Privacy policy

Last updated: 13 October 2026

This is an English translation; if it differs from the Bulgarian text, the Bulgarian text prevails.

This policy explains what personal data we collect when you write to us, book or stay at the hotel and when you browse the website hoteletar.com, what we use it for, how long we keep it and what rights you have. We comply with the General Data Protection Regulation – Regulation (EU) 2016/679 (“the Regulation”) – and the Personal Data Protection Act (ЗЗЛД).

In brief

We use your data to reply to your enquiry, prepare your reservation and check you in.
On check-in, the law requires us to enter the details from your identity document in the register of accommodated tourists. We do not copy, scan or photograph the document.
We do not sell data and do not use it for marketing without your explicit consent.
The Google map on the Contact page loads only if you agree.
At any time you can ask to see, correct or delete your data. Write to us at book@hoteletar.com.

1. Who is responsible for your data

Hotel Etar is operated by „Интер Турс Къмпани“ ЕООД. The company is the controller of your personal data under the Regulation and the Personal Data Protection Act. This means that it decides why and how the data is processed. When we write “we” or “the hotel” in this text, we mean this company.

Company: „Интер Турс Къмпани“ ЕООД
Unified Identification Code (UIC): 206681066
VAT number: BG206681066
Registered office and management address: гр. Велико Търново 5000, ул. „Ивайло“ № 6 (6 Ivaylo Street, 5000 Veliko Tarnovo, Bulgaria)
Hotel Etar: 6 Ivaylo Street, 5000 Veliko Tarnovo, Bulgaria
Phone: +359 892 217 915
Email: book@hoteletar.com

For any question about personal data, write to us at book@hoteletar.com, call us or ask us at reception.

Since 25 May 2018, data controllers no longer register with the Commission for Personal Data Protection (КЗЛД). That is why we do not have a controller number.

2. Whose data we process

people who write to us or call us – through the website forms, by email or by phone;
hotel guests, including the children who stay with them;
people who book for others – for their family, friends or colleagues;
representatives of companies who ask for an invoice;
visitors to the website – technical data only (section 3.5).

3. What data we collect and where from

3.1. From the website forms

The website has three forms: the enquiry window on the homepage, the enquiry form on each room’s page and the form on the Contact page.

In every form you fill in your name, email address and phone number. The form cannot be sent without them.
In the enquiry forms you also give your arrival and departure dates and the number of guests. If you wish, you can choose a room type and write a message.
In the contact form you choose a subject (general question, reservation or longer stay) and write a message.

The website automatically adds to the enquiry its reference number, the date and time it was sent, the language of the page, the number of nights and of rooms needed, and the nightly rate and total price at the time of the enquiry.

The enquiry is saved in the website’s database. Immediately afterwards, the hotel receives an email at book@hoteletar.com with the same details, including your message. We reply to you by email or by phone.

You may also receive an automatic email confirming that we have received your enquiry. It contains the enquiry reference number and your name and, for a booking enquiry, also the room, the dates and the number of guests. Your message is not repeated in it.

We do not ask for your address, details from your identity document, your date of birth or card details through the website. Please do not include them in your message either. No payment is made on the website.

Your IP address is not stored with the enquiry.

3.2. By email, by phone and at reception

When you write to us or call us directly, we receive your name, your email address or phone number and whatever you tell us. We keep the emails in the hotel’s mailbox.

3.3. On check-in

Article 116 of the Tourism Act (ЗТ) requires us to enter every guest in the register of accommodated tourists on check-in. That is why you show a valid identity document – an identity card or a passport – at reception.

We enter only the details the law requires:

full name and personal number – for Bulgarian citizens, the Unified Civil Number (ЕГН) – as written in the document;
the type, number and date of issue of the document;
the dates of arrival and departure;
for citizens of certain countries outside the European Union, the details required by Article 28, paragraph 4 of the Foreigners in the Republic of Bulgaria Act (ЗЧРБ): names, date of birth, citizenship, passport number and period of stay.

These details are submitted to the Unified Tourist Information System (ЕСТИ) of the Ministry of Tourism. We do not copy, scan or photograph the document. The Personal Data Protection Act allows a copy of an identity document to be made only where this is provided for by law (Article 25d).

During your stay we also process data about the stay itself: the room, the dates, payments, receipts and invoices. For an invoice we need the company’s details – for example its name, UIC and address. We also note anything you ask of us in connection with your stay, for example that you will arrive late in the evening.

We do not ask for data about your health. If you tell us anything like this yourself because it matters for your stay (for example an allergy or reduced mobility), we use it only for that purpose and only if you explicitly agree.

3.4. From other people

If your reservation was made by another person or a company, we receive your name and the details of the stay from them. Anyone who books for others must tell them about this policy.

3.5. Technical data from the website

Security cookie. When you send a form, the website sets the ETAR_SESSION cookie. It holds a random code that tells the website the enquiry comes from its own form. It is deleted when you close your browser. The related record on the server is kept for a short time and deleted automatically.
Protection against abuse. To stop enquiries being sent in bulk, the website counts how many enquiries arrive within a short time from one IP address and from one email address. For this it does not store the address and the email themselves but an encoded form of them, from which they cannot be read directly, together with the time of the enquiry. These records are deleted after 7 days.
Server logs. The hosting provider keeps technical records of visits to the website: IP address, date and time, the page opened and the browser type. They are used for the security and operation of the website and are kept only for as long as they are needed for that purpose.
Your cookie choice. When you choose “Accept all” or “Necessary only”, your browser remembers your choice for 12 months in the etar_consent cookie. The website does not store your choice anywhere else.

The website does not use any analytics, advertising or visitor-tracking tools.

4. What we use the data for and on what legal basis

We process data only when we have a legal basis for it under Article 6 of the Regulation and, for health data, also under Article 9.

Replying to enquiries and preparing reservations. Basis: steps taken at your request before entering into a contract (Article 6(1)(b)). If you ask about something not related to a stay, the basis is our legitimate interest in replying to people who write to us (point (f)).
The reservation and the stay – check-in, services, payment and keeping in touch with you before and during your stay. Basis: our contract with you (point (b)).
The register of accommodated tourists and the registration of foreign nationals. Basis: legal obligation under Article 116 of the Tourism Act and Article 28 of the Foreigners in the Republic of Bulgaria Act (point (c)).
Accounting and taxes – receipts, invoices, tourist tax. Basis: legal obligation under the Accountancy Act (ЗСч), the Value Added Tax Act (ЗДДС) and the Local Taxes and Fees Act (ЗМДТ) (point (c)).
Claims about our services. Basis: legal obligation under the Consumer Protection Act (ЗЗП), which requires us to keep a register of claims (point (c)).
Requests from public authorities – courts, the prosecutor’s office, the police and others, when the law requires us to give them data. Basis: point (c).
Website security and protection against abuse – the security cookie, the limit on the number of enquiries, the server logs. Basis: our legitimate interest in protecting the website and the data in it (point (f)).
Protecting our rights in a dispute. Basis: our legitimate interest in establishing, exercising or defending our rights (point (f)).
The Google map on the Contact page. Basis: your consent (point (a)) and Article 4a of the Electronic Commerce Act (ЗЕТ). Without consent the map does not load.
Health data you give us yourself (for example an allergy or reduced mobility) – so that we can take it into account during your stay. Basis: your explicit consent (Article 9(2)(a)). You can withdraw it at any time.

When the basis is our legitimate interest, we use only as much data as is needed and make sure that our interest does not override your rights. You can object to such processing (section 9).

5. Do you have to give us your data?

Your name, email address and phone number in the forms are needed so that we can reply to you. Without them the enquiry cannot be sent. The message in the enquiry forms is optional.
The details from your identity document on check-in are required by law. Without a valid document we cannot enter you in the register of accommodated tourists and therefore cannot check you in.
You give us invoice details only if you want an invoice.
Whether you consent to the Google map is entirely up to you. The hotel’s address and the link to Google Maps are on the Contact page even without the map.

6. Who receives your data

Your data is seen only by hotel staff who need it for their work. We pass it to others only in the following cases:

The hosting and email providers. The website and the database with the enquiries are on servers in the European Union. Emails to book@hoteletar.com are kept by the provider of the mailbox. These providers process the data on our behalf, as processors (Article 28 of the Regulation).
The Ministry of Tourism, through the Unified Tourist Information System. Under Article 116, paragraph 7 of the Tourism Act, all data in the system is accessible to the Minister of Interior and the State Agency for National Security (ДАНС). Veliko Tarnovo Municipality and the National Revenue Agency (НАП) see the number of guests, their citizenship and the number of nights, and the National Statistical Institute (НСИ) sees aggregated data for statistics.
Other public authorities – for example courts, the prosecutor’s office, the police, the National Revenue Agency or the Commission for Consumer Protection (КЗП) – when the law requires it and only to the extent necessary.
Banks that handle the payment, when you pay by bank transfer.
Google – only if you choose to view the map (section 7).

We do not sell data and do not give it to others for advertising. We do not use your data for marketing messages without your separate, explicit consent.

7. Data outside the European Union

The website and the database with the enquiries are on servers in the European Union. If we need to transfer personal data outside the European Union, we do so only under the conditions set out in Chapter V of the Regulation.

The Google map on the Contact page loads only if you choose to view it. In that case your browser sends Google your IP address, the address of the page and information about your browser, and Google may set or read its own cookies. For users in the European Union, the company responsible for this data is Google Ireland Limited, which may transfer it to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Commission Implementing Decision (EU) 2023/1795).

We decide only whether the map is loaded. What Google then does with the data is decided by Google under its own rules – see Google’s privacy policy.

8. How long we keep data

Enquiries and questions that did not lead to a stay, and the related emails – 12 months after our last contact with you. We then delete them from the database and the mailbox.
Reservations, including cancelled ones, and the related emails – 5 years after the end of the year in which the stay took place or was due to take place – the length of the general limitation period under the law (Article 110 of the Obligations and Contracts Act, ЗЗД).
The details we enter for the register of accommodated tourists – 5 years after the end of the year of the stay – the length of the limitation period for the tourist tax. The data submitted to ЕСТИ is kept there under the rules of the system.
Accounting documents – receipts, invoices, payment documents – 10 years from 1 January of the year following the year to which they relate (Article 12 of the Accountancy Act).
Claims and our replies – 5 years after the end of the year in which the claim was closed – the length of the general limitation period under the law.
Abuse-protection records – 7 days.
Server logs – only for as long as they are needed for the security and operation of the website.
The security cookie – until you close your browser. The cookie with your choice – 12 months. Google cookies – according to Google’s rules.

If there is a dispute or an inspection by a public authority, we keep the data needed until the dispute or inspection is over. Once the retention period has expired, we delete the data or change it so that it can no longer be linked to you.

9. Your rights

Under the Regulation you have the following rights:

access – to find out whether we process data about you and to receive a copy of it (Article 15);
rectification – to have us correct inaccurate data or complete incomplete data (Article 16);
erasure – to have us delete your data when it is no longer needed or there is no basis for keeping it (Article 17). We cannot delete data that the law requires us to keep, for example the register of accommodated tourists and accounting documents;
restriction – to have us temporarily stop using the data, for example while we check whether it is accurate (Article 18);
portability – to receive the data you have given us in a machine-readable file, or to have us send it to another controller, where we process it under a contract or with your consent (Article 20);
objection – to object to processing based on our legitimate interest (Article 21). We then stop, unless we have compelling grounds to continue or need the data to defend ourselves in a dispute;
withdrawal of consent – to withdraw your consent at any time (Article 7(3)). For the Google map, you do this through the “Cookie settings” link at the bottom of every page. Withdrawal takes effect for the future and does not make anything we did before it unlawful.

If we correct or delete data, we also tell those to whom we have disclosed it, unless this proves impossible or involves disproportionate effort (Article 19).

10. How to exercise your rights

Write to us at book@hoteletar.com, send a letter to our address (section 1) or tell us at reception. Say which right you wish to exercise and for which data. If it concerns an enquiry from the website, please include its reference number.

So that we do not give your data to someone else, we may ask you to confirm that it is really you – for example by writing to us from the email address you used for the enquiry, or by showing an identity document at reception. We do not ask for more data than is needed for this.

We reply without undue delay and within one month at the latest. If the request is complex or there are many requests, this period may be extended by up to two further months. In that case we let you know before the end of the first month.

Exercising your rights is free of charge. Only for manifestly unfounded or excessive requests, for example ones that are repeated many times, may we charge a reasonable fee or refuse, explaining why.

11. Lodging a complaint with the Commission for Personal Data Protection

If you think we are infringing your rights, write to us – we will do our best to resolve the matter. You also have the right to lodge a complaint at any time with the Commission for Personal Data Protection:

address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia
phone: 02/91-53-519
email: kzld@cpdp.bg
website: cpdp.bg

If you live or work in another country of the European Union, you can also lodge a complaint with the data protection authority there. You can also go to court.

12. Automated decisions

We do not make decisions based solely on automated processing and do not use your data for profiling. The only automated action is the website’s protection: if many enquiries arrive from one IP address or email address within a short time, the website temporarily stops accepting new ones. If that happens, write to us or call us.

13. Children

We process data about children who stay at the hotel only as far as the law requires (for example for the register of accommodated tourists) or as far as is needed for the stay.

14. How we protect data

The database with the enquiries is in a separate folder on the server, outside the public part of the website, and cannot be opened from the internet.
Only authorised hotel staff can access the enquiries in the website’s administration area and the mailbox, and only with a password.
No card details are collected through the website.

If a security breach occurs that could seriously affect your rights, we will notify you without undue delay. Where the Regulation requires it, we also notify the Commission for Personal Data Protection (Articles 33 and 34).

15. Cookies

The website uses only the cookies it needs. Google cookies are set only if you agree to view the map. Details are in our cookie policy.

16. Changes to this policy

We update this policy when we change the way we handle data or when the law changes. The date of the last update is at the top of this page. If we decide to use your data for a new purpose, we will tell you in advance.