Privacy Policy

1. Who processes your data

The data controller is the operator of Predel Hut:

• Entity: ET "BIROV-GOMO-OGNYAN-STOILOV" (ЕТ „Биров - Гомо - Огнян Стоилов“)
• Company reg. no. (EIK/Bulstat): 101039391
• Address: Predel saddle (1,050 m), between Razlog and Simitli, Bulgaria
• Email: hello@predelhut.bg
• Phone: +359 887 549 704

Given the scale of our activity we are not required to appoint a Data Protection Officer. For anything concerning your personal data, write to hello@predelhut.bg.

2. What we collect and why

We only collect what you give us yourself through the booking form - we do not buy data or gather it from third parties.

We do not collect special categories of data (health, ethnicity, religion and the like) through the site, and we ask you not to send us any.

The site is not directed at children and we do not knowingly collect data about anyone under 18. Bookings are made by an adult, who is responsible for the guests accompanying them.

Accounting records

Where a booking led to an actual stay, its details also form part of our accounting records. Those records are kept longer than the 12 months stated above - for the period required by the Bulgarian Accountancy Act and tax legislation. The basis for this is Article 6(1)(c) GDPR (compliance with a legal obligation), not your consent. At the end of each month the system writes a copy of the requests to a separate archive file on the same server, not reachable over the internet, which is then also kept offline. These records are used solely for accounting and tax purposes.

3. Do you have to provide the data

Providing the data is voluntary, but it is necessary for us to process your request. Without it we cannot send you a confirmation - you are always welcome to book by phone instead.

4. Who we share it with

We do not pass your data to third parties for their own purposes. Only the following service providers (processors) have access, and only as far as necessary:

• Hostinger - the EU virtual server that runs the site and stores the booking database.
• Hostinger Mail - sending and receiving the booking confirmation emails.
• Google Fonts - the site's typefaces load from Google's servers, in the course of which Google receives your IP address.
• Google Maps - the map at the bottom of the home page is embedded from Google; loading it gives Google your IP address and may set its own cookies.
• The links to Facebook, Instagram, TikTok, Messenger, WhatsApp and Google Reviews lead to external sites. We pass them no data, but once you open them their own privacy policies apply.

We do not sell or rent personal data. We do not use your data for automated decision-making or profiling.

Booking data is stored on a server within the European Union. Google may process data outside the EU, on the basis of the Standard Contractual Clauses approved by the European Commission.

5. Cookies and similar technologies

The site uses no analytics, advertising or tracking cookies. What we do use:

• Local storage (“predel-lang”) - remembers only whether you are reading the site in Bulgarian or English. It is strictly necessary for the language switch to work and needs no consent.
• Google cookies - the embedded Google Maps frame may set its own cookies when the page loads. You can restrict these through your browser settings.

The web server logs only the request method, the path and the response code. We do not record IP addresses in the application logs.

6. How we protect your data

We apply appropriate technical and organisational measures:

• All traffic to the site is encrypted (HTTPS).
• The booking database and configuration files are not reachable over the web - the server only serves the site's pages and images.
• The admin dashboard is protected by a secret key, and the confirmation links in the email are single-use and carry a unique token.
• Only the hut's operator has access to the data.

In the event of a security breach likely to result in a high risk to your rights, we will notify you and the Commission for Personal Data Protection within 72 hours, as required by Articles 33 and 34 GDPR.

7. Your rights

In relation to your personal data you have the right to:

• Access - to obtain a copy of the data we hold about you.
• Rectification - to have inaccurate or incomplete data corrected.
• Erasure (“the right to be forgotten”) - to have your data deleted when it is no longer needed. Records we are required by law to keep (see “Accounting records” above) are an exception: we cannot delete those before the statutory period expires.
• Restriction of processing - in the cases set out in Article 18 GDPR.
• Portability - to receive your data in a machine-readable format.
• Objection - to processing based on legitimate interests.
• Withdrawal of consent - where processing is based on consent, at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, write to hello@predelhut.bg. We respond within one month. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act.

8. Right to complain

If you believe we are processing your data unlawfully, you may lodge a complaint with the supervisory authority:

• Commission for Personal Data Protection (CPDP)
• 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• kzld@cpdp.bg
• www.cpdp.bg

9. Changes to this policy

We may update this policy if our services or the law change. The current version is always available at this address, and the date at the top shows when it was last revised.