PRIVACY AND PERSONAL DATA PROTECTION POLICY FOR CUSTOMERS

Hostel “Penev”

Please read carefully the Customer Personal Data Protection Policy of Hostel Penev (hereinafter referred to as the “Policy”), which aims to explain the practices related to the processing of personal data in the context of the services provided and activities performed.

This Policy has been drawn up in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation).

CUSTOMER PERSONAL DATA PROTECTION POLICY OF HOSTEL PENEV

I. GENERAL PROVISIONS

Art. 1. In providing its services and carrying out its activities, Hostel Penev processes, as a data controller, the personal data of its customers – natural persons, as well as the personal data of other natural persons specified below (hereinafter referred to as Data Subjects), guided by the rules and principles provided for in this Policy.

Art. 2. Hostel Penev is managed by “Penevi Group” EOOD, a company with UIC 203756791, with its registered office and management address at: Stara Zagora, Bogomilovo village, 8 Bor St. The address of Hostel Penev is: Stara Zagora, 51 Anton Marchin St. (southern entrance), phone: +359 878 889 735 / +359 878 889 725, email address: [email protected].

VAT number: BG203756791.

II. DATA SUBJECTS

Art. 3. (1) In connection with the services provided, Hostel Penev processes information regarding the following Data Subjects:

(a) natural persons who make reservations in their own name or on behalf of another natural or legal person via the website of Hostel Penev, http://hostelpenev.com/

(hereinafter referred to as the Website);

(b) natural persons visiting the Website;

(c) natural persons using the services provided by Hostel Penev, including hotel accommodation services, restaurant services, event organization and other similar services, as well as natural persons representing or otherwise acting on behalf of legal entities using these services;

(d) natural persons who have submitted, on their own behalf or on behalf of another person they represent, inquiries (via phone call, use of Website functionalities, email, fax, etc.), requests, alerts, complaints or other correspondence to Hostel Penev;

(e) natural persons whose information is contained in inquiries (via phone call, use of Website functionalities, email, fax, etc.), requests, alerts, complaints or other correspondence to Hostel Penev.

(2) The services of Hostel Penev may only be requested by legally capable persons who have reached the age of 18.

III. CATEGORIES OF PERSONAL DATA

Art. 4. The information (categories of personal data) that Hostel Penev processes regarding Data Subjects in accordance with this Policy may include:

1. In connection with the provision of hotel accommodation services:

(a) Identification data: names of the guest; date of birth; gender; nationality; national identification number (such as EGN for Bulgarian citizens) and/or ID document number; date of ID document issuance; ID document validity; country of ID document issuance; signature.

(b) Contact details: phone number; email address; address.

(c) Information related to hotel accommodation: room number; floor; dates of stay (arrival and departure dates); duration of stay (number of overnight stays completed); use of a tourist package; room type preference; guest status.

(d) Additional information related to hotel accommodation upon explicit request by the service user: special requirements and preferences, including for type of press (if Hostel Penev starts offering such a service), food and beverages; special requirements related to food products, drinks and other substances that the guest must be prevented from coming into contact with (regardless of the reason).

2. Data related to payments and invoice issuance:

Information on payment method (cash, bank transfer, credit card, etc.); information on due and executed payments; information on payment terms and overdue/unpaid obligations; bank information (bank, IBAN, bank account holder); currency of the payment made; credit/debit card number, validity and holder; CVC code; data contained in a payment authorization form (slip); name of legal entity; address of legal entity; VAT number and/or other identification, tax or registration number (EGN for natural persons); authorization forms (signed).

3. In connection with the provision of restaurant services:

(a) Identification data: names.

(b) Contact details: phone number; email address; address.

(c) Data related to payments and invoicing: credit/debit card number, validity and holder; CVC code; name of legal entity; address of legal entity; VAT number and/or other tax or registration number (for sole proprietors and natural persons); authorization forms (signed).

(d) Information related to preferences (upon explicit request by the user): food and beverage preferences; preferred payment method; special requirements related to food products, drinks and other substances that the guest must be prevented from coming into contact with (regardless of the reason).

4. In cases where the Data Subject represents another person (e.g., a company):

Information on which person and in what capacity (including workplace, position), as well as information on the requested services/orders placed in this capacity. Correspondingly, in cases where services are requested by a person other than the Data Subject for the benefit of the Data Subject – in what capacity the Data Subject will use the services, by whom they were requested, by whom the payment will be made, and other similar details (e.g., in case of accommodations organized by an employer or business partner of the Data Subject).

5. In connection with the issuance of discount customer cards:

(a) Identification data: names.

(b) Information regarding the discount that can be used with the respective customer card.

6. In connection with the services and functionalities of the Website:

(a) Data processed in connection with making a hotel accommodation reservation: names; email address; phone number; country; credit/debit card number, validity and holder; CVC code; number of rooms; number of guests, including number of adults and number of children; corporate code / access code; event participant and/or group accommodation code; reservation number; special offers and guest preferences (upon explicit indication in the reservation form).

(b) Unstructured content from conversations and inquiries addressed to a reservation officer via Website functionalities.

(c) Information from account login logs, server logs, and logs from web application firewalls (WAF) and other devices falling into this category: date and time, IP address, URL, browser and device information. AT THIS MOMENT, THE WEBSITE OF HOSTEL PENEV DOES NOT RECORD OR STORE THIS INFORMATION.

(d) THE WEBSITE OF HOSTEL PENEV does not support so-called “Cookies” and DOES NOT USE information from such sources.

(e) In connection with complaints, statements, requests, petitions and alerts submitted by customers (including in free text): unstructured information contained in the respective complaints, statements, requests, petitions and alerts.

IV. VIDEO SURVEILLANCE AND SECURITY

Art. 5. (1) In accordance with the requirements of applicable legislation, Hostel Penev applies security measures that include the following technical and organizational means for access control and ensuring physical security against encroachments on buildings and facilities, as well as protecting the life and health of citizens: physical security, security alarm systems, and a video surveillance system performing 24-hour video monitoring consisting of recording and storage devices.

(2) Video surveillance and recording may be carried out in publicly accessible areas and rooms within the buildings of Hostel Penev and in those for which a special access regime is provided or envisaged. Video surveillance is not carried out in guest rooms, sanitary and hygienic facilities, etc. Data from video surveillance activities is stored in an administrative room with restricted access to recording devices, which are under 24-hour observation.

(3) Through information boards placed in prominent locations, Data Subjects and other visitors who may be filmed are notified of the use of technical surveillance and control equipment and of any other relevant information regarding the monitoring performed.

V. DIRECT MARKETING

Art. 6. (1) Upon the explicit consent of the Data Subject, Hostel Penev, respectively other companies associated with or partners of Hostel Penev, may process the following personal data: names; phone number; address; email address; information on the type and volume of used and preferred services provided by Hostel Penev; and other data explicitly mentioned in the respective consent, for direct marketing purposes such as offering other goods and services, including offering goods and/or services offered by third parties, conducting surveys and questionnaires in order to improve the quality of services provided, and the like, in accordance with the scope of the specifically given consent.

(2) When personal data is processed for direct marketing purposes, the Data Subject has the right to object at any time to such processing of personal data. In such cases, the processing of personal data for these purposes shall be discontinued.

(3) The Data Subject has the right to withdraw their consent for the processing of personal data for direct marketing purposes at any time. In such cases, the processing of personal data based on the given consent shall be discontinued.

(4) Profiling for direct marketing purposes may be carried out solely with the explicit consent of the Data Subject, applying at least the following additional safeguards for their rights and interests: the right to human intervention on the part of the controller; the right to express their point of view and the right to contest decisions based on profiling.

VI. PURPOSES OF PERSONAL DATA PROCESSING

Art. 7. Hostel Penev collects, stores, and processes the information described in Articles 4, 5, and 6 above for the purposes provided for in this Policy and in the general terms and rules (contract) for using the respective services it provides. Depending on the legal basis for processing, these purposes may be:

(a) purposes related to compliance with legal obligations of Hostel Penev;

(b) purposes related to and/or necessary for the performance of contracts concluded with Hostel Penev or for taking steps at the request of the Data Subject prior to entering into a contract;

(d) purposes for which the Data Subject has given consent for the processing of their data.

Art. 8. The purposes of personal data processing by Hostel Penev related to compliance with legal obligations include:

keeping a register of accommodated tourists and submitting information from it to the competent authorities in the statutory manner;
address registration of foreigners in accordance with the requirements of applicable legislation;
withholding and payment of tourist tax;
activities related to the development and implementation of counter-terrorism measures;
handling alerts, complaints, requests for the exercise of rights and the like, as well as claims and commercial guarantees (if applicable), including the preparation of responses thereto;
bookkeeping, invoicing, and reporting of received and executed payments in accordance with applicable tax and accounting legislation;
other activities for the fulfillment of legal obligations (tax, accounting, regulatory, licensing, etc.) of Hostel Penev related to providing information to competent state and judicial authorities and assisting in inspections by competent authorities.

Art. 9. The purposes of personal data processing by Hostel Penev related to and/or necessary for the performance of contracts or for taking steps at the request of the Data Subject prior to entering into a contract with Hostel Penev include:

accepting, administering, and processing reservations and cancellations thereof;
customer service, including the provision of online services via the Website;
communication related to the services provided;
administration and collection of payments for the provided services, including remotely;
providing a guarantee (where provided for) for made reservations and for the payment of hotel accommodation and additionally requested services;
financial and accounting activity and administration, processing, and collection of due payments for provided services;
refunding incorrectly transferred amounts;
ensuring an individualized approach in providing services, in accordance with the preferences stated by their users.

Art. 10. The purposes of personal data processing related to the pursuit of the legitimate interests of Hostel Penev or third parties include:

1. Legitimate interest – (1.1.) exercising and defending the legal rights and interests of Hostel Penev; and (1.2.) assisting in the exercise and defense of the legal rights and interests of customers; other persons associated with Hostel Penev; employees of Hostel Penev; data processors on behalf of Hostel Penev; and commercial partners of Hostel Penev:

(a) establishment, exercise, or defense of legal claims of the persons mentioned above under item (1.1) and item (1.2), including in court proceedings, inter alia submission of complaints, alerts, etc., to competent state and judicial authorities;

(b) video surveillance and access control for the purpose of protecting the property of Hostel Penev, proving compliance with applicable requirements, ensuring physical security against encroachments on buildings and facilities, and protecting the life and health of citizens;

(c) taking actions to suspend the provision of services in case of refusal of payment, violation of rules and policies established by Hostel Penev, etc.;

(d) administration and handling of received complaints, alerts, petitions, etc.;

(e) collection of receivables due to Hostel Penev, including by enforcement order and/or through assignment to third parties, as well as transfer of receivables to third parties (assignment of claims/cessions) in the manner established by law;

(f) sending notary invitations.

2. Legitimate interest – analysis, planning, and enhancement of the quality of services provided by Hostel Penev:

(a) maintaining a copy of data from the internal information system regarding the current status of the hostel (occupancy, liabilities, etc.) in case of IT system failures;

(b) receiving, processing, and preparing responses to submitted applications, petitions, etc., unrelated to complaints and grievances regarding the used Services;

(d) control, analysis, and optimization of business processes to improve service quality.

3. Legitimate interest – ensuring the normal operation and use of the Website:

(a) maintenance and administration of the Website;

(b) detection and resolution of technical issues with Website functionalities;

4. Legitimate interest – carrying out hotel and restaurant operations and ensuring quality hotel and restaurant services:

(a) administration and management of services provided by Hostel Penev;

(b) management and quality control of the provided services;

Art. 11. The purposes of personal data processing based on consent given by the Data Subject include:

Sending marketing and promotional messages regarding services, special offers, packages, events, and the like;
Surveys and gathering feedback regarding service quality;
Sending newsletters;
Other purposes for which consent has been specifically provided by the Data Subject.

VII. PROVISION OF PERSONAL DATA AND CONSEQUENCES OF REFUSAL TO PROVIDE IT TO HOSTEL PENEV

Art. 12. (1) Hostel Penev clearly indicates, where applicable and in an appropriate manner, whether the provision of the respective data and/or documents is mandatory or constitutes a requirement necessary for the conclusion or performance of a contract, as well as the consequences of a refusal to provide them.

(2) If additional clarifications are needed, any Data Subject may request them at the premises of Hostel Penev or submit an inquiry to the contacts specified in Article 23 of this Policy.

(3) Refusal to provide data and documents designated as mandatory may constitute an insuperable obstacle to the provision of a service by Hostel Penev, or to the satisfaction and execution of submitted requests, applications, petitions, alerts, etc., which releases Hostel Penev from liability for non-performance.

(4) Refusal to provide data and documents or providing incorrect ones may lead to the impossibility of providing the respective services or to the suspension of access to services provided by Hostel Penev.

(5) Data Subjects should not provide Hostel Penev with any special categories of data within the meaning of Art. 9 and Art. 10 of the Regulation (namely: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation; and personal data relating to criminal convictions and offenses).

VIII. OTHER SOURCES OF PERSONAL DATA

Art. 13. (1) In some cases, the personal data processed by Hostel Penev are not collected or received directly from the Data Subject to whom they refer, but from third parties such as:

Persons representing, working for, or otherwise cooperating with a Data Subject;
Event organizers – regarding information about event participants;
Commercial partners of Hostel Penev (e.g., reservation websites, travel agents, other persons providing intermediary services in making reservations or requesting other services, and the like);
Competent state and judicial authorities.

(2) The persons under para. 1, items 1-3 undertake to inform the Data Subjects whose data they provide to Hostel Penev and to ensure that they provide the data on the basis of a valid legal ground.

IX. PROCESSING OF INFORMATION BY THIRD PARTIES – DATA PROCESSORS

Art. 14. (1) For the purposes specified in this Policy, Hostel Penev may assign personal data processing activities to third parties – data processors, in accordance with and within the framework of the requirements of the Regulation and other applicable data protection rules.

(2) When personal data is disclosed to and processed by data processors, this shall happen only to the extent and volume necessary for the performance of the tasks assigned to them by Hostel Penev.

(3) Data processors act on behalf of Hostel Penev and are obligated to process personal data solely and exclusively in strict compliance with the instructions of Hostel Penev, and have no right to use or process the information in any other way for purposes other than those specified in this Policy.

X. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Art. 15. Hostel Penev does not disclose personal data regarding the Data Subject to third parties, except in cases where:

This is necessary for the fulfillment of a legal obligation of Hostel Penev:
(a) competent state, municipal, or judicial authorities;
(b) auditors;
This is explicitly provided for in the Policy and/or in the general terms and rules (contract) for using the respective services provided by Hostel Penev:
(a) data processors commissioned by Hostel Penev;
(b) debt collection agencies.
This is necessary for the provision of Hostel Penev’s services:
(a) banks and payment service providers;
(b) postal and courier service providers;
(c) commercial partners of Hostel Penev such as: reservation websites, travel agencies, and other providers of travel or auxiliary services such as car rentals, taxi and other transport services, and the like.
The Data Subject has given explicit consent – the persons provided for in the respective consent (e.g., affiliated with Hostel Penev, commercial partners of Hostel Penev, and the like);
This is necessary to protect the rights or legitimate interests of Hostel Penev, third parties, or the Data Subject:
(a) state, municipal, and judicial authorities;
(b) private and state bailiffs;
(c) attorneys/lawyers;
(d) notaries.
In other cases provided for by law.

XI. STORAGE PERIOD OF PERSONAL DATA

Art. 16. (1) Hostel Penev processes and stores information regarding the Data Subject until the achievement of the respective purposes for which it was collected and is processed.

(2) Hostel Penev, in accordance with its internal rules and procedures and applicable legislation, processes and stores information regarding the Data Subject for the following periods:

Types of Data	Storage Period
Data for the register of accommodated tourists within the meaning of Art. 116 of the Tourism Act, which include identification data of accommodated persons and data related to hotel accommodation.	In accordance with the procedure and period provided for in the Tourism Act and subordinate legislation.
Information related to requested and used hotel accommodation services, events, and restaurant services, including canceled hotel accommodation reservations (insofar as they are related to the refund of prepaid amounts and/or withholding of due amounts).	From the execution of the respective reservation/request up to 5 (five) years from the provision of the service / completion of contract performance / cancellation of the reservation. In cases where services are requested and used based on a long-term contract, the period starts from the final performance and/or termination of the contract.
Financial and accounting documents; invoices; authorization forms; other information related to tax and social security control.	Up to 10 (ten) years, starting from the beginning of the year following the year in which payment of the obligation for the respective year is due.
Unstructured communication, correspondence, complaints, alerts, etc.	5 years. In cases where the correspondence relates to a long-term contract, the period starts from the final performance and/or termination of the contract.
Data related to restaurant service reservations made by phone.	Up to 1 year.
Action log for profile registration requests or product purchase requests with or without a registered profile on the Website (information such as: action/request content, date and time, IP address, etc. is stored).	If Hostel Penev uses and maintains such information (service), for the entire period of maintaining the profile registration on the Website and up to 5 (five) years after its termination (if any). If Hostel Penev uses and maintains such information (service), up to 5 (five) years from the execution of the requested purchase (if made without a registered profile).
Video recording data.	Up to 3 months.
Data contained in feedback forms.	Information from feedback forms is entered in an anonymized form (solely the feedback, received reviews, and recommendations) without any information about the person who provided this feedback in the internal systems of Hostel Penev, after which the forms are destroyed immediately. If Hostel Penev uses and maintains such information, up to 30 days from their completion.
Data processed based on the explicit consent of the Data Subject (e.g., Praise Book, etc.).	From the moment of granting consent until its withdrawal by the Data Subject.

The personal data specified in this Policy may also be processed for a longer period than those specified above if necessary to achieve the purposes provided for herein or to protect the rights and/or legitimate interests (including judicial) of Hostel Penev (Penevi Group EOOD), or if current legislation provides for data processing for a longer period.

XII. RIGHTS OF DATA SUBJECTS REGARDING THEIR PERSONAL DATA

Art. 17. (1) In connection with the processing of personal data relating to them, every Data Subject has the following rights:

Right to information – to obtain information regarding the processing of their personal data by Hostel Penev;
Right of access:
(a) to obtain confirmation as to whether or not personal data concerning them are being processed;
(b) to obtain access to the processed personal data and detailed information regarding the processing and their rights.
Right to rectification – to request the correction or completion of their personal data if it is inaccurate or incomplete;
Right to erasure (“right to be forgotten”) – to request the erasure of their personal data if the grounds provided for in the Regulation exist;
Right to restriction of processing – to request Hostel Penev to restrict the processing of their personal data within the framework provided for in the Regulation, if the grounds provided therein exist;
Notification of third parties – the right to request Hostel Penev to notify third parties to whom their personal data have been disclosed of any rectification, erasure, or restriction of processing carried out, unless this proves impossible or involves disproportionate effort for Hostel Penev;
Right to data portability – to receive the personal data concerning them, which they have provided to Hostel Penev, in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from Hostel Penev.
The right to data portability applies when both of the following conditions are met:
(a) processing is based on consent or on a contractual obligation; and
(b) processing is carried out by automated means.
Where technically feasible, the Data Subject has the right to have the personal data transmitted directly from Hostel Penev to another controller. The right to data portability may be exercised in a manner that does not adversely affect the rights and freedoms of others.
Rights in relation to automated individual decision-making, including profiling – not to be subject to a decision based solely on automated processing (i.e., processing without human intervention), including profiling within the meaning of the Regulation, which produces legal effects concerning the Data Subject or similarly significantly affects them, unless the grounds provided for in the Regulation exist and appropriate safeguards for the protection of the Data Subject’s rights, freedoms, and legitimate interests are established. Such safeguards shall include at least the right to obtain human intervention on the part of Hostel Penev, the right to express their point of view, and to contest the decision.
If such a decision, including profiling, is taken regarding the Data Subject, for each specific case the Data Subject has the right and will receive from Hostel Penev separate substantial information regarding the logic used, significance, and envisaged consequences of such processing for them, as well as the manner of exercising the rights under this point.
Right to withdraw consent for processing – where the processing of personal data is based solely on consent given by the Data Subject, they may withdraw their consent at any time. Such withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.

XIII. RIGHT TO OBJECT

Art. 18. The Data Subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them, including profiling within the meaning of the Regulation, which is based on public interest, the exercise of official authority, or the legitimate interests of Hostel Penev or a third party. In such cases, Hostel Penev shall cease the processing of personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of legal claims.

XIV. PROCEDURE FOR EXERCISING RIGHTS

Art. 19. (1) The Data Subject may exercise their rights related to personal data protection by personally submitting a corresponding written request to Hostel Penev – submitted in person by the Subject at the address specified in Article 23 of this Policy or via a notarized request sent by mail.

(2) The request under para. 1 may also be exercised electronically, for which purpose it must be signed by the Data Subject with a qualified electronic signature within the meaning of the Electronic Document and Electronic Certification Services Act and Art. 3, point 12 of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, and sent to Hostel Penev at the email address specified in Article 23 of this Policy.

(3) The Data Subject may exercise the rights related to their personal data personally or through an expressly authorized person (with a notarized power of attorney).

(4) Some of the rights may also be exercised via the functionalities available on the Website.

XV. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Art. 20. Every Data Subject has the right to lodge a complaint with a supervisory authority for personal data protection, in particular in the EU/EEA Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that the processing of personal data relating to them infringes the provisions of the Regulation or other applicable data protection requirements.

XVI. SUPERVISORY AUTHORITY IN THE REPUBLIC OF BULGARIA

Art. 21. The supervisory authority in the Republic of Bulgaria is:

Commission for Personal Data Protection

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Website: https://www.cpdp.bg/

XVII. RESTRICTIONS ON RIGHTS

Art. 22. The scope of the rights of Data Subjects and the obligations of Hostel Penev in connection with these rights may be restricted through a legislative measure under EU or Member State law applicable to Hostel Penev.

XVIII. CLARIFICATIONS AND ADDITIONAL INFORMATION

Art. 23. The Data Subject may obtain clarifications regarding the content and grounds for data processing, the manner of exercising the rights under this Policy, as well as any additional information in connection with their rights regarding the processing of personal data by Hostel Penev at:

Address: Stara Zagora, 51 Anton Marchin St. (southern entrance)

Email address: [email protected]

Phone: +359 878 889 735; +359 878 889 725

This Personal Data Protection Policy has been drawn up by “Penevi Group” EOOD (Hostel Penev) in its capacity as a personal data controller with a view to fulfilling its obligations to provide information to data subjects under Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

This Privacy and Personal Data Protection Policy is effective as of 25.05.2018.