1. Personal data administrator

SPA HOTEL POMORIE AD — GRAND HOTEL POMORIE
VAT No.: BG102948767
Pomorie 8200, 5 Prof. Parashkev Stoyanov Street
reservations@grandhotelpomorie.com
+359 885 88 20 10   |   +359 886 32 44 44
grandhotelpomorie.com

2. What personal data do we collect?

We collect only the minimum amount of personal data necessary for the specific purpose. We never collect data that is unnecessary to perform the service.

2.1. Upon reservation and check-in

• Three names, citizenship, date of birth
• Email address, phone number
• Arrival and departure dates, room type, number of guests, special requirements
• Payment method (full card details are not stored by us)
• Legally required registration data under the Tourism Act

2.2. When using the website

• IP address and technical data about the device and browser
• Cookies — see Section 6 for details
• Site behavior data (analytics) — anonymized

2.3. When using SPA and medical services

• Therapy charts and medical documents are your sole property.
• We do not store medical documents — they are returned to you immediately after the examination or therapy
• Data about your health condition is used only within the current therapeutic session.

2.4. When organizing events

• Date and time, number of guests, room type
• Minimum required data for participants
• For corporate events — company details and additional information

2.5. Video surveillance

• We record videos in public places in the complex
• Legal basis: Private Security Activities Act
• Recordings are stored for up to 30 days, after which they are automatically deleted.

2.6. Third-party data

When booking through tour operators, travel agents or event organizers, these parties provide data about you within the framework of joint processing agreements or personal data processor agreements concluded with us, in full compliance with the GDPR.

Grand Hotel Pomorie does not provide personal data outside the territory of the Republic of Bulgaria.

3. Why and on what basis do we process data?

4. Sharing personal data

We only share personal data in the following cases:

• With tour operators, travel agents and event organizers - only for overlapping purposes and based on data processing contracts according to GDPR
• With service providers in the complex (SPA, restaurant, concierge) - only for overlapping purposes or with your consent
• With government bodies - only in legally regulated cases (Tourism Law, National Revenue Agency, Ministry of Interior, etc.)
• With technical service providers (hosting, payment systems) - based on data processing contracts

5. Your rights

Under the GDPR, you have the following rights regarding your personal data:

To exercise your rights, send a request to: reservations@grandhotelpomorie.com

We respond within 30 days of receiving the request.

6. Cookies

Our website uses cookies to function properly and to improve your user experience. When you first visit the site, you will be asked to consent to cookies.

Types of cookies we use:

• Required cookies: necessary for the site to function; do not require consent
• Analytical cookies: measure site traffic and behavior (e.g. Google Analytics) - require consent
• Marketing cookies: personalized advertising and remarketing - require consent

You can manage cookies through your browser settings or through the cookie management button on the site. Disabling certain cookies may affect the functionality of the site.

7. Data security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, destruction or disclosure. These measures include:

• Encrypted connection (SSL/HTTPS) for all website pages
• Restricted access to personal data to authorized employees only
• Regular training of staff on data protection
• Data processing contracts with all service providers
• Periodic review and update of security measures

Upon detection of a security breach, we will notify you within the legally prescribed timeframes if the breach is likely to affect your rights and freedoms.

8. Social media and marketing

We encourage you to share your experience with us on social media. Please note:

• If you publish photos with the presence of third parties, their consent is required.
• Our social media accounts (Facebook, Instagram, YouTube) are managed by us and are subject to the privacy policies of the respective platforms.
• With your consent, we may use photos from your public posts for promotional purposes.

When participating in lotteries, marketing research or service quality surveys, personal data is collected only for the relevant specific purpose.

9. Supervisory authority — CPDP

If you believe that your personal data protection rights have been violated, you have the right to file a complaint with the Personal Data Protection Commission (PDPC):

We recommend that you contact us before filing a complaint with the CPDP so that we can resolve the issue directly with you.

10. Principles for processing personal data

We process your personal data in compliance with the following principles set out in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: data is processed lawfully and fairly
• Purpose limitation: data is collected for specific, explicit and legitimate purposes
• Minimization: we only collect the data necessary for the specific purpose
• Accuracy: we take measures to keep data up to date
• Storage limitation: data is kept no longer than necessary
• Integrity and confidentiality: we implement appropriate protection against unauthorized access and loss
• Accountability: we are able to demonstrate compliance with all principles

11. Policy changes

We may update this Privacy Policy as the law or our practices change. The current version is available on our website.

In the event of material changes, we will notify you via a visible notice on the website or by email.

CONTACTS FOR PRIVACY ISSUES

Last updated: March 2026.
SPA HOTEL POMORIE AD — GRAND HOTEL POMORIE