Privacy Policy

Privacy Policy of Royal Travel Sofia Ltd.

Tour operator Royal Travel Sofia, has always insisted on the security and lawful use of personal data, so we publish this policy in order to inform users about how and why it processes their personal information.

Personal data is any information that identifies a specific natural person or that relates to a natural person who can be identified directly or indirectly.

I. Types of personal data covered by this policy:

 Basic Data:

Three names;

 Contact Telephone;

Data to be provided at the conclusion of a contract

Personal data that users need to provide to Royal Travel Sofia to enter into a contract. The provision of these data is voluntary, but without them Royal Travel Sofia cannot conclude the contract and provide the travel service.

Such data are:

The user's name;

Unique citizenship number (for Bulgarian citizens);

Identity number (for non-residents);

Identity document data.

Contract data

These are details of the subject matter, terms and duration of contracts that Royal Travel Sofia enters into with users.

Such data are:

Contract number and date of conclusion;

Start date and duration;

Name of the excursion;

Category of hotel(s) on the excursion;

Type of transport;

Base of meals;

Additional services paid for and their total cost;

Medical insurance paid;

Detailed excursion programme;

Total amount of the tour package;

Cancellation conditions;

Rights and obligations of the parties;

Details of obligations

These are data related to the obligations of users arising from contracts concluded with Royal Travel Sofia and services provided:

Information about invoices issued - number, date, amount due, due date, etc.

Payment data

Data related to the payment history of users in connection with contracts concluded with Royal Travel Sofia.

Such data are:

Date of payment;

Payment amount;

Place of payment;

Method of payment (cash, bank transfer, credit/debit card, etc.);

Debit/credit card information, bank account number or other bank/payment information.

Communication details with users

o This is data that is processed in connection with communication between Royal Travel Sofia and its users in the form of user enquiries, complaints, applications, requests or claims, when conducting satisfaction surveys and when making calls or messages relating to the services used (including messages containing departure information).

Such data are:

User data;

User contact information (telephone number, e-mail address, address and/or other);

Type of communication - written request, application, complaint, letter, enquiry via online form, email, phone call or short text message (sms);

Date the communication was sent or received;

The information that the relevant communication contains.

7. Automatically generated data when visiting Royal Travel Sofia's website

When visiting Royal Travel Sofia websites, certain data about the visitor and their device is automatically collected.

Such data are:

IP address;

time and date of visiting the website;

the device used, including its operating system;

the application used to access the page;

language settings.

II. Principles of personal data processing

 Royal Travel Sofia processes personal data in good faith, in a transparent manner, for specific, specified and legitimate purposes. Personal data is processed in order to provide the best possible products tailored to the needs of users.

Royal Travel Sofia tells users what personal data it processes, why it needs to process it and how it processes it.

Royal Travel Sofia tells users what personal data it processes, why it needs to process it and how it processes it.

The processing of personal data will not exceed the period necessary to achieve the aforementioned purposes, unless Royal Travel Sofia is obliged to store it in accordance with applicable law.

Royal Travel Sofia respects the rights of users under data protection legislation, including the right of access to personal data, the right to rectification of personal data, the right to erasure of personal data, etc.

Royal Travel Sofia takes the necessary technical and organizational measures to ensure the security of the personal data processed and to protect them from accidental or unlawful destruction, accidental loss, unauthorized access, alteration or dissemination, as well as from other unlawful forms of processing.

III. Manner of collection of users' personal data

Royal Travel Sofia collects personal data directly from users in the following cases:

In a pre-contractual relationship with them - when a user expresses a wish to enter into a contract with Royal Travel Sofia for a tourist or other service;

When concluding a contract for a tourist service with Royal Travel Sofia;

When concluding other contracts with Royal Travel Sofia;

When purchasing gift vouchers with the express consent of the purchaser;

Upon or in connection with the execution, modification, amendment or termination of a contract concluded between Royal Travel Sofia and the consumer.

Royal Travel Sofia collects personal data about users from third parties in the following cases:

When a customer is enrolled (concluding a contract for organised travel) through a travel agency contracted with Royal Travel Sofia (travel agency contract);

In case of a customer's enrolment (conclusion of a contract for an organised trip) through a tour operator contracted with Royal Travel Sofia;

Data that is generated and collected automatically

When visiting Royal Travel Sofia's websites, certain information is automatically collected, which includes the IP address, time and date of use of the website, the device used as well as information about its operating system, the application used to access the page and the language settings of the operating system.

IV. What personal data of users is processed by Royal Travel Sofia

Royal Travel Sofia mainly provides travel services and in this sense the company's activity is homogeneous. Given this fact, Royal Travel Sofia processes the same types of personal data for all its users. Royal Travel Sofia processes the following categories of personal data of its users:

basic data;

data that is provided at the conclusion of a contract;

contract data;

commitment data;

payment data;

consumer communication data.

V. How we process users' personal data

Data processing necessary for the preparation of proposals and for the conclusion of contracts

In order to conclude a contract with Royal Travel Sofia and to provide a travel service, the user must provide personal data. The provision of this data allows the user to be identified as a party to the contract and as the holder of the rights and obligations under the contract. The name, address and identity document details of the user are part of the minimum content of any organised travel contract, in accordance with the requirements of the Tourism Act.

Data processing necessary for the performance of contracts

Royal Travel Sofia processes users' personal data in order to be able to perform the contracts concluded with them. Otherwise, it cannot meet its contractual obligations to users.

Royal Travel Sofia processes users' personal data to ensure that the services provided comply with the contractual terms. Thanks to this processing, Royal Travel Sofia identifies the user as the contract holder in order to monitor compliance with the parameters of the agreed service.

Royal Travel Sofia processes the personal data of users in order to be able to provide them with the agreed services. In order to provide travel services, Royal Travel Sofia processes basic user data and identity document data.

Royal Travel Sofia processes personal data for payment purposes in connection with the provision of travel services. When a user makes a payment under a contract with Royal Travel Sofia, we process their basic data, contract data, liability data and payment data.

Royal Travel Sofia processes users' personal data for the purpose of payments with partners. In order to make it possible for Royal Travel Sofia's users to conclude contracts, pay for services, submit requests and be served at the offices of Royal Travel Sofia's partners (travel agencies and tour operators that have signed a contract with Royal Travel Sofia), Royal Travel Sofia concludes agreements with them. Under these agreements, Royal Travel Sofia owes

amounts, for the determination of which it is necessary to process user data.

2.5 Royal Travel Sofia processes personal data of users in order to fulfil their requests. When fulfilling requests from a user, Royal Travel Sofia processes the user's basic data, data about the contract(s) as well as data about obligations and/or payments (if applicable).

2.6. Royal Travel Sofia processes Users' personal data for customer service purposes in order to provide quality and prompt service, including but not limited to processing User suggestions, applications, requests, inquiries and complaints. The type and amount of personal data processed in these cases depends on the nature and content of the proposal, application, request, enquiry or complaint.

2.7. Royal Travel Sofia processes personal data of users where necessary to exercise its rights under contracts concluded with them.

2.8. Royal Travel Sofia processes personal data of users when necessary to collect unpaid amounts under contracts.

Processing of data in compliance with legal obligations

In certain cases, applicable law requires Royal Travel Sofia to process personal data about its users for certain purposes, in a certain manner and for a certain period of time.

Royal Travel Sofia processes users' personal data where the company is required by applicable law to provide information to the competent authorities.

Royal Travel Sofia processes users' personal data where, under applicable law, the company is obliged to provide assistance to competent state and/or municipal authorities in connection with their inspections.

Royal Travel Sofia processes personal data in order to fulfil obligations arising from accounting and tax legislation. The applicable legislation of the Republic of Bulgaria requires Royal Travel Sofia to compile and store for a given period certain accounting and business information, as well as any other information and documents relevant to taxation. In fulfillment of this obligation, relevant information and documents, which also contain personal data of users, are stored by Royal Travel Sofia for the periods provided for in the relevant laws.

Processing of data necessary to protect the legitimate interests of Royal Travel Sofia

Royal Travel Sofia processes personal data when performing analyses in order to improve customer service and the travel services it offers, as well as when developing new services. In these cases, Royal Travel Sofia processes personal data in aggregate form in order to evaluate the quality of service and/or the service offered and to plan future activities. Royal Travel Sofia also processes user data in order to evaluate the performance of employees in its offices.

Royal Travel Sofia processes users' personal data for the purpose of surveying users' satisfaction with Royal Travel Sofia's services. In order to improve customer service and services, we sometimes ask users questions regarding their satisfaction with a travel service they have used. In processing

the results of such a survey, Royal Travel Sofia processes basic data, contract data, consumer communication data.

4.3. Royal Travel Sofia processes users' personal data for the purpose of providing departure information. Royal Travel Sofia sends messages to its users (via e-mail and/or short text message - sms) containing departure information for an organised excursion for which the user has signed up. If desired, the user may opt out of this service. 

When sending these messages, Royal Travel Sofia processes contract data and data for communication with users.

4.4. Royal Travel Sofia processes personal data when providing a "regular customer discount" (users who have already used Royal Travel Sofia's services). In order to increase the number of users using Royal Travel Sofia services more than once, we provide special "regular customer discounts". In order to identify a user, to establish that he/she has already used a Royal Travel Sofia service and to prevent fraud, we process basic data, data that is provided at the conclusion of a contract and contract data.

4.5 Royal Travel Sofia processes personal data of users when carrying out direct marketing. Royal Travel Sofia processes users' data in order to communicate to them (no more than twice a month) about its relevant offers and services via e-mail messages. Only users who have given their explicit consent to this will receive communications. Users may opt out of receiving communications at any time by being provided with a link to manifest their unwillingness to receive promotional communications to their e-mail from Royal Travel Sofia.

4.6. Royal Travel Sofia processes personal data where this is necessary to settle legal disputes.

Processing of personal data on the basis of consent given by users It is also possible for Royal Travel Sofia to process users' personal data for

other purposes, subject to consent. The consent given may be withdrawn at any time by the users, free of charge, by submitting a written request to the office of Royal Travel Sofia or by e-mail to: office@royaltravelbg.com. Withdrawal of consent does not affect the lawfulness of processing based on the withdrawn consent prior to its withdrawal.

VI. Categories of persons to whom we disclose users' personal data

Processors - Processors are persons who process personal data on behalf of and on behalf of Royal Travel Sofia on the basis of a written agreement. They may not process the personal data provided to them for purposes other than the performance of the work assigned to them by Royal Travel Sofia. Processors are obliged to comply with all instructions of Royal Travel Sofia.

Partners of Royal Travel Sofia - in order to provide certain services to its users, Royal Travel Sofia enters into contracts with third parties (partners). In connection with the provision of the respective services, it is sometimes necessary to provide personal data of users to the respective partners. Such partners may be air carriers, insurance companies, other tour operators and travel agencies, etc.

Banks and payment institutions - in connection with the servicing of payments of Royal Travel Sofia users made by bank transfer or through a payment institution, it is necessary to exchange data between Royal Travel Sofia and the relevant bank or payment institution.

Postal operators in connection with the dispatch of parcels containing contracts or other documents and materials intended for the consumer.

Companies providing Royal Travel Sofia with services for the establishment and maintenance of information systems, internal networks, software and hardware used for the processing of personal data and necessary for reporting, payment, communication with customers, etc.

Consulting companies

7. Competent authorities - under applicable law, the company is obliged to provide information to competent authorities upon request or in the context of inspections carried out by them.

VII. Processing of personal data outside Bulgaria

Royal Travel Sofia endeavours not to send personal data to users outside the European Union (EU) and the European Economic Area (EEA). However, in certain cases it is necessary to send certain data to persons outside the EU/EEC (e.g. in order to provide hotel accommodation services outside the EU/EEC), subject to the requirements of applicable law. Royal Travel Sofia only sends personal data outside the EU/EEC if this is necessary to fulfil a contract with the relevant user.

VIII. Storage period of users' personal data

Royal Travel Sofia retains users' personal data for as long as is necessary to achieve the purposes of this policy. Royal Travel Sofia does not delete personal data before one year has elapsed from the termination of the contract or until all financial obligations have been finally settled and statutory data retention obligations have expired, such as obligations to retain and provide information for the purposes of detecting and investigating crime (6 months), obligations under the Accountancy Act to retain and process

accounting data (11 years), expiry of the limitation periods for making claims set out in the Law on Obligations and Contracts (5 years), obligations to provide information to the court, competent state authorities and other grounds provided for in the applicable legislation (5 years). After the expiration of the time limits for processing personal data, they are anonymized or deleted/destroyed.

IX. Protection of users' personal data

Royal Travel Sofia has always been committed to the security of our users' personal data. Guarantees of such security build trust between us and our users and have therefore always been of strategic importance to us. In this sense, at Royal Travel Sofia we take all the necessary organizational and technical measures provided for in current legislation and described in best practices at European level.

Royal Travel Sofia stores priority personal data in its central database, whose protection is ensured by a three-layer architecture that isolates the encrypted servers for personal data from external networks (the systems have the following relationship: front-end (web) server <-> application server <-> database). Malware detection software runs on the servers. All systems send their logs to a central log server. Automatic analysis of the logs for errors and threats is performed. Monitoring systems provide monitoring of the operating parameters of the systems and alarm in case of deviations. All systems use a common source for time reconciliation. Backups of all systems are performed regularly. Personal data is also temporarily processed on local servers in the Royal Travel Sofia office (with restricted access, backups are made regularly on encrypted hard drives) and/or on computer configurations in the Royal Travel Sofia office (with restricted access). 

Threats and risks associated with the local network in the Royal Travel Sofia office are regularly assessed and the necessary measures are taken.

In connection with the organisational measures, the manager of Royal Travel Sofia has issued instructions for the processing of personal data, which are binding for all employees of Royal Travel Sofia. The instructions include the following measures:

all employees of Royal Travel Sofia sign and abide by the terms of the Privacy Policy for the processing of personal data entrusted to them;

personal data is stored as a priority in an encrypted central database of Royal Travel Sofia Ltd. with a secure and limited connection to external networks, unless the purposes of the processing require otherwise;

passwords for access to the central database of "Royal Travel Sofia" Ltd, local servers, computer configurations in the offices of "Royal Travel Sofia" Ltd and other information systems containing personal data about users are confidential, are not disclosed to unauthorized persons and are stored in a manner that prevents their disclosure through unauthorized persons.

paper copies of information assets containing personal data shall be made in minimal numbers and, wherever possible, shall be processed in enclosed areas to which only authorised persons have access;

information assets containing personal data in paper form are stored temporarily in locked drawers and for longer periods in locked storage in an office of Royal Travel Sofia Ltd. guarded by a security company with which 

 "Royal Travel Sofia" Ltd has concluded a contract;

information assets containing personal data on electronic media are stored on local servers with limited access in the offices of Royal Travel Sofia Ltd. and/or on computer configurations with limited access in the offices of Royal Travel Sofia Ltd. only if the purposes of processing require it and only temporarily.

X. Rights of natural persons in relation to the processing of personal data

Right of access - individuals have the right to obtain from Royal Travel Sofia information on whether personal data relating to them is being processed. If personal data is being processed, the individual has the right to obtain information about the content of the personal data, the purpose of the processing and the categories of recipients of the data.

Right to rectification - if the personal data processed by Royal Travel Sofia is inaccurate or outdated, the individual has the right to request Royal Travel Sofia to rectify it.

Right to erasure - individuals have the right to request Royal Travel Sofia to erase their personal data in the following cases:

the personal data is no longer necessary for the purposes for which it was collected and processed;

the individual has withdrawn his/her consent to processing and there are no other legal grounds for continuing the processing;

the person has objected to the processing of personal data based on a legitimate interest of Royal Travel Sofia and there are no other lawful grounds for continuing the processing;

the person's personal data have been unlawfully processed;

personal data must be deleted by Royal Travel Sofia in order to comply with applicable law.

Right to restriction of processing - individuals have the right to request Royal Travel Sofia to restrict the processing of their personal data in the following cases:

the individual disputes the accuracy of the data, for the period in which Royal Travel Sofia must verify the accuracy of the personal data;

the data have been processed without a legal basis, but the person does not wish them to be erased but wishes to restrict their processing;

Royal Travel Sofia no longer has a need for the personal data of the individual, but it requires it in order to establish, exercise or defend legal claims;

when an objection to the processing of personal data is lodged, but verification of the lawfulness of Royal Travel Sofia's processing purposes is awaited.

Right to portability - individuals have the right to request Royal Travel Sofia to provide their personal data in a structured, commonly used and machine-readable format if Royal Travel Sofia processes the data on the basis of a contract or based on consent to the terms and conditions. Individuals have the right to ask Royal Travel Sofia to transfer their personal data directly to another controller where this is technically feasible.

Right to object - individuals have the right to object to the processing of their personal data when Royal Travel Sofia processes it on the basis of its legitimate interests. In the case of objection to processing for direct marketing purposes, the objection is unconditional and the processing shall cease. In all other cases, Royal Travel Sofia shall carry out an internal check on the basis of the person's objection and shall notify him or her of the cessation of the processing of his or her personal data or shall reasonably refuse to cessate the processing of his or her personal data if there is a legitimate ground for doing so.

Right to lodge a complaint - individuals have the right to lodge complaints and alerts with the relevant national and European competent authorities if they believe that Royal Travel Sofia is in breach of data protection legislation. Detailed instructions for lodging complaints can be found on the website of the Data Protection Commission.

Clarification on the rights of individuals in relation to the processing of personal data:

Royal Travel Sofia will only act on a request from an individual to exercise a right under this section if it is able to identify the individual;

Royal Travel Sofia may request further information to confirm an individual's identity if it has reasonable concerns about their identity;

Royal Travel Sofia shall notify an individual of the action taken within one month of receipt of a request to exercise a right under this section, in certain cases this period may be extended to two months, taking into account the complexity and number of requests. Royal Travel Sofia shall inform the person concerned of any extension within one month of receipt of the request, giving reasons for the delay;

in the event of a refusal to comply with a request under this section, Royal Travel Sofia shall inform the individual concerned within one month of the reasons for not taking action and of the possibility of lodging a complaint with the competent authorities;

actions prescribed by Royal Travel Sofia in relation to requests made to exercise the rights described in this section shall be carried out free of charge for the individuals unless the requests are manifestly unfounded or excessive. If a request is unreasonable or excessive (for example, due to high repetition), Royal Travel Sofia has the right to refuse to comply with the request or to charge a reasonable fee for complying with the request based on the administrative costs the request would incur.

XI. Contact Information for Royal Travel Sofia

Royal Travel Sofia Ltd, UIC 131131963, with registered office and management address in Sofia, Bulgaria. 1202 Sofia Blvd. Maria Louisa №67A.

For questions regarding the processing of personal data you can contact us at office@royaltravelbg.com.

Contact phone number: 029831175, 0899993083

XII. Update and renewal of the policy

Royal Travel Sofia's privacy policy was published on 23.05.2018.

is up-to-date as of that date. In order to apply the most up-to-date measures for the protection of personal data and to comply with current legislation, this policy will be regularly updated. Royal Travel Sofia will keep you informed of amendments and additions by publishing the updated version on its website - www.royaltravelbg.com. We recommend that users periodically check the most up-to-date version of this policy to keep informed of the measures we are taking to keep their personal data secure.