Date of last update: 31.05.2023

Please read this document carefully. It contains the Policy for the protection of personal data of customers of "SPA TEAM" OOD ("Policy/s") and aims to explain the practices related to the processing of personal data in the context of the services provided and the activities performed.
This Policy has been prepared in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95 /46/EO (Regulation), as well as in accordance with the Personal Data Protection Law of the Republic of Bulgaria.

General
Art. 1. In connection with the provision of its services and the performance of its activities, "SPA TEAM" Ltd., a company that manages Balneocomplex Aquatonic, Velingrad, processes as an administrator the personal data of its customers - individuals, as well as the personal data of other individuals persons named below ("Data Subjects"/"You"), in accordance with the principles and rules provided for in the personal data protection legislation and this Policy.
Art. 2. "SPA TEAM" Ltd. is a company registered with EIK 207114439, with headquarters and management address: Velingrad, Georgi Benkovski Street 56, contact phone: +359878 701 005, e-mail: manager@aquatonik.com.

Data subjects
Art. 3. (1) In connection with the services provided by "SPA TEAM" OOD, the company processes personal information regarding the following Data Subjects:
(a) natural persons visiting the website http://www.aquatonik.com (the Website);
(b) natural persons who make reservations on their own behalf or on behalf of another natural or legal person at the contact details indicated on the Website;
(c) natural persons using the services provided by "SPA TEAM" OOD, including but not limited to hotel accommodation, catering and related services, provision of premises for organizing conferences and other events, etc. sub., as well as natural persons representing or otherwise acting on behalf of legal entities that use these services;
(d) natural persons who, on their own behalf or on behalf of another person they represent, have sent inquiries (by e-mail, by calling), requests, signals, complaints or other correspondence;
(2) The services of "SPA TEAM" OOD can only be requested by able-bodied persons who have reached the age of 18.
Categories of personal data
Art. 4. The information (categories of personal data) that "SPA TEAM" Ltd. processes regarding the Data Subjects in accordance with this Policy may include:
(1) Data processed in connection with making a reservation for hotel accommodation: names; contact details - e-mail address, telephone; details about the reservation, incl. period of accommodation/use of services, number of rooms, number of guests (number of adults and number of children), details of selected package; special requirements and preferences of the guest (when explicitly indicated by the Subject in an inquiry, email correspondence or by phone);.
(2) Data processed in connection with the provision of hotel accommodation services:
(a) Identification data: guest names; date of birth; gender; nationality; national identification number (EGN for Bulgarian citizens), data from an identity document; signature.
(b) Contact details: telephone; email address; address.
(c) Information related to hotel accommodation: reservation number, room number; floor; dates of stay (arrival date and departure date); length of stay (number of overnight stays); use of a travel package; preference for room type, etc.;
(d) Additional information related to hotel accommodation services upon explicit request by the user of the services: special requirements and preferences, incl. for food and beverages.
(3) Data related to payments and invoicing: information on payment method (cash, bank transfer, debit/credit card, etc.); information on payments due and made; bank information (bank, IBAN, bank account holder); currency of the payment made; credit/debit card number, validity and holder; CVC code.
(4) In cases where the services are requested by a person other than the Data Subject for the benefit of the Data Subject: information regarding in what capacity the Data Subject will use the services, by whom they are requested, by whom the payment will be made, etc. . (e.g. for accommodations organized by an employer, business partner, relative or close relative of the Data Subject, etc.).
(5) Unstructured content from conversations with employees of the administrator, as well as information contained in the inquiry form ("Book a Room" section of the Website).
(6) Data related to complaints, applications, requests, requests and signals submitted by customers (including in free text): unstructured information contained in the respective complaints, applications, requests, requests and signals.
(7) Cookies. The use of "cookies" is necessary for the functioning of the Website. A detailed description of the "cookies" used, their purpose and the information processed through them can be found in the Cookie Policy of "SPA TEAM" OOD, available on the Website.

Video surveillance and security
Art. 5. (1) According to the requirements of the applicable legislation, "SPA TEAM" Ltd. implements security measures, which include the following technical and organizational means for access control and for ensuring physical security against encroachments on the buildings and objects and for the protection of life and health of citizens: physical security, security alarm systems and a video control system, performing 24-hour video surveillance and consisting of recording and storage devices.
(2) Video surveillance and video recording may be carried out in publicly accessible areas and premises in the building of the balneo complex and in those for which a special access regime is provided. There is no video surveillance in the guest rooms, sanitary and hygiene rooms, recreation rooms, etc. under. Data from video surveillance activities are stored in a monitoring room with limited access and 24-hour security.
(3) Through information boards placed in a visible place, the Data Subjects and other visitors who may be filmed are notified of the use of technical means of monitoring and control and of any other relevant information in connection with the monitoring being carried out.
Direct marketing
Art. 6. (1) With the express consent of the Data Subject, "SPA TEAM" Ltd. may process the following personal data: names; telephone; email address; information about the type and volume of used and preferred services provided by "SPA TEAM" OOD and other data, expressly mentioned in the relevant consent, for the purposes of direct marketing, including offering other services, conducting surveys, surveys with a view to improving the quality of the services provided, etc. under. according to the scope of the specifically given consent.
(2) When personal data are processed for the purposes of direct marketing, the Data Subject has the right to object to this processing of personal data at any time. In these cases, the processing of personal data for these purposes is terminated.
(3) The data subject has the right at any time to withdraw his consent to the processing of his personal data for the purposes of direct marketing. In these cases, the processing of personal data based on the given consent is suspended.
(4) "SPA TEAM" Ltd. does not perform profiling for the purposes of direct marketing.
Grounds for processing personal data
Art. 7. "SPA TEAM" Ltd. processes the information described above for the purposes provided for in this Policy and in the general terms and conditions (agreement) for the use of the relevant services that it provides on the following grounds:
(a) when necessary to comply with statutory obligations applicable to "SPA TEAM" OOD;
(b) when it is necessary to fulfill the contracts concluded with "SPA TEAM" OOD or to take steps at the request of the Data Subject before concluding a contract;
(c) when it is necessary for the purposes of the legitimate interests of "SPA TEAM" OOD or of third parties;
(d) based on the Subject's express consent to process his data.
Art. 8. The purposes of personal data processing by "SPA TEAM" OOD, related to compliance with legal obligations, include:
(1) keeping a register for the accommodated tourists and submitting information from it to the competent authorities in accordance with the law;
(2) address registration of foreigners according to the requirements of the applicable legislation;
(3) withholding and payment of tourist tax;
(4) activities related to the development and implementation of counter-terrorism measures;
(5) service of signals, complaints, requests for exercise of rights and the like, as well as claims and commercial warranties (if applicable), including the preparation of responses thereto;
(6) accounting, invoicing and reporting of payments received and made in accordance with the current tax and accounting legislation;
(7) other activities for the fulfillment of legal obligations (tax, accounting, regulatory, licensing, etc.) of "SPA TEAM" OOD, related to providing information to competent authorities and providing assistance during inspections by competent authorities.
Art. 9. The purposes of processing personal data by "SPA TEAM" OOD, related to and/or necessary for the performance of contracts or to take steps at the request of the Data Subject before concluding a contract with "SPA TEAM" OOD, include:
(1) accepting, administering and processing reservations and canceling them;
(2) customer service;
(3) carrying out communication related to the services provided;
(4) administration and receipt of payments for services provided, incl. from a distance;
(5) providing a guarantee for reservations made and for the payment of hotel accommodation and additionally requested services;
(6) financial and accounting activities and administration, processing and collection of payments due for services provided;
(7) refund of transferred amounts;
(8) ensuring an individual approach to the provision of services, consistent with the preferences stated by their users.
Art. 10. The purposes of processing personal data related to the legitimate interests of "SPA TEAM" OOD or third parties include:
(1) Legitimate interest – (1.1.) exercising and protecting the legal rights and interests of "SPA TEAM" OOD; (1.2.) assistance in exercising and protecting the legal rights and interests of customers, other persons associated with "SPA TEAM" OOD, employees of "SPA TEAM" OOD, persons processing personal data on behalf of "SPA TEAM" " Ltd., to commercial partners of "SPA TEAM" Ltd.:
(a) establishment, exercise or defense of legal claims of the above-mentioned persons under item (1.1) and item (1.2), incl. and by court order, including filing of complaints, reports, etc. under. to the competent authorities;
(b) video surveillance and access control in order to protect the property of "SPA TEAM" OOD, prove the fulfillment of the applicable requirements, ensure physical security against encroachments on the building and objects and protect the life and health of citizens;
(c) taking actions to suspend the provision of services in case of refusal of payment, violation of the internal rules and policies established by "SPA TEAM" OOD, etc. sub.;
(d) administration and service of received complaints, alerts, requests, etc. sub.;
(e) collection of receivables owed to "SPA TEAM" OOD, including by compulsory order and/or by assignment to third parties, as well as transfer of receivables to third parties (assignments) according to the procedure established by law;
(f) issuing notarial invitations.
(2) Legitimate interest – analysis, planning and improving the quality of the services provided by "SPA TEAM" OOD:
(a) maintaining a copy of the data from the internal information system, in relation to the current state of the hotel (occupancy, obligations, etc.) in the event of a breakdown of the information systems;
(b) receiving, processing and preparing responses to submitted applications, requests, etc. sub., not related to complaints and complaints about the used Services;
(c) customer and service user satisfaction survey;
(d) control, analysis and optimization of business processes to improve the quality of services.
(3) Legitimate interest – ensuring the normal functioning and use of the Website:
(a) maintenance and administration of the Website;
(b) detecting and resolving technical problems with the functionalities of the Website;
(c) taking measures against malicious actions against the security and normal functioning of the Website.
(4) Legitimate interest – implementation of hotel and restaurant activities and provision of quality hotel and restaurant services:
(a) administration and management of the services provided by "SPA TEAM" OOD;
(b) management and control of the quality of the services provided;
(c) receiving feedback on the services provided.
Art. 11. The purposes of processing personal data based on consent given by the Data Subject include:
(1) Sending marketing and advertising messages for services, special offers, packages, events and the like;
(2) Surveys and obtaining feedback regarding the quality of the Services;
(3) Sending newsletters;
(4) Other purposes for which consent has been specifically granted by the Data Subject.
Provision of personal data and consequences of refusal to provide them to "SPA TEAM" OOD
Art. 12. (1) "SPA TEAM" OOD clearly indicates, where applicable and in an appropriate manner, whether the indication/provision of relevant data and/or documents is mandatory or constitutes a requirement necessary for the conclusion or performance of a contract, as well as the consequences of refusal to provide.
(2) If additional clarifications are needed, each Data Subject may request such on-site at the "SPA TEAM" OOD facility or send an inquiry to the contact details specified in this Policy.
(3) The refusal to provide data and documents specified as mandatory may constitute an insurmountable obstacle to the provision of a service by "SPA TEAM" OOD, to the satisfaction of requirements and preferences, as well as to the fulfillment of submitted requests, applications, requests, alerts, etc. sub., which exempts "SPA TEAM" OOD from liability for non-performance.
(4) The refusal to provide data and documents or the provision of incorrect ones may lead to the impossibility of providing the relevant services or to the suspension of access to services provided by "SPA TEAM" OOD.
(5) Data subjects should not provide SPA TEAM OOD with any special categories of data within the meaning of Art. 9 and Art. 10 of the Regulation (namely: personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership, genetic data, biometric data, health data or data on the sex life or sexual orientation of the natural person ; and personal data relating to convictions and offences.
Other sources of personal data
Art. 13. (1) In some cases, the personal data processed by "SPA TEAM" OOD are not collected or received directly from the Data Subject to whom they relate, but from third parties such as:
(a) Persons representing, working for or otherwise cooperating with a Data Subject;
(b) Event organizers - regarding information about event participants;
(c) Business partners: online platforms for reservations, travel agents, other persons who provide intermediary services when making reservations or when requesting other services and similar to "SPA TEAM" OOD;
(d) Competent authorities.
(2) The persons under para. 1, letters (a)-(c) undertake to inform the Data Subjects whose data they provide to "SPA TEAM" OOD and to ensure that they provide the data based on a valid legal basis.
Categories of recipients of personal data
Art. 14. "SPA TEAM" Ltd. does not disclose personal data about the Data Subject to third parties, except in cases where:
(1) this is necessary to fulfill a legal obligation of "SPA TEAM" OOD:
(a) competent state, municipal or judicial authorities;
(b) auditors;
(2) this is expressly provided for in the Policy and/or in the general conditions (agreement) for the use of the relevant services that "SPA TEAM" OOD provides;
(3) this is necessary to provide the services of "SPA TEAM" OOD:
(a) banks and payment service providers;
(b) postal and courier service providers;
(c) commercial partners of "SPA TEAM" OOD such as: online booking platforms; travel agencies and other providers of travel or other ancillary services such as car rental, taxi and other transport services and the like;
(3) The data subject has given his express consent - the persons provided for in the relevant consent;
(4) this is necessary to protect the rights or legitimate interests of "SPA TEAM" OOD, third parties or the Data Subject;
Art. 15. (1) "SPA TEAM" Ltd. processes and stores information about the Data Subject for the purposes of and until the achievement of the relevant purposes for which it was collected and processed.
(2) "SPA TEAM" Ltd., in accordance with its internal rules and procedures and the applicable legislation, processes and stores information about the Data Subject in the following terms:
Data types Retention period
Data for the register of accommodated tourists within the meaning of Art. 116 of the Tourism Act, which include identification data of the accommodated persons and data related to hotel accommodation
In accordance with the order and term provided for in the Law on Tourism and the subordinate regulations
Information related to requested and used services for hotel accommodation, events and restaurant services, incl. for canceled reservations for hotel accommodation (as far as they are related to the refund of prepaid amounts and/or withholding of due amounts) From the making of the relevant reservation/request up to 5 /five/ years from the provision of the service/completion of the performance of the contract/cancellation of the reservation.
In cases where the services are requested and used on the basis of a contract with continuous performance, the term begins to run from the final performance and/or termination of the contract.
Financial and accounting documents; invoices; authorization forms; other information related to tax and insurance control. Up to 10 /ten/ years, counted from the beginning of the year following the one in which payment of the obligation for the respective year is due.
Unstructured communication, correspondence, complaints, alerts and 5 years
In cases where the correspondence refers to a contract with continuous performance, the term begins to run from the final performance and/or termination of the contract.

Data related to reservations for restaurant services made by telephone Up to 1 year

System logs. Logs related to security, technical support, etc. (may contain information such as: date and time, IP address, URL, browser version and device information) 1 year
Video data 1 (one) week / 7 (seven) calendar days

Data contained in feedback cards Information from feedback cards is entered in an anonymized form (feedback only; feedback and recommendations received) without any information about the person from whom this feedback was given in the internal systems of "SPA TEAM" OOD, after which the cartons are destroyed immediately.

Data processed on the basis of the express consent of the Data Subject From the moment of giving consent until its withdrawal by the Data Subject.
The personal data specified in this Policy may be processed for a longer period of time than specified above, if this is necessary to achieve the goals set out in it or to protect the rights and/or legal interests (including by court order ) of "SPA TEAM" OOD or if the current legislation provides for data processing for a longer period.
Rights of Data Subjects in relation to their personal data
Art. 16. In relation to the processing of personal data relating to him, each Data Subject has the following rights:
(1) Right to information - to receive information about the processing of his personal data by "SPA TEAM" OOD;
(2) Right of access:
(a) to obtain confirmation as to whether personal data relating to him are being processed;
(b) to obtain access to the processed personal data and to the detailed information about the processing and his rights.
(3) The right to correction – to request the correction or completion of his personal data, if the same are inaccurate or incomplete;
(4) The right to erasure – to request the erasure of his personal data, if the grounds for this provided for in the Regulation are present;
(5) Right to limit the processing of personal data - to demand from "SPA TEAM" OOD to limit the processing of his personal data within the framework of the provisions of the Regulation, if the grounds for this, provided for in the same, are present;
(6) Notification of third parties - right to request from "SPA TEAM" OOD to notify the third parties to whom his personal data were disclosed of any correction, deletion or restriction of the processing of his personal data, unless this is impossible or requires disproportionately large efforts from "SPA TEAM" OOD;
(7) Right to data portability - to receive the personal data concerning him and which he has provided to "SPA TEAM" OOD, in a structured, widely used and machine-readable format, and to transfer this data to another administrator without obstruction by "SPA TEAM" OOD.
The right to data portability applies when the following two conditions are met simultaneously:
(a) the processing is based on consent or a contractual obligation; and
(b) the processing is carried out in an automated manner.
If it is technically feasible, the Data Subject has the right to receive a direct transfer of the personal data from "SPA TEAM" Ltd. to another administrator. The right to data portability can be exercised in a way that does not adversely affect the rights and freedoms of others.
(8) Rights in automated individual decision-making, including profiling – not to be subject to an automated decision based solely on automated processing (i.e. processing without human intervention), including profiling within the meaning of the Regulation, which gives rise to legal consequences for the Data Subject or similarly affects him to a significant extent, unless the grounds provided for in the Regulation are present and appropriate guarantees are provided to protect the rights and freedoms and legitimate interests of the Data Subject. Such guarantees are at least the right of human intervention on the part of "SPA TEAM" OOD, the right of the Data Subject to express his point of view and challenge the decision.
If such a decision, including profiling, is made against the Data Subject, for each specific case the Data Subject has the right and will receive from "SPA TEAM" OOD separately material information about the logic used, the meaning and the intended consequences of this processing for him, as and for the way of exercising the rights under this point.
(9) Right to withdraw consent to processing – when the processing of personal data is based solely on consent given by the Data Subject, the same may withdraw consent at any time. Such withdrawal does not affect the lawfulness of the processing based on the consent given until the time of its withdrawal;
(10) Right to object - The data subject has, at any time and on grounds related to his specific situation, the right to object to the processing of personal data concerning him, including against profiling within the meaning of the Regulation, which is based on public interest, exercise of official powers or the legitimate interests of "SPA TEAM" OOD or a third party. In these cases, "SPA TEAM" OOD terminates the processing of personal data, unless it proves that there are convincing legal grounds for the processing that take precedence over the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or protection of legal claims.
(11) Right to complain to a supervisory authority - every Data Subject has the right to lodge a complaint with a supervisory authority for personal data protection, in particular in the Member State (of the EU/EEA) of his/her habitual residence, place of work or the place of the alleged violation, if it considers that the processing of its personal data violates the provisions of the Regulation or other applicable requirements for the protection of personal data.
The supervisory authority in the Republic of Bulgaria is:
Commission for the Protection of Personal Data
Address: Sofia 1592, Prof. Blvd. Tsvetan Lazarov" No. 2
Website: https://www.cpdp.bg.
Art. 17. (1) The data subject may exercise the rights listed above by making a corresponding written request to "SPA TEAM" OOD - submitted personally by the data subject at the site of "SPA TEAM" OOD or to the email address mail specified in this Policy.
(2) The data subject may exercise the rights related to his personal data, personally or through a person expressly authorized by him (with a notarized power of attorney).
Limitations on Rights
Art. 18. The scope of the rights of the Data Subjects and the obligations of "SPA TEAM" OOD in relation to these rights may be limited by legislative measure of the law of the EU or of a Member State, which applies to "SPA TEAM" OOD.
Clarifications and additional information
Art. 19. The data subject may receive clarifications regarding the content and grounds for data processing, the manner of exercising the rights under this Policy, as well as any additional information regarding their rights in the processing of personal data from "SPA TEAM" OOD at the addresses , specified in Article 2 of this Policy.
This Policy for the protection of personal data has been drawn up by "SPA TEAM" OOD in its capacity as a personal data administrator with a view to fulfilling its obligations to provide information to data subjects under Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC ( General Data Protection Regulation). The Policy may be amended and supplemented, and the current version will always be available and accessible on our Website.