Privacy Policy

This policy explains what personal data Hotel Friends 3*, Bansko collects through hotelfriends.eu and during your stay, why we collect it, how long we keep it and what rights you have.

Who processes your data

The data controller is K&P Hotels EOOD, company number BG206065537, registered at 42 Baba Iliytsa Street, Sofia, Bulgaria.

For any question or request under this policy write to [email protected] or call +359 884 751 057. Hotel address: 2 Rayna Knyaginya Street, 2770 Bansko, Bulgaria.

What we collect, why, and on what basis

1. Enquiries and bookings made through the site

We collect your name, email, phone number, the dates of your stay, the number of guests and whatever you write in the message. We use it to reply to you and to arrange the booking.
Basis: performance of a contract, or steps taken at your request before entering into one — Article 6(1)(b) GDPR.
Retention: up to one year after your stay. Accounting records are kept for 10 years under the Bulgarian Accountancy Act.

2. Checking in at the hotel

At check-in we record names, date of birth, nationality and identity-document details. We do this because the Bulgarian Tourism Act requires every guest to be registered in the Unified Tourist Information System (ESTI).
Basis: compliance with a legal obligation — Article 6(1)(c) GDPR.
Retention: the periods set by the Tourism Act and by tax legislation.

3. Newsletter

If you have subscribed, we keep your email address so we can send you offers and news.
Basis: your consent — Article 6(1)(a) GDPR. You can withdraw it at any time through the unsubscribe link in every message, or by writing to us.
Retention: until you unsubscribe.

4. CCTV

The public areas of the hotel are under video surveillance. There are no cameras in the rooms, bathrooms or changing rooms.
Basis: our legitimate interest in the safety of guests and the protection of property — Article 6(1)(f) GDPR.
Retention: recordings are kept only for as long as that purpose requires and are then deleted automatically.

5. Cookies and site statistics

The site uses cookies. The essential ones are needed for the site to work. The rest — statistics and marketing — load only after you agree through the cookie banner, and you can change your choice there at any time.
Basis: your consent — Article 6(1)(a) GDPR.

Who we share data with

We do not sell or rent your personal data. We share it only with:

the provider that hosts and maintains the website;
Google Ireland Ltd. — visit statistics (Google Analytics), if you have consented;
Meta Platforms Ireland Ltd. — Facebook and Instagram marketing tools, if you have consented;
Cloudflare, Inc. — network protection and site delivery;
the Unified Tourist Information System (ESTI), the Ministry of the Interior and the National Revenue Agency, where the law requires it;
the company’s accountants.

Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on the European Commission’s standard contractual clauses or on an adequacy decision.

Your rights

to obtain access to the data we hold about you;
to have inaccurate data corrected;
to have data erased where we have no legal ground to keep it;
to ask us to restrict processing;
to receive your data in a machine-readable format and transfer it to another controller;
to object to processing based on legitimate interest;
to withdraw your consent at any time, without affecting processing carried out before the withdrawal.

Send your request to [email protected]. We reply within one month. We may ask for further information to satisfy ourselves that the request comes from you.

Complaints

If you believe we are handling your data unlawfully, you may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, phone +359 2 915 3 518, [email protected], www.cpdp.bg. You also have the right to go to court.

Last updated: 4 September 2026