Personal data

Privacy Policy

Last updated: 23 September 2026

This policy explains what personal data we collect when you visit rayagarden.bg, make a booking or an enquiry, or get in touch with us — why we collect it, on what legal basis, and what your rights are.

1. Who we are

The data controller is „Света гора-Велико Търново“ ООД (Sveta Gora-Veliko Tarnovo OOD), EIK 203389338, with its registered address at 6 Rositsa St., apt. 4, 5100 Gorna Oryahovitsa, Veliko Tarnovo Province, Bulgaria.

Trading name: Park Hotel RAYA Garden, Sveta Gora Park, 5000 Veliko Tarnovo, Bulgaria.

For any question or request about your personal data: hotel@svetagora.bg, +359 896 100 100.

2. What we collect and why

Room and table reservations, hotel stays

Data: Name, phone, email, dates of stay, number of guests, special requests and notes on the booking.
Legal basis: Performance of a contract — GDPR Art. 6(1)(b).
Registration: On check-in we register guests using details from an identity document, as the Bulgarian Tourism Act requires — a legal obligation, GDPR Art. 6(1)(c).

Event and corporate enquiries

Where from: Facebook and Instagram lead forms, the contact form and the wedding configurator on this site.
Data: Name, phone, email, company, event month, number of guests and the content of your enquiry.
Legal basis: Steps taken at your request before entering into a contract — GDPR Art. 6(1)(b).

Website analytics and advertising

Tools: Google Analytics 4, Google Tag Manager, the Meta Pixel and the OpenAI advertising pixel (ChatGPT ads).
Data: Cookie identifiers, IP address, device and browser type, pages visited, where you came from (for example an ad) and actions on the site — such as sending an enquiry or starting a booking.
Legal basis: Consent — GDPR Art. 6(1)(a). You can withdraw it at any time; see the Cookie Policy for how.

Phone calls and emails

Data: Name, phone number or email address, and what was said or written.
Legal basis: Legitimate interest in answering your enquiries and corresponding with you — GDPR Art. 6(1)(f).

Showing the site in your language

Data: If you have not chosen a language, your IP address is sent to the ipwho.is service to determine your country, so we can show the site in Bulgarian, English or Romanian. Only the chosen language is kept, on your own device.
Legal basis: Legitimate interest — GDPR Art. 6(1)(f).

Booking and registration details are needed to accommodate you; without them we cannot enter into the contract. We do not make decisions based solely on automated processing that have legal effects on you.

3. Who we share data with

We do not sell personal data. We share it only with providers that process it on our behalf, or for their own part of the purposes above:

Meta Platforms Ireland Ltd — the Meta Pixel, and Facebook and Instagram lead forms.
Google Ireland Ltd — Google Analytics 4, Google Tag Manager, and the site's fonts (Google Fonts), which your browser loads from Google, sending it your IP address.
SuperHosting.BG — hosts this site in Bulgaria, including the server that receives wedding configurator enquiries.
Sanity — the content management system that holds the site's text and photos. It stores no guest data.
Clock Software (Clock PMS+) — the online room booking system.
Formspree — delivers messages sent through the contact form to us.
OpenAI — the advertising pixel for ChatGPT ads.
ipwho.is — country lookup by IP address, for choosing the language.
Public authorities, where the law requires it — for example tourist registration or the tax authorities.

4. Transfers outside the EU

Some of these providers, including Google, Meta and OpenAI, may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, or on Standard Contractual Clauses approved by the European Commission.

5. How long we keep data

Enquiries that do not become bookings — 12 months from our last contact with you.
Booking and accounting records — as long as the Bulgarian Accounting Act and tax legislation require.
Guest registration data — as long as the Tourism Act requires.
Analytics and advertising data — according to each tool's settings. The lifetime of each cookie is listed in the Cookie Policy.

6. Your rights

You have the right:

of access — to know what data we hold about you and receive a copy;
to rectification of inaccurate or incomplete data;
to erasure (the "right to be forgotten");
to restriction of processing;
to data portability — to receive your data in a machine-readable format;
to object to processing based on legitimate interest;
to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, email us at hotel@svetagora.bg or call +359 896 100 100. We reply within one month. We may ask you to confirm your identity so that we never disclose your data to someone else.

7. Complaints

If you believe we process your data unlawfully, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД), cpdp.bg.

Changes

When we change this policy, we update the date at the top of the page.