Please read this document carefully. It contains the Privacy Policy for guests and clients of “KINGS VALLEY” Ltd.  (“the Policy”) and aims to explain the practices related to the processing of personal data in the context of the services provided and activities carried out.

This Policy has been prepared in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation).

PRIVACY POLICY FOR GUESTS AND CLIENTS OF “KINGS VALLEY” Ltd.

GENERAL PROVISIONS

Art. 1. In connection with the provision of its services and the performance of its activities, “KINGS VALLEY” Ltd.  processes, as a data controller, the personal data of its clients – natural persons, as well as the personal data of other individuals listed below (“Data Subjects” / “You”), in accordance with the rules and principles set out in this Policy.

Art. 2. “KINGS VALLEY” Ltd. is a company registered under UIC 200285944 and VAT number BG200285944, with its registered office and management address in Sofia, 12 Viskyar Planina Street, telephone: +359 883 244 544, e-mail address: .

DATA SUBJECTS

Art. 3. (1) In connection with the services provided, “KINGS VALLEY” Ltd. processes information regarding the following Data Subjects:

(a) natural persons visiting the website www.kingsvalleyhotel.bg (the “Website”);

(b) natural persons making reservations on their own behalf or on behalf of another natural or legal person through the Website;

(c) natural persons using the services provided by “KINGS VALLEY” Ltd., including but not limited to hotel accommodation services, restaurant services and related services, provision of premises for organizing conferences and other events, etc., as well as natural persons representing or otherwise acting on behalf of legal entities that use these services;

(d) natural persons who, on their own behalf or on behalf of another person they represent, submit inquiries (including but not limited to by e-mail, fax, phone call, through the Instant Messaging functionality on the Website, via the hotel’s social media, etc.), requests, signals, complaints or other correspondence to “KINGS VALLEY” Ltd.;

(e) natural persons whose information is contained in inquiries (including phone calls or use of the Instant Messaging functionality on the Website), requests, signals, complaints, or other correspondence to “KINGS VALLEY” Ltd..

(2) The services of “KINGS VALLEY” Ltd. may be requested only by legally capable persons who are at least 18 years of age.

CATEGORIES OF PERSONAL DATA

Art. 4. The information (categories of personal data) that “KINGS VALLEY” Ltd. processes regarding Data Subjects in accordance with this Policy may include the following:

In connection with the provision of hotel accommodation services:

(a) Identification data: guest’s names; date of birth; gender; nationality; national identification number (such as Personal Identification Number for Bulgarian citizens) and/or ID document number; date of issue of the ID document; validity of the ID document; country of issue; signature.

(b) Contact details: telephone; e-mail address; address.

(c) Information related to hotel accommodation: room number; floor; dates of stay (arrival and departure dates); duration of stay (number of nights); use of a tourist package; room type preference; guest VIP status.

(d) Additional information related to hotel accommodation, upon explicit request by the service user: special requirements and preferences, including type of press, food and beverage preferences; special requirements regarding food, beverages, and other substances the guest cannot come into contact with (for any reason).

(e) Payment and invoicing data: payment method (cash, bank transfer, credit card, etc.); information on due and completed payments; information on payment deadlines and overdue/unpaid obligations; bank details (bank, IBAN, account holder); currency of payment; credit/debit card number, validity, and cardholder; CVC code; information contained in a payment authorization form (slip); name of legal entity; address of legal entity; VAT number and/or other identification, tax or registration number (including Personal Identification Number for natural persons); signed authorization forms.

In connection with the provision of restaurant services:

(a) Identification data: names.

(b) Contact details: telephone; e-mail address; address.

(c) Payment and invoicing data: credit/debit card number, validity, and cardholder; CVC code; name of legal entity; address of legal entity; VAT number and/or other identification or registration number (for sole traders and individuals); signed authorization forms.

(d) Information related to preferences (upon explicit declaration by the service user): food and beverage preferences; preferred payment method; special requirements regarding foods, beverages, or other substances the guest cannot come into contact with (for any reason).

When the Data Subject represents another person (e.g., a company):

Information identifying the represented person and the representative’s capacity (including workplace, position), as well as details of the services requested or orders placed in that capacity.
Likewise, when the services are requested by a person other than the Data Subject for the benefit of the Data Subject, information about the capacity in which the Data Subject will use the services, by whom they were requested, who will make the payment, etc.
(For example, accommodation organized by the Data Subject’s employer or business partner, and similar cases.)

In connection with the issuance of customer discount cards:

(a) Identification data: names.

(b) Information about the discount available for use with the respective customer card.

In connection with the services and functionalities of the Website:

(a) Data processed in relation to hotel accommodation reservations: names; e-mail address; telephone; country; credit/debit card number, validity, and cardholder; CVC code; number of rooms; number of guests (including number of adults and children); corporate code / access code / discount code; event and/or group booking code; reservation number; special offers and guest preferences (if explicitly indicated in the reservation form); package data (e.g., “Romantic Getaway Package,” “Special Occasion Package,” “Explore Sofia Weekend Package,” etc.).

(b) Unstructured content from conversations and inquiries with a reservation agent through the Website’s Instant Messaging functionality.

(c) Unstructured content from conversations and inquiries with hotel staff through the hotel’s social media profiles (Facebook, Instagram, LinkedIn, TikTok, etc.).

(d) Information from access logs, server logs, and logs of security devices (Web Application Firewalls and other devices in this category): date and time, IP address, URL, browser and device information.

(e) Cookies: The Website requires the use of cookies for its operation. A detailed description of the cookies used, their purpose, and the information processed through them can be found in the Cookie Policy of “KINGS VALLEY” Ltd., available at: https://kingsvalleyhotel.bg/en/cookie-policy/.

In connection with complaints, applications, requests, or signals submitted by clients (including in free-text form):

Unstructured information contained in the respective complaints, applications, requests, or signals.

VIDEO SURVELLANCE & SECURITY

Art. 5. (1) In accordance with the requirements of the applicable legislation, “KINGS VALLEY” Ltd. implements security measures that include the following technical and organizational means for access control and for ensuring physical security against intrusions into its buildings and facilities, as well as for the protection of the life and health of individuals: physical security guards, alarm security systems, and a video surveillance system performing 24-hour monitoring, consisting of recording and storage devices.

(2) Video surveillance and video recording may be carried out in publicly accessible areas and premises within the buildings of “KINGS VALLEY” Ltd., as well as in areas subject to a special access regime. No video surveillance is conducted in guest rooms, sanitary facilities, relaxation areas, or similar premises. The data obtained from video surveillance activities are stored in a monitoring room with restricted access and 24-hour security.

(3) By means of information boards placed in visible locations, Data Subjects and other visitors who may be recorded are notified about the use of technical surveillance and control systems, as well as about any other relevant information related to the monitoring being performed.

DIRECT MARKETING

Art. 6. (1) With the explicit consent of the Data Subject, “KINGS VALLEY” Ltd., and/or other companies affiliated with or partners of “KINGS VALLEY” Ltd., may process the following personal data: name; telephone number; address; e-mail address; information regarding the type and scope of services used and preferred by the Data Subject, provided by “KINGS VALLEY” Ltd., as well as other data expressly indicated in the respective consent. Such processing may be carried out for the purposes of direct marketing, including offering other goods and services (including those offered by third parties), conducting surveys and questionnaires to improve service quality, and similar activities, all in accordance with the scope of the specific consent provided.

(2) When personal data are processed for the purposes of direct marketing, the Data Subject has the right to object at any time to such processing. In these cases, the processing of the personal data for these purposes shall cease.

(3) The Data Subject has the right to withdraw at any time any consent previously given for the processing of their personal data for the purposes of direct marketing. In such cases, processing based on the withdrawn consent shall be discontinued.

(4) Profiling for the purposes of direct marketing may be carried out only with the explicit consent of the Data Subject, and at least the following additional safeguards for their rights and interests shall apply: the right to human intervention by the controller; the right to express their point of view; and the right to contest decisions based on profiling.
At present, “KINGS VALLEY” Ltd. does not perform such personal data processing activities.

PURPOSES OF PERSONAL DATA PROCESSING

Art. 7. “KINGS VALLEY” Ltd. collects, stores, and processes the information described in Articles 4, 5, and 6 above for the purposes set forth in this Policy and in the general terms and conditions (contract) governing the use of its respective services. Depending on the legal basis for the processing, these purposes may include:

(a) purposes related to compliance with the legal obligations of “KINGS VALLEY” Ltd.;
(b) purposes related to and/or necessary for the performance of contracts concluded with “KINGS VALLEY” Ltd. or for taking steps at the request of the Data Subject prior to entering into such a contract;
(c) purposes related to the legitimate interests of “KINGS VALLEY” Ltd. or of third parties;
(d) purposes for which the Data Subject has given consent for the processing of their data.

Art. 8.The purposes of personal data processing by “KINGS VALLEY” Ltd. related to compliance with legal obligations include:

1. maintaining a register of accommodated guests and providing information from it to competent authorities as required by law;
2. registering the address of foreign nationals in accordance with applicable legislation;
3. withholding and paying the tourist tax;
4. activities related to the development and implementation of anti-terrorism measures;
5. handling signals, complaints, requests for the exercise of rights, and similar matters, as well as claims and commercial guarantees (where applicable), including the preparation of responses thereto;
6. accounting, invoicing, and reporting of received and made payments in accordance with the applicable tax and accounting legislation;
7. other activities required to fulfill legal obligations (tax, accounting, regulatory, licensing, etc.) of “KINGS VALLEY” Ltd., including the provision of information to competent state and judicial authorities and cooperation during official inspections.

Art. 9. The purposes of personal data processing by “KINGS VALLEY” Ltd. related to and/or necessary for the performance of contracts or for taking steps at the request of the Data Subject prior to entering into a contract include:

1. accepting, administering, and processing reservations and cancellations;

2. customer service, including the provision of online services through the Websites;

3. enabling account registration, administration, and maintenance of registered profiles in the online store accessible through the Website;

4. administration, fulfillment, and delivery of purchases made through the Website;

5. communication related to the provided services;

6. administration and receipt of payments for provided services, including remotely;

7. ensuring guarantees for reservations and payment of hotel accommodation and additional services;

8. financial and accounting operations, including administration, processing, and collection of payments for provided services;

9. refunding incorrectly transferred amounts;

10. ensuring a personalized approach in the provision of services according to the user’s expressed preferences.

Art. 10. The purposes of personal data processing related to the legitimate interests of “KINGS VALLEY” Ltd. or of third parties include:

1. Legitimate interest – (1.1) exercising and protecting the lawful rights and interests of “KINGS VALLEY” Ltd.; and (1.2) assisting in the exercise and protection of the lawful rights and interests of clients; other persons associated with “KINGS VALLEY” Ltd.; employees of “KINGS VALLEY” Ltd.; data processors acting on its behalf; and business partners of “KINGS VALLEY” Ltd.:
(a) establishing, exercising, or defending legal claims of the above-mentioned persons, including through judicial means, and filing complaints, alerts, or similar with competent state or judicial authorities;
(b) video surveillance and access control for the protection of “KINGS VALLEY” Ltd.’s property, ensuring compliance with applicable requirements, physical security of buildings and facilities, and protection of individuals’ life and health;
(c) taking actions to suspend service provision in cases of payment refusal, breach of “KINGS VALLEY” Ltd. rules and policies, etc.;
(d) administration and handling of received complaints, signals, requests, and similar communications;
(e) collection of receivables due to “KINGS VALLEY” Ltd., including through enforcement and/or assignment to third parties, as well as transfer of receivables to third parties (cession) as permitted by law;
(f) issuing notarial invitations.

2. Legitimate interest – analysis, planning, and improvement of service quality provided by “KINGS VALLEY”:
(a) maintaining backup copies of data from the internal information system to reflect the current state of the hotel (occupancy, liabilities, etc.) in the event of system failure;
(b) receiving, processing, and preparing responses to applications, requests, etc., not related to service complaints;
(c) studying customer satisfaction with the provided services;
(d) monitoring, analyzing, and optimizing business processes to improve service quality.

3. Legitimate interest – ensuring the proper functioning and use of the Website:
(a) maintenance and administration of the Website;
(b) detecting and resolving technical issues related to the Website’s functionalities;
(c) implementing measures against malicious actions affecting the security and normal operation of the Website.

4. Legitimate interest – conducting hotel and restaurant operations and ensuring high-quality hospitality and catering services:
(a) administration and management of the services provided by “KINGS VALLEY” Ltd.;
(b) management and quality control of the services provided;
(c) obtaining feedback regarding the provided services.

Art. 11. The purposes of personal data processing based on the consent given by the Data Subject include:

1. sending marketing and promotional messages regarding services, special offers, packages, events, and similar activities;

2. conducting surveys and obtaining feedback regarding service quality;

3. sending newsletters;

4. other purposes for which specific consent has been provided by the Data Subject.

PROVISION OF PERSONAL DATA AND CONSEQUENCES OF REFUSAL TO PROVIDE IT TO GRAND HOTEL MILLENNIUM SOFIA

Art. 12. (1) “KINGS VALLEY” Ltd. clearly indicates, where applicable and in an appropriate manner, whether the provision of certain data and/or documents is mandatory or constitutes a requirement necessary for the conclusion or performance of a contract, as well as the consequences of refusing to provide such information.

(2) Where additional clarification is needed, any Data Subject may request further information at the premises of “KINGS VALLEY” Ltd. or send an inquiry to the contact details specified in Article 23 of this Policy.

(3) Refusal to provide data and documents identified as mandatory may constitute an insurmountable obstacle to the provision of a service by “KINGS VALLEY” Ltd., as well as to the processing and fulfillment of submitted requests, applications, petitions, or complaints, thereby releasing “KINGS VALLEY” Ltd. from liability for non-performance.

(4) Refusal to provide data and documents, or the provision of false information, may result in the inability to deliver the respective services or in the suspension of access to services provided by “KINGS VALLEY” Ltd.

(5) Data Subjects should not provide “KINGS VALLEY” Ltd. with any special categories of personal data within the meaning of Articles 9 and 10 of the Regulation (namely: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data; data concerning health; or data concerning a person’s sex life or sexual orientation; as well as personal data related to criminal convictions and offences).

OTHER SOURCES OF PERSONAL DATA

Art. 13. (1) In certain cases, the personal data processed by “KINGS VALLEY” Ltd. are not collected or received directly from the Data Subject to whom they relate, but rather from third parties such as:

1. persons representing, employed by, or otherwise cooperating with the Data Subject;

2. event organizers – with regard to information about event participants;

3. business partners of “KINGS VALLEY” Ltd. (e.g., booking platforms such as booking.com, travel agents, or other intermediaries providing reservation or related services);

4. competent state and judicial authorities.

(2) The persons referred to in paragraph (1), items 1–3 undertake to inform the Data Subjects whose data they provide to “KINGS VALLEY” Ltd. and to ensure that they supply such data on a valid legal basis.

PROCESSING OF INFORMATION BY THIRD PARTIES – PERSONAL DATA PROCESSORS

Art. 14. (1) For the purposes specified in this Policy, “KINGS VALLEY” Ltd. may assign personal data processing activities to third parties — data processors, in accordance with and within the scope of the requirements of the Regulation and other applicable data protection laws.

(2) When personal data are disclosed to and processed by data processors, this shall be done only to the extent and scope necessary for the performance of the tasks assigned to them by “KINGS VALLEY” Ltd.

(3) The data processors act on behalf of “KINGS VALLEY” Ltd. and are required to process personal data strictly in compliance with the instructions of “KINGS VALLEY” Ltd., without having the right to use or otherwise process the information for purposes other than those specified in this Policy.

CATEGORIES OF PERSONAL DATA RECIPIENTS

Art. 15. “KINGS VALLEY” Ltd. does not disclose personal data concerning the Data Subject to third parties, except in the following cases:

1. When required to fulfill a legal obligation of “KINGS VALLEY” Ltd.:
   (a) to competent state, municipal, or judicial authorities;
   (b) to auditors.

2. When expressly provided for in this Policy and/or in the general terms (contract) for the use of the respective services provided by “KINGS VALLEY” Ltd.:
   (a) to data processors acting on behalf of “KINGS VALLEY” Ltd.;
   (b) to debt collection agencies.

3. When necessary for the provision of the services of “KINGS VALLEY” Ltd.:
   (a) to banks and payment service providers;
   (b) to postal and courier service providers;
   (c) to business partners of “KINGS VALLEY” Ltd., such as reservation platforms, travel agencies, and other providers of tourist or ancillary services (e.g., car rentals, taxi or other transport services, and similar).

4. When the Data Subject has given explicit consent — to the persons specified in the respective consent (e.g., entities affiliated with or business partners of “KINGS VALLEY” Ltd. and others).

5. When necessary for the protection of the rights or legitimate interests of “KINGS VALLEY” Ltd., third parties, or the Data Subject:
   (a) to state, municipal, and judicial authorities;
   (b) to private or state enforcement officers;
   (c) to lawyers;
   (d) to notaries.

6. In other cases provided for by law.

Art. 16. (1) “KINGS VALLEY” Ltd. processes and stores information about the Data Subject until the purposes for which it was collected and processed are achieved.

(2) In accordance with its internal rules and procedures and applicable legislation, “KINGS VALLEY” Ltd. processes and stores information about the Data Subject within the following time limits:

RIGHTS OF DATA SUBJECTS IN RELATION TO THEIR PERSONAL DATA

Art. 17. (1) In connection with the processing of personal data concerning them, each Data Subject has the following rights:

1. Right to information – to obtain information regarding the processing of their personal data by “KINGS VALLEY” Ltd.

2. Right of access:
   (a) to obtain confirmation as to whether personal data concerning them are being processed;
   (b) to access the personal data being processed and detailed information regarding the processing and their rights.

3. Right to rectification – to request the correction or completion of personal data if they are inaccurate or incomplete.

4. Right to erasure – to request the deletion of personal data if the conditions provided in the Regulation are met.

5. Right to restriction of processing – to request that “KINGS VALLEY” Ltd. restrict the processing of personal data under the conditions provided in the Regulation.

6. Notification of third parties – the right to request that “KINGS VALLEY” Ltd. inform third parties to whom personal data have been disclosed about any rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.

7. Right to data portability – to receive personal data concerning them that they have provided to “KINGS VALLEY” Ltd. in a structured, commonly used, and machine-readable format, and to transfer those data to another controller without hindrance from “KINGS VALLEY” Ltd. This right applies only if both of the following conditions are met:
   (a) processing is based on consent or a contractual obligation; and
   (b) processing is carried out by automated means.

   Where technically feasible, the Data Subject has the right to request a direct transfer of personal data from “KINGS VALLEY” Ltd. to another controller. This right may be exercised in a manner that does not adversely affect the rights and freedoms of others.

8. Rights related to automated individual decision-making, including profiling – to not be subject to a decision based solely on automated processing (i.e., processing without human intervention), including profiling as defined in the Regulation, which produces legal effects concerning them or similarly significantly affects them, except where the Regulation allows it and appropriate safeguards are in place to protect the rights, freedoms, and legitimate interests of the Data Subject. Such safeguards include, at a minimum: the right to human intervention by “KINGS VALLEY” Ltd., the right to express their point of view, and the right to contest the decision.

   If such a decision, including profiling, is made concerning the Data Subject, they have the right to receive separate, meaningful information from “KINGS VALLEY” Ltd. for each case regarding the logic used, the significance, the expected consequences of such processing, and how to exercise their rights under this provision.

9. Right to withdraw consent to processing – where the processing of personal data is based solely on the Data Subject’s consent, the Data Subject may withdraw consent at any time. Such withdrawal does not affect the lawfulness of processing carried out based on the consent prior to its withdrawal.

RIGHT TO OBJECT

Art. 18. The Data Subject has the right, at any time and based on grounds related to their particular situation, to object to the processing of personal data concerning them, including profiling as defined in the Regulation, when such processing is based on public interest, the exercise of official authority, or the legitimate interests of “KINGS VALLEY” Ltd. or a third party.

In such cases, “KINGS VALLEY” Ltd. shall cease the processing of personal data, unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of legal claims.

Art. 19. (1) The Data Subject may exercise their rights related to personal data protection by personally submitting a written request to “KINGS VALLEY” Ltd. — either delivered in person to the address specified in Article 23 of this Policy or sent by mail as a notarized request.

(2) The request under paragraph (1) may also be submitted electronically, provided it is signed by the Data Subject with a qualified electronic signature in accordance with the Law on Electronic Document and Electronic Certification Services and Article 3(12) of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market, repealing Directive 1999/93/EC, and sent to “KINGS VALLEY” Ltd. at the email address specified in Article 23 of this Policy.

(3) The Data Subject may exercise their personal data rights personally or through a specifically authorized representative (with a notarized power of attorney).

(4) Some of these rights may also be exercised through the functionalities available on the Website.

RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Art. 20. Every Data Subject has the right to file a complaint with a supervisory authority responsible for personal data protection, in particular in the EU/EEA Member State of their habitual residence, place of work, or the location of the alleged infringement, if they believe that the processing of their personal data violates the provisions of the Regulation or other applicable personal data protection requirements.

SUPERVISORY AUTHORITY IN THE REPUBLIC OF BULGARIA

Art. 21. The supervisory authority in the Republic of Bulgaria is:

Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: https://www.cpdp.bg/

LIMITATIONS OF RIGHTS

Art. 22. The scope of the rights of Data Subjects and the obligations of “KINGS VALLEY” Ltd. regarding these rights may be restricted by legislative measures under EU law or the law of a Member State applicable to “KINGS VALLEY” Ltd.

CLARIFICATIONS AND ADDITIONAL INFORMATION

Art. 23. The Data Subject may obtain clarifications regarding the content and grounds for data processing, the manner of exercising the rights under this Policy, as well as any additional information concerning their rights in relation to the processing of personal data by “KINGS VALLEY” Ltd. at:

Address: 12 Viskyar Planina St., Sofia, Bulgaria
Email:
Phone: +359 883 244 544

This Personal Data Protection Policy has been prepared by “KINGS VALLEY” Ltd. in its capacity as a data controller, in order to fulfill its obligations to provide information to Data Subjects pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).

This Personal Data Protection Policy has been in effect since 01.10.2022.
Last updated: 02.10.2025.