Casa Real Apartments Sveti Vlas

Privacy Policy

Mandatory Information on the Rights of Individuals Regarding Personal Data Protection

Information Regarding the Data Controller Processing Your Data

Name: „Casa Real Invest“ EOOD
UIC/BULSTAT: BG208628176
Registered Office and Management Address: 14 Han Kubrat St., Yambol, Bulgaria

Correspondence Address: 14 Han Kubrat Str., Yambol, Bulgaria

Telephone: +359876751115
E-mail: reservation@casareal.bg

Website: www.casareal.bg

Information Regarding the Competent Supervisory Authority for Personal Data Protection

Name: Commission for Personal Data Protection
Registered Office and Management Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Telephone: 02 915 3 518
Website: www.cpdp.bg

“(Casa Real Invest)“ EOOD (hereinafter referred to as the "Controller" or the "Company") conducts its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR).

This information aims to inform you about all aspects of the processing of your personal data by the Company and the rights you have in connection with this processing.

Legal Basis for the Collection, Processing, and Storage of Your Personal Data

Art. 1. (1) The Controller collects and processes your personal data in connection with the use of the website www.casareal.bg and the conclusion of contracts with the company based on Art. 6, Para. 1 of Regulation (EU) 2016/679 (GDPR), and specifically on the following grounds:

Explicit consent received from you as a customer;
Performance of the Controller's obligations under a contract with you;
Compliance with a legal obligation applicable to the Controller;

For the purposes of the legitimate interests of the Controller or a third party;

Purposes and Principles in the Collection, Processing, and Storage of Your Personal Data

Art. 2. (1) We collect and process the personal data that you provide to us in connection with the use of the website and the conclusion of a contract with the company, including for the following purposes:

profile creation and providing full functionality when using the website;

conclusion and execution of a distance contract;
individualization of a party to the contract;
accounting purposes;
statistical purposes;
protection of information security;

ensuring the performance of the contract for the provision of the respective service.
sending a newsletter upon your expressed desire;

(2) We observe the following principles when processing your personal data:

lawfulness, fairness, and transparency;

purpose limitation;

data minimization and relevance to the purposes of processing;

accuracy and up-to-date data;
storage limitation for the achievement of the purposes;
integrity and confidentiality of processing and ensuring an appropriate level of personal data security.

(3) When processing and storing personal data, the Controller may process and store personal data in order to protect its following legitimate interests:

fulfillment of its obligations towards the National Revenue Agency, the Ministry of Interior, and other state and municipal authorities.

What Types of Personal Data Our Company Collects, Processes, and Stores

Art. 3. (1) The Company performs the following operations with the personal data provided by you for the following purposes:

Conclusion and execution of a commercial transaction with a customer or partner – the purpose of this operation is the conclusion and execution of a contract with a commercial partner or customer and its administration. Given the limited scope of the personal data collected and the fact that part of it is collected from publicly available sources, conducting an impact assessment is not necessary for this operation.

Sending an information bulletin (newsletter) – the purpose of this operation is to administer the process of sending newsletters to customers who have stated that they wish to receive them. Given the limited scope of the personal data collected, conducting an impact assessment is not necessary for this operation.

Exercising the right of withdrawal or filing a claim – the purpose of this operation is to administer the process of exercising the right of withdrawal or a claim by the customer. Given the limited scope of the personal data collected, conducting an impact assessment is not necessary for this operation.

(2) The Controller processes the following categories of personal data and information for the following purposes and on the following legal bases:

Your identifying data (email, name, etc.)
- Purpose for which the data is collected: 1) Establishing contact with the user and sending information to them, 2) for the purposes of user registration on the website, as well as 3) for sending an inquiry.

Legal basis for processing your personal data: By accepting the terms and conditions and registering on the website, or making an order without registration, or upon concluding a written contract, a contractual relationship is created between the Controller and you, on which basis we process your personal data – Art. 6 (1) (b) GDPR. Your data for sending a newsletter is processed based on your explicit consent – Art. 6 (1) (a) GDPR.

Delivery data (names, phone, address, etc.)
- Purpose for which the data is collected: Fulfillment of the controller's obligations regarding the delivery of a service.
- Legal basis for processing your personal data: By accepting the terms and conditions and registering on the website, or making an order without registration, or upon concluding a written contract, a contractual relationship is created between the Controller and you, on which basis we process your personal data – Art. 6 (1) (b) GDPR.

Additional data provided by you – If you wish to complete your profile, you can fill in data for first name, last name, and telephone number.

Purpose for which the data is collected: Supplementing information about the user in their user account.
Legal basis for processing the data: You have provided explicit consent for the processing of your personal data for one or more specific purposes – Art. 6 (1) (a) of the GDPR at the time of registration on the website. Providing this data is not mandatory for registration on the website.

(3) The Controller does not collect and does not process personal data that relates to the following:

reveal racial or ethnic origin;

reveal political, religious, or philosophical beliefs, or trade union membership;

genetic and biometric data, health data, or data concerning a natural person's sex life or sexual orientation.

(4) Personal data is collected by the Controller from the individuals to whom it relates.

(5) The Company does not perform automated decision-making with data.

Art. 4. (1) The Company performs the following operations with the personal data provided by you as legal representatives or proxies of legal entities-commercial partners for the following purposes:

Conclusion and execution of a commercial transaction: For the conclusion and execution of a commercial transaction with a commercial company, we process only the full three names of the legal representative or the person authorized by the company. Conclusion from the impact assessment: Given the small volume of natural persons whose data is processed and given the limited volume of personal data collected, conducting an impact assessment is not necessary for this operation.

(2) Personal data is collected by the Controller from the individuals to whom it relates and from the Commercial Register at the Registry Agency.

(3) The Company does not perform automated decision-making with data.

Art. 5. The Controller may use so-called "cookies" for the purposes of providing full functionality of the website, improving user experience, statistical purposes, easier access, etc., to which you agree by using our website. You can control and/or delete "cookies" at any time through the settings of the browser you use. "Cookies" do not constitute personal data and are not used to identify visitors and users of the website.

Period of Storage of Your Personal Data

Art. 6. (1) The Controller stores your personal data for a period no longer than the existence of your profile on the website. After the deletion of your profile, the Controller takes due care to delete and destroy all your data without undue delay or to anonymize it (i.e., to bring it into a form that does not reveal your identity).

(2) The Controller processes your personal data, which you provided when placing an order without registration on the website, until the completion of the order, unless you have given your explicit consent when placing the order for your data to be processed for the purposes of improving the service, providing recommended content for you, individual terms, promotions, as well as for statistical purposes.

(3) The Controller stores your personal data provided in connection with online orders placed for a period of 5 years for the purpose of protecting the legal interests of the Controller in judicial or administrative disputes with users of the website.

(4) The Controller shall notify you in the event that the period for data storage needs to be extended in view of fulfilling a regulatory obligation or in view of the legitimate interests of the Controller or otherwise.

(5) The Controller stores the personal data that it is required to keep under applicable legislation for the respective prescribed period, which may exceed the period of existence of your profile on the website or until the completion of the order.

Art. 7. The Controller stores the personal data of the legal representatives of its commercial partners for the duration of the performance of the contract, for compliance with the legitimate interests and legal obligations of the Controller, and this period may exceed the duration of the concluded contract.

Transfer of Your Personal Data for Processing

Art. 8. (1) The Controller may, at its own discretion, transfer part or all of your personal data to personal data processors for the fulfillment of the processing purposes to which you have agreed, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Controller shall notify you in case of an intention to transfer part or all of your personal data to third countries or international organizations.

Your Rights in the Collection, Processing, and Storage of Your Personal Data

Withdrawal of Consent for the Processing of Your Personal Data

Art. 9. (1) If you do not wish the personal data provided by you to be processed for marketing purposes and for receiving a newsletter, you may at any time withdraw your consent for processing by filling out the consent withdrawal form in Appendix No. 1 or by a request in free text, and sending it to us by email.

(2) After we receive your request, we will send a letter with detailed instructions for your verification as a newsletter recipient and a personal data subject, for whom the withdrawal of consent has been requested, to the email you specified for receiving newsletters and advertising messages.

(3) The withdrawal of consent does not affect the lawfulness of the personal data processing that the Controller has carried out up to that moment.

Right of Access

Art. 10. (1) You have the right to request and obtain confirmation from the Controller as to whether personal data relating to you is being processed, by sending a request in free text by email.

(2) You have the right to obtain access to the data relating to you, as well as to the information relating to the collection, processing, and storage of your personal data.

(3) After we receive your request, we will send a letter with detailed instructions for your verification as a subject of the personal data to which access is requested to the email you used for registration or placing orders on the website.

(4) After performing the verification pursuant to Para. 3, the Controller shall provide you, upon request, with a copy of the processed personal data relating to you in an electronic or other appropriate form.

(5) Providing access to the data is free of charge, but the Controller reserves the right to impose an administrative fee in case of repetitiveness or excessiveness of the requests.

Right to Rectification or Completion

Art. 11. (1) You can at any time rectify or complete inaccurate or incomplete personal data relating to you through the "Edit Profile" option.

(2) You can rectify or complete inaccurate or incomplete personal data relating to you directly through your profile on the website or by submitting a request to the Controller by email, using the form in Appendix No. 4 or through a request in free text.

Right to Erasure ("Right to be Forgotten")

Art. 12. (1) You have the right to request from the Controller the erasure of part or all of the personal data relating to you, and the Controller has the obligation to erase it without undue delay when any of the grounds listed below is present:

the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

you withdraw your consent on which the data processing is based and there is no other legal basis for the processing;

you object to the processing of the personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;

the personal data has been processed unlawfully;
the personal data must be erased for compliance with a legal obligation under EU law or the law of a Member State applicable to the Controller;
the personal data has been collected in connection with the offer of information society services.

(2) The Controller is not obliged to erase the personal data if it stores and processes it:

for exercising the right of freedom of expression and the right to information;
for compliance with a legal obligation which requires processing provided for by EU law or Member State law applicable to the Controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;

for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;

for the establishment, exercise, or defense of legal claims.

(3) In order to exercise your right to be forgotten, it is necessary to send a request by email for the erasure of your personal data processed by the Controller, by filling out the form in Appendix No. 2 or through a request in free text, after which the Controller will send a letter with detailed instructions for your verification as a website user and a subject of the personal data for which the erasure request has been made to the email you used for registration or making orders on the website.

(4) Once we verify the identity of the person who made the request and the person to whom the data relates in accordance with the instructions sent to you, we will delete all data we process for you, in accordance with Para. 3.

(5) If there is an order placed by you that is in the process of being processed, the earliest moment at which you can request to be "forgotten" is upon the successful completion of the order.

Right to Restriction of Processing

Art. 13. You have the right to request the Controller to restrict the processing of data relating to you by sending us a request in free text by email when:

you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
the processing is unlawful, but you do not wish the personal data to be erased, but only its use to be restricted;
the Controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of your legal claims;

you have objected to processing pending the verification whether the legitimate grounds of the Controller override your interests.

(2) After we receive your request, we will send a letter with detailed instructions for your verification as a website user and a subject of the personal data for which a request for restriction of processing has been made to the email you used for registration or making orders on the website.

(3) After performing the verification pursuant to Para. 2, the Company will cease the processing of your data, but will not remove the posts you have made on the website, if any.

Right to Data Portability

Art. 14. (1) If you have given consent for the processing of your personal data or the processing is necessary for the performance of the contract with the Controller, or if your data is processed by automated means, you may:

request the Controller to provide your personal data in a readable format and transfer it to another Controller;
request the Controller to directly transfer your personal data to a controller specified by you, when technically feasible.

(2) You can exercise the right to portability by sending us by email a completed form pursuant to Appendix No. 3 or a request in free text, after which the Controller will send a letter with detailed instructions for your verification as a website user and a subject of the personal data for which a portability request has been made to the email you used for registration or making orders on the website.

(3) After performing the verification pursuant to Para. 2, the Company shall send the data it processes for you in XML format to the email specified by you.

Right to Receive Information

Art. 15. You may request the Controller to inform you regarding all recipients to whom the personal data, for which rectification, erasure, or restriction of processing has been requested, has been disclosed. The Controller may refuse to provide this information if it would be impossible or involves disproportionate effort.

Right to Object

Art. 16. You may object at any time to the processing of personal data by the Controller relating to you, including if it is processed for profiling or direct marketing purposes.

Your Rights in Case of a Personal Data Security Breach

Art. 17. (1) If the Controller detects a personal data security breach that may pose a high risk to your rights and freedoms, it shall notify you without undue delay of the breach, as well as of the measures that have been taken or are about to be taken.

(2) The Controller is not obliged to notify you if:

it has taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
it has subsequently taken measures ensuring that the breach will not lead to a high risk to your rights;
notification would require disproportionate effort.

Persons to Whom Your Personal Data is Provided

Art. 18. (1) For the purposes of processing your personal data and providing the service in its full functionality and in view of your interests, the Controller may provide the data to third parties only for the purposes of concluding a contract and executing a service, namely to an accounting company and a licensed postal operator (courier company), while observing all confidentiality procedures.

(2) Personal data processors comply with all requirements for lawfulness and security in the processing and storage of your personal data.

Art. 19. The Controller does not transfer your data to third countries.

Art. 20. In the event of a violation of your rights under the aforementioned or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:

Art. 21. You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are not mandatory and you can make your requests in any form that contains a statement to that effect and identifies you as the data holder.

Art. 22. If the consent relates to a transfer, the Controller describes the possible risks for the transfer of data to third countries in the absence of an adequacy decision and appropriate safeguards.

Appendix No. 1

Form for Withdrawal of Consent for Processing Purposes

Your Name*: …………………….

Your Email Used on the Website*: ……………………. Contact Details (Email)*: …………………….

To
Name: „Casa Real Invest“ EOOD UIC/BULSTAT: BG208628176 Registered Office and Management Address: 14 Han Kubrat Str., Yambol, Bulgaria Correspondence Address: 14 Han Kubrat Str., Yambol, Bulgaria E-mail: reservation@casareal.bg Website: www.casareal.bg

I hereby withdraw my consent for the processing of the personal data provided by me for the purposes of receiving an information bulletin (newsletter), advertising messages, or other marketing materials, being aware of the conditions for withdrawal of consent in accordance with the Mandatory Information on the Rights of Individuals Regarding Personal Data Protection on the website.

In the event of a violation of your rights under the aforementioned or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:

Name: Commission for Personal Data Protection

Registered Office and Management Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Telephone: +359 2 915 3 518

Website: www.cpdp.bg

Appendix No. 2

Request "To Be Forgotten" – For the Erasure of Personal Data Relating to Me

Your Name*: …………………….

Your Email Used for Registration or Orders on the Website*: …………………….

Contact Details (Email)*: …………………….

To
Name: „Casa Real Invest“ EOOD

UIC/BULSTAT: BG208628176

Registered Office and Management Address: 14 Han Kubrat Str., Yambol, Bulgaria

Correspondence Address: 14 Han Kubrat Str., Yambol, Bulgaria

E-mail: reservation@casareal.bg

Website: www.casareal.bg

Please erase all personal data from your databases that you collect, process, and store, which has been provided by me or by third parties and is related to me according to the specified identification.

I declare that I am aware that part or all of my personal data may continue to be processed and stored by the controller for the purposes of fulfilling its legal obligations.

Name: Commission for Personal Data Protection

Registered Office and Management Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Telephone: +359 2 915 3 518

Website: www.cpdp.bg

Appendix No. 3

Request for Personal Data Portability

Your Name*: …………………….

Your Email Used for Registration or Orders on the Website*: …………………….

Contact Details (Email)*: …………………….

To
Name: „Casa Real Invest“ EOOD UIC/BULSTAT: BG208628176

Registered Office and Management Address: 14 Han Kubrat Str., Yambol, Bulgaria Correspondence Address: 14 Han Kubrat Str., Yambol, Bulgaria

E-mail: reservation@casareal.bg

Website: www.casareal.bg

Please send all personal data relating to me, which is collected, processed, and stored in your databases, in XML format to:

E-mail: …………………….
Receiving Data Controller: …………………….

Name: …………………….

Identification Number (UIC, BULSTAT, Reg. No. with CPDP): …………………….

E-mail: ……………………

Name: Commission for Personal Data Protection

Registered Office and Management Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Telephone: +359 2 915 3 518

Website: www.cpdp.bg

Appendix No. 4

Request for Data Rectification

Your Name*: …………………….

Your Email Used for Registration or Orders on the Website*: …………………….

Contact Details (Email)*: …………………….

To:

Name: „Casa Real Invest“ EOOD UIC/BULSTAT: BG208628176

Registered Office and Management Address: 14 Han Kubrat Str., Yambol, Bulgaria

Correspondence Address: 14 Han Kubrat Str., Yambol, Bulgaria

E-mail: reservation@casareal.bg

Website: www.casareal.bg

Please rectify the following personal data that you collect, process, and store, which has been provided by me or by third parties and is related to me, as follows:

Data Subject to Rectification: ……………………..

Please Rectify in the Following Manner: …………

Name: Commission for Personal Data Protection

Registered Office and Management Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Telephone: +359 2 915 3 518

Website: www.cpdp.bg

Contact us

Privacy Policy

Quick links

Apartments

Contacts