Privacy Policy

The data controller is „SMOLYAN FILM“ EOOD, UIC 830158373, with registered office and management address in the city of Smolyan, 51 Bulgaria Blvd.

• Phone: +359 888 909 119
• E-mail: info@luxor-bg.com
• Website: www.luxor-bg.com

When you fill in the booking request form, we collect the following data that you voluntarily provide:

• Name (full name or company, for a request from a legal entity);
• E-mail address and phone number for contact;
• Check-in / check-out dates and number of guests (adults/children);
• Selected room type and additional notes on the request.

To protect the form from automated abuse (spam), the system logs technical data: the sender's IP address and the timestamp of the request. This data is not used for profiling.

We process your data for the following purposes and on the following legal bases:

• Performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) — responding to an enquiry and preparing an accommodation offer;
• Legitimate interest of the controller (Art. 6(1)(f) GDPR) — protection of the system from abuse, spam and repeated fake requests;
• Legal obligation (Art. 6(1)(c) GDPR) — retention of accounting and hotel documents under applicable legislation.

Data from unsuccessful or unanswered booking requests is kept for up to 12 months from the date of submission, after which it is deleted.

Data that has been used for a concluded accommodation contract or included in accounting documents is kept for the periods required by the Accountancy Act and related regulations (usually 5 years, and for specific documents — up to 10 years).

A hosting and database provider, as well as a transactional email service provider, process data as processors under contract with the controller and in compliance with the GDPR.

Personal data is not sold, not transferred to third parties for marketing purposes, and not transferred outside the European Economic Area without a legal basis (e.g. an adequate level of protection under Art. 45 GDPR).

In accordance with the GDPR, you have the following rights:

• Right of access to your personal data and to a copy of it;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure („the right to be forgotten“);
• Right to restriction of processing;
• Right to data portability;
• Right to object to processing based on legitimate interest;
• Right to withdraw consent, where processing is based on consent.

To exercise your rights, write to us at info@luxor-bg.com. We will respond within 1 month, in accordance with Art. 12 GDPR.

If you believe that the processing of your data infringes your rights, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP):

• Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd;
• Website: www.kzld.bg;
• Phone: +359 2 815 18 20; e-mail: kzld@cilec.bg / kzld@kzld.bg.

The website uses technically necessary cookies, which ensure that the selected language version is remembered and that the site works correctly. They do not store identifying personal data and do not require your consent.

For traffic statistics we use Google Analytics (Google Ireland Ltd.) via the Google Consent Mode v2 technology. The Google Analytics tag (gtag.js) is loaded on every page, but it defaults to a „denied“ state — no analytics cookies (e.g. _ga, _ga_*) are set and no identifying data is collected until you accept via the cookie banner. In the „denied“ state Google receives only anonymous, cookieless signals for traffic modelling. Once you accept, Google Analytics processes aggregated visit data (pages visited, approximate location, device type). You can withdraw or change your consent at any time via the „Cookie settings“ link in the site footer.

A Google Maps map is embedded on the „Contact“ page, which may set its own cookies from Google. You can manage and delete cookies through your browser settings.

We apply technical and organisational measures to protect personal data from unauthorised access, loss or abuse: database access only for authorised persons, an encrypted connection (HTTPS) and restricted access to the request form (protection against spam and repeated requests).

The controller reserves the right to update this policy in case of changes in legislation or processing practices. The version with the date of the last update is indicated at the top of the page.