Privacy Policy

Updated 6 October 2026

This policy explains personal data handling on sunnybeachbulgaria.eu. For payment, cancellation and refund rules, see Booking Terms & Cancellations.

Who is responsible and how to contact us

Sunny Beach Travel EOOD, operating Sunny Beach Bulgaria, is responsible for the personal data it collects through this website. Contact us at info@sunnybeachbulgaria.eu or +359 887 44 84 76 for privacy questions or requests.

Information we use and why

• Enquiries and reservations: name, email, phone, travel dates, pickup or hotel details, flight information, participants and booking correspondence. We use these to answer requests, check availability and arrange the services you request, on the basis of steps before a contract and performance of that contract. Without essential booking details we may be unable to arrange the service.
• Payments and business records: booking, payment and invoice information is used to administer your booking and meet accounting or other legal obligations. Use the payment instructions supplied with your confirmation; do not send card details by email or chat.
• Accounts, reviews and rewards: account details, submitted reviews, photos and points activity are used to provide the features you choose. Approved reviews, public display names and uploaded photos can be visible to other visitors. Avoid uploading sensitive information or photos containing embedded location data you do not want to share.
• Security and website operation: technical information such as IP address, browser details and access logs supports site operation, fraud prevention and abuse investigation. Our legitimate interests are protecting the website, customers and business; these must be balanced against your rights.
• Newsletters: information supplied when you subscribe is used to send the updates you request on the basis of consent. You can unsubscribe using the message’s unsubscribe link or by contacting us. Withdrawing consent does not affect earlier lawful processing.

Provide only information needed for your enquiry. If a service requires health or accessibility information, contact us first so we can explain what is necessary and the applicable basis for processing it.

Who may receive information

Relevant booking details may be shared with the hotel, excursion provider or transfer operator needed to fulfil your request. Website hosting, email, technical support and payment providers may process data as required to provide their services. Information may also be supplied to professional advisers or authorities where necessary or legally required. Access is limited to the purpose for which information is needed.

Cookies, analytics and third-party services

The site uses cookies for features such as sign-in and the shopping basket, and includes Google Analytics, map features and links or embedded content from other services. These services may receive technical data when their content loads or when you use them. Google and Meta services have their own privacy information and settings. Opening a social-media or messaging link takes you to that provider.

Where applicable law requires consent for optional cookies or tracking, consent is required before that processing. This notice itself is not consent. Browser settings let you block or remove cookies, although essential website functions may then stop working. For questions about cookies or tracking, contact us.

Some service providers may process information outside the European Economic Area. Any transfer subject to GDPR must use an applicable legal transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for details of the providers and safeguards relevant to your information.

How long information is kept

Retention depends on the purpose: enquiries for as long as needed to resolve them; reservations and payment records for service administration, applicable accounting obligations and legal claims; account and rewards information while needed to provide those features; and security records for prevention and investigation of incidents. Reviews may remain published until removed. Data that must be retained by law may not be erased immediately. Ask us for the retention period or criteria applicable to a particular record.

Your rights

Depending on the applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, or withdraw consent. Contact us using the details above. We may need proportionate information to verify your identity before disclosing or changing personal data.

You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or your local data protection authority. You can also contact us first so that we can try to resolve the issue.

Updates

We may update this policy when services or data practices change. The date above identifies the current version.