Privacy Policy

1. Data Controller

This Privacy Policy explains how MIR Ltd. processes the personal data of visitors to www.bansko.apartments, customers, and guests staying in the properties we manage.

Data Controller Details:

• Company: MIR Ltd. („ЕМ АЙ АР“ ЕООД)
• Company Registration Number: 203926667
• VAT Number: BG203926667
• Registered Address: 16 Peta Street, Banya Village, Razlog Municipality, Bulgaria
• Email: info@bansko.apartments
• Phone: +359 878 433 713
• Website: www.bansko.apartments

2. Personal Data We Process

Depending on the service provided, we may process:

• First and last name;
• Telephone number and email address;
• Arrival and departure dates;
• Selected apartment and reservation details;
• Information required for guest registration;
• Payment information;
• Information voluntarily provided during communication with us.

For guest registration, we may process information from identity documents to the extent required by applicable legislation.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes:

• Receiving, confirming and managing reservations — performance of a contract or steps taken before entering into a contract;
• Communicating with guests and arranging accommodation — performance of a contract;
• Registering guests in the Bulgarian Unified Tourist Information System (ESTI) — compliance with a legal obligation;
• Issuing accounting documents and fulfilling tax obligations — compliance with legal requirements;
• Establishing, exercising or defending legal claims and resolving disputes — legitimate interests, where applicable.

Where consent is required for a particular activity, it will be requested separately.

4. Reservations Through External Platforms

Reservations may be received through Booking.com, Airbnb and other accommodation platforms.

For such reservations, we receive the information necessary to provide accommodation services, in accordance with the terms and settings of the relevant platform.

External platforms also process personal data under their own privacy policies.

5. Self Check-In and Guest Registration in ESTI

For self check-in, guests provide the personal information required for registration before arrival.

This information may be received through electronic communication, including email, Viber, WhatsApp or other communication channels.

Where a guest provides an image of an identity document, the information is used only for the necessary verification and registration, unless another applicable legal basis exists.

Images and unnecessary copies of identity documents are deleted once they are no longer required.

Information subject to mandatory registration and retention is processed in accordance with the Bulgarian Tourism Act and other applicable legal requirements.

6. Payments and Bank Cards

Payments may be made by bank transfer, secure payment link or other available payment methods.

When paying through a secure payment page, card details are entered directly into the payment service provider’s system.

We do not store complete card details entered through these payment pages.

For certain reservations made through Booking.com, authorized personnel may have access to card information through the platform’s secure system when necessary and permitted under its rules.

7. Recipients of Personal Data

Where necessary, personal data may be shared with:

• Competent public authorities, including through ESTI;
• Reservation and payment service providers;
• Hosting, email and technical support providers;
• Accounting and other professional service providers, where necessary.

Personal data is shared only to the extent necessary and in accordance with applicable legal requirements.

Some service providers may process data outside the European Economic Area. Where this constitutes an international transfer, the safeguards required under the GDPR apply.

8. Data Retention Periods

Personal data is retained only for as long as necessary for the relevant purpose or as required by law.

• Tourist registration data is processed and retained in accordance with applicable legal requirements.
• Accounting and tax records are retained for the periods prescribed by law.
• Reservation information is retained for as long as necessary to manage the reservation, fulfill legal obligations or defend legal claims.
• Images of identity documents are deleted once they are no longer necessary, unless a legal basis requires longer retention.

9. Personal Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or unlawful disclosure.

Access to personal data is restricted to persons who require it to perform their duties.

10. Your Rights

Under the GDPR, and subject to applicable legal conditions, you have the right to request:

• Access to your personal data;
• Correction of inaccurate information;
• Erasure of personal data;
• Restriction of processing;
• Data portability;
• Objection to certain processing activities;
• Withdrawal of consent where processing is based on consent.

To exercise your rights, please contact us at info@bansko.apartments.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or seek judicial protection.

11. Cookies

Our website may use strictly necessary cookies to ensure its proper functioning.

As of the date of this version, we do not use Google Analytics or Facebook Pixel.

Further information about cookies will be provided in a separate Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, technologies or applicable legislation.

The current version will be published at www.bansko.apartments.