Privacy policy
Last updated: 15.08.2026
1. Who processes your data
The data controller is TENANCYPROOF LTD, a company registered in the United Kingdom under Companies House number 17109704, which operates bulgariarest.com.
For any question about this policy or your rights, write to info@bulgariarest.com.
2. What we collect and why
| What | When | Why (legal basis) | Retention |
|---|---|---|---|
| Email, country, number of guests, budget, preferred dates | Joining the Eurovision 2027 guest waitlist | Consent (Art. 6(1)(a) GDPR), confirmed by double opt-in | Until consent is withdrawn, and no later than 31 Dec 2027 |
| Name, email, phone, town, address, property details, price, free dates, photos | Host form / adding a listing | Performance of a contract and steps taken at your request (Art. 6(1)(b)) | While the listing is active + 12 months |
| Email, name, user account | Claiming an existing listing | Performance of a contract and our legitimate interest in verifying the listing is yours (Art. 6(1)(b) and (f)) | While the account exists + 12 months |
| Name, email, phone, message | Sending an enquiry to a host | Legitimate interest in delivering your enquiry (Art. 6(1)(f)) | 24 months |
| Payment data | Paid subscription or one-off package | Performance of a contract and statutory accounting obligations (Art. 6(1)(b) and (c)) | As required by applicable accounting law |
| IP address and timestamp of consent | When consent is given | Demonstrating consent (Art. 7(1) GDPR) | Together with the related record |
We do not collect special categories of personal data, and we do not carry out automated decision-making or profiling with legal effects for you.
3. Processors
We use the following providers, which process data on our behalf:
- Brevo (Sendinblue SAS, France) — sending email and managing recipient lists.
- Stripe (Stripe Payments Europe Ltd, Ireland) — payment processing. Card details are entered directly with Stripe; we never see or store them.
- Google Analytics (Google Ireland Ltd) — aggregate traffic statistics.
- The hosting provider running this site.
Where a provider processes data outside the European Economic Area, it does so under the European Commission's standard contractual clauses.
4. Your rights
Under the GDPR you have the right to access your data; to rectification; to erasure ("the right to be forgotten"); to restriction of processing; to data portability; to object to processing based on legitimate interests; and to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Every marketing email we send carries an unsubscribe link. You can also exercise any of these rights by writing to info@bulgariarest.com — we reply within one month.
If you believe we process your data unlawfully, you may lodge a complaint with a supervisory authority — in Bulgaria the Commission for Personal Data Protection (cpdp.bg), in the United Kingdom the Information Commissioner's Office (ico.org.uk).
5. Cookies
We use strictly necessary cookies for your session and language preference, plus Google Analytics cookies for aggregate statistics. You can block them in your browser settings; the site remains usable.
6. Changes
If this policy changes we update the date at the top. Material changes affecting data processed on the basis of your consent will be announced to you by email.