Privacy Policy
Last updated: 8 January 2026
1. Introduction
This Privacy Policy explains how the Operator ("we", "us", or "our") collects, uses, and protects personal data in accordance with the General Data Protection Regulation (GDPR).
This Privacy Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable Bulgarian data protection law.
"Operator", "we", "us", or "our" refers to the natural person or legal entity that operates the website and provides the accommodation rental services.
2. Data Controller
The data controller within the meaning of Article 4(7) of the GDPR is:
ELCONSULT ATANASOV EOOD (legal entity)
Email: hello@luxeambra.com
Country of residence: Bulgaria
3. Personal Data We Collect
We collect the following personal data during the booking process:
- Name
- Email address
- Phone number
- Personal identification number or document
- Stripe charge ID (payment reference only)
Identification data is collected only where required by applicable tourism, tax, or identity-verification laws and is processed strictly for compliance purposes.
We do not store full payment card details.
4. Purpose and Legal Basis of Processing
| Purpose | Legal basis |
|---|---|
| Managing bookings and rentals | Performance of a contract (Article 6(1)(b)) |
| Processing payments | Performance of a contract (Article 6(1)(b)) |
| Legal and regulatory compliance | Legal obligation (Article 6(1)(c)) |
| Fraud prevention and security | Legitimate interest (Article 6(1)(f)) |
| Customer communication | Legitimate interest (Article 6(1)(f)) |
5. Data Retention
We retain personal data only for as long as necessary:
- Booking and contact data: retained for as long as needed to manage the booking and ongoing communications, and then for up to 12 months after the last activity to handle questions, disputes, or legal claims, unless a longer period is required by law.
- Identification data (documents or numbers, where required by law) and payment references are retained as required by tax, accounting, and legal obligations.
Retention periods are determined based on the purpose of processing, statutory obligations, and limitation periods for legal claims.
Data is retained within the European Economic Area in observance of national and European legislation, in particular the GDPR.
Data is securely deleted or anonymized once no longer required.
6. Data Sharing
We may share personal data with:
- Stripe (payment processing)
- Legal, tax, or regulatory authorities where required by law
- Service providers assisting in hosting or technical operation (under data processing agreements)
Service providers act as data processors on our behalf and process personal data only under our instructions and applicable data protection agreements.
We do not sell personal data.
7. International Transfers
If personal data is transferred outside the European Economic Area (EEA), appropriate safeguards are applied, such as Standard Contractual Clauses approved by the European Commission.
8. Your Rights Under GDPR
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict or object to processing
- Data portability
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with a supervisory authority
Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Requests can be made by contacting us at the email above.
You also have the right to lodge a complaint with a supervisory authority.
9. Security Measures
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse.
10. Personal Data Breaches
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Article 34 GDPR.
11. Cookies
We use a single essential cookie to remember your selected property (`current-property-id`). It is required for the site to function and is not used for analytics or marketing.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes materially affect how personal data is processed, we will take appropriate steps to inform users. The latest version will always be available on the website.
13. Contact
For privacy-related inquiries:
Email: hello@luxeambra.com