Privacy Policy

Reviewed: 28 September 2026

Controller and scope

Travel Haven EOOD, EIK 207660897, is responsible for the website and the enquiries it receives. Contact tomov.d@yahoo.com · +359 893 520 135 for privacy matters. See the Legal Notice for the verified accommodation operator and the outstanding registered-address confirmation. No DPO appointment is asserted.

This notice covers browsing this website, contacting the hosts and information connected with a stay. Booking.com has its own notice for its platform. Travel Haven remains responsible for its own use of guest information received through that platform.

What information is used, and why

• Website delivery and security: connections necessarily disclose an IP address and technical request information to the infrastructure serving the site. Cloudflare is visible in the production delivery chain. Operating and protecting the site relies on legitimate interests in providing a reliable, secure service, subject to necessity and balancing against visitors' rights.
• Enquiries and quotes: the contact details, requested dates, apartment, guest count and message you choose to send are used to answer and prepare a requested stay: steps at your request before a contract, or performance of that contract. General non-booking correspondence is handled under the legitimate interest in answering it. Additional requests are optional. Avoid sending health information, payment-card details or identification copies in an ordinary enquiry.
• Booking and stay administration: the agreed guest details, dates, communications and payment status are used to perform the accommodation contract. The website has no direct card checkout or guest database. Payment records may arise from an agreed payment method; card numbers and CVV must not be emailed to us.
• Guest registration and accounting: where Travel Haven is legally responsible as hotelier, the information prescribed by Bulgarian tourism law is recorded and reported through ESTI. Statutory identification fields and invoicing/accounting records are processed for the applicable legal obligations, not on a compulsory consent checkbox.
• Complaints and legal claims: relevant booking records and correspondence may be needed to address a complaint, meet legal duties or establish, exercise or defend claims. Any legitimate-interest reliance must be limited to the relevant evidence.

The website does not offer a newsletter, marketing subscription, uploaded-ID form or social-media embed. No automated decision with legal or similarly significant effects is made by this site's code. Any separate offline marketing or profiling requires a separate assessment and disclosure before it starts.

Language memory is optional and based on your consent. If you tick the remember box before selecting a language, this browser stores only the language, consent time, notice version and expiry for up to 180 days. This supports return visits while planning a stay. It is not sent to an analytics service. Without this choice, language navigation works through the page URL. Use Cookie Settings to withdraw and erase the preference.

Information you need to provide

You can browse without sending an enquiry. Contact information and relevant stay details are needed to answer a quote request; without them we may be unable to respond or arrange the stay. Required guest-registration information is statutory where applicable; failure to provide it can prevent lawful check-in. Optional requests can be omitted. Information about children must be limited to what is needed for the stay, the selected rate and lawful registration. A booking should be made by an adult.

Identification and self check-in

Provide only the identification information legally required for guest registration. An ordinary email enquiry or this website is not an ID-document upload channel. Do not send passport or identity-card copies merely for convenience. If a document transmission is genuinely necessary, the host must first explain the legal need, minimum fields, secure channel, restricted access and deletion arrangements. No such upload facility is provided here.

Recipients and service providers

• Cloudflare: website delivery/security and technical request processing. The precise service, contracting entity, log configuration and processing terms require owner confirmation. The 28 September audit also detected a Cloudflare Web Analytics beacon and Network Error Logging headers; see Cookies.
• Email and telephone: messages sent to the published Yahoo email address and calls pass through the relevant communications services. Yahoo's account type, contracting entity, processing role, locations and retention settings have not been confirmed. The recipient's and sender's providers may both process a message.
• Booking.com: an external booking platform, not simply our processor. Opening its listing or submitting the date-search form sends information to Booking.com under its own platform terms and privacy notice. Before submission, the dates and adult count entered in this website's form remain in that page. Our own use of platform booking details is covered here.
• Authorities and professional recipients: the legally prescribed tourist-registration and tax/accounting information goes to competent authorities where required. Any accountant, maintenance supplier or other person granted access must be identified and assigned the appropriate controller/processor role before access is given.

Official event links are ordinary external links. They do not load an event embed before you follow them. Fonts, logos and photographs in this website are served locally.

International transfers

Cloudflare and the communications/platform providers may process data outside the EEA. The account-specific locations and safeguards have not been verified. We do not claim that every provider is covered by Standard Contractual Clauses or the EU–US Data Privacy Framework. Contact us for information about a particular transfer and a copy of applicable safeguards.

Retention

The website does not store enquiry submissions or booking records in a website database. Mailbox, host and platform copies are separate. An unanswered or declined enquiry should be removed after it is closed and any quote has expired, unless a specific complaint or legal need justifies retaining relevant parts. Confirmed-booking correspondence is separated from statutory invoice and guest-register records. Those records must follow the applicable Bulgarian accounting, tax and tourism retention rules, measured from the legally specified event. A live dispute requires a documented hold on relevant records, not indefinite retention of the whole mailbox.

Your rights

Depending on the legal conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing actually relies on consent, you can withdraw it without affecting earlier lawful processing. Contact the email above. Identity checks must be proportionate; an ID copy is not automatically required. Requests are normally answered within one month; a lawful extension must be explained within that month. Legal obligations can limit erasure.

You may complain to the Bulgarian Commission for Personal Data Protection, or another competent supervisory authority, including in your habitual residence or place of work. You do not have to contact us first. Changes to this notice do not retrospectively create consent or alter an agreed booking.