Who Processes Your Personal Data
The data controller is Лекс Консулт Родопи ООД, Unified Identification Code (UIC) Company number 200532980, VAT BG200532980, address Девин, ул. Юндола 2, operating “Хотел Елит” (the “Property”). For questions and requests, please contact elitdevin@gmail.com or 0877878703. Data Protection Officer: [TO BE COMPLETED: Data Protection Officer details or “not appointed”].
Purpose of This Page
This page explains what personal data we process when you browse the website, submit an inquiry, or request data deletion, why we process it, the legal basis for processing, how long we retain it, and your rights.
The website collects inquiries; it does not confirm reservations or accept payments. Personal data relating to your actual stay is handled separately upon check-in and is not covered by this page.
Website Inquiries
When you submit an inquiry through the website, the information you enter in the form is recorded and sent to the Property by email so that it can respond to you.
Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR).
An inquiry is not a reservation and does not create a reservation.
Website Chat Assistant
If the website includes a chat assistant, the messages you send to it are forwarded to an artificial intelligence provider to generate a response. The AI providers are OpenAI and Google (Gemini).
If you send a voice message, it is sent only to OpenAI for speech-to-text transcription.
Please do not share identity documents, payment card details, or health information in the chat.
Data Deletion Requests
When you request the deletion of personal data, we process your request in order to fulfil it and to demonstrate that it has been fulfilled.
Legal basis: compliance with a legal obligation (Article 6(1)(c) of the GDPR).
How Long We Retain Your Data
[TO BE COMPLETED: ISKA will confirm the retention periods for website inquiries, chat assistant conversations, and data deletion requests.]
Website and Cookies
The website uses only strictly necessary cookies, which are described on the “Cookies” page.
Marketing
We do not use your personal data for advertising or newsletters unless you have given your separate and explicit consent.
You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
Who We Share Your Data With
Your data is shared only with parties that need access to it:
- The ISKA platform provider (Irodopi EOOD), through which the website is maintained, acting as a data processor on behalf of the Property;
- The hosting provider, OVH, located in Poland (within the EU), where the website is hosted;
- The artificial intelligence providers, OpenAI and Google, for generating chat responses, and OpenAI only for voice message transcription; both providers are located outside the EU (see “Transfers Outside the EU”);
- The platform's outgoing email infrastructure, through which inquiries are delivered to the Property, operated using the platform's own infrastructure;
- Competent authorities (courts, public prosecutors, the Ministry of Interior, and revenue authorities), where required by law.
The website does not use advertising networks or third-party analytics providers.
Transfers Outside the EU
The website is hosted in Poland, within the EU, so its primary hosting does not involve transfers outside the EU.
Transfers outside the European Economic Area (EEA) occur only through the chat assistant: text messages are sent to OpenAI and Google, while voice messages are sent only to OpenAI. Both providers are located outside the EEA.
[TO BE COMPLETED: ISKA will confirm the legal basis and safeguards for transferring personal data outside the EEA to both providers — OpenAI and Google.]
Automated Decision-Making
We do not make decisions that affect you based solely on automated processing.
Your Rights
You have the right to:
- Request access to your personal data and obtain a copy;
- Request the rectification of inaccurate personal data;
- Request the erasure of your personal data;
- Request the restriction of processing;
- Data portability;
- Object to processing based on legitimate interests;
- Withdraw your consent where processing is based on consent.
Not all rights apply in every situation. For example, personal data that we are legally required to retain cannot be deleted before the applicable statutory retention periods expire.
How to Exercise Your Rights
You can contact us by email at elitdevin@gmail.com, by writing to Девин, ул. Юндола 2, or by calling 0877878703.
We may ask you to verify your identity.
We will respond within one month of receiving your request. For complex or numerous requests, this period may be extended, and we will inform you accordingly.
Requests are free of charge unless they are manifestly unfounded or excessive.
For deletion requests, please also refer to the “Data Deletion” page.
Complaints
If you believe your rights have been violated, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (https://www.cpdp.bg) or bring a claim before the competent court.
Children
We do not knowingly collect personal data from children through the website.
If a parent believes that a child has submitted personal data, they may request its deletion.
Security
The connection to the website is encrypted. The session cookie is transmitted only over a secure connection.
Access to personal data within the ISKA platform is restricted to individually identified users with assigned access permissions.
Changes
We may update this page.
Last updated: 2026.