1. Who processes your data
Victoria — host of Nagomi Sozopol, Sozopol, Bulgaria.
The apartment is run by a private individual renting out her own property. Victoria is the data controller under the General Data Protection Regulation (GDPR).
For anything related to your data: +359 895 017 080 — phone, Viber or WhatsApp.
2. What we collect and why
Nothing is collected "just in case" — only what we need to reply to you or to check you in.
| When | What data | Why | Legal basis |
|---|---|---|---|
| You fill in the enquiry form | Name, phone, email, requested dates, number of guests, your message | To reply, check availability and make the booking | Steps at your request prior to a contract — Art. 6(1)(b) GDPR |
| You call or message (phone, Viber, WhatsApp) | Your phone number and the content of the conversation/messages | To handle the booking conversation | Art. 6(1)(b) GDPR |
| You check in | Name, date of birth, nationality, ID document type and number | Guest register and reporting to ESTI, the Bulgarian national tourism information system | Legal obligation under the Bulgarian Tourism Act — Art. 6(1)(c) GDPR |
| Payment / stay documentation | Name and payment details | Accounting and tax obligations | Legal obligation — Art. 6(1)(c) GDPR |
We do not collect health, religious or other "special category" data. We do not buy or sell contact databases.
3. Cookies and tracking
This site has no advertising cookies and no visitor analytics (no Google Analytics, no Facebook pixel, no remarketing). That is why there is no cookie pop-up.
Two things are loaded from external servers, and they do see your IP address and browser details:
- Google Fonts — the site's typefaces are served from Google's servers.
- Google Maps — the embedded map in the location section. Google may set its own cookies if you are signed in to a Google account.
4. Who else sees your data
Only those we can't do without. The full list:
- Web3Forms — the service that delivers the submitted enquiry to the host's inbox.
- The email and hosting providers of this site — where the messages and site files are technically stored.
- Google (Fonts, Maps) — as described in section 3.
- Meta (WhatsApp) and Rakuten Viber — if you choose to message through those apps, their own privacy policies also apply.
- Booking.com — only if you booked through their platform, not for direct bookings.
- ESTI and the competent authorities (Ministry of Interior, tax authority, municipality) — where the law requires it.
Some of these providers are based outside the EU (mainly the USA). Transfers rely on a European Commission adequacy decision or on standard contractual clauses.
5. How long we keep it
- An enquiry that did not become a booking — up to 12 months, then deleted.
- A completed stay — booking and payment records are kept for 5 years, as tax rules require.
- Guest register — for the period set out in the Bulgarian Tourism Act.
- Chat correspondence (Viber/WhatsApp/SMS) — up to 12 months after the stay.
6. Your rights
Under the GDPR you may request:
- Access — what data we hold about you.
- Rectification — if something is wrong.
- Erasure — except where the law requires us to keep it (e.g. the guest register).
- Restriction of processing and objection to it.
- Portability — receiving your data in a machine-readable format.
Call or message +359 895 017 080 and we reply within one month. There is no fee, and you don't owe us a reason for asking.
If you believe your data is handled unlawfully, you have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, +359 2 915 3 518, cpdp.bg. You may also complain to the supervisory authority in your own EU country.
7. Security
Enquiries travel over an encrypted connection (HTTPS). Only the host has access to them. The devices and accounts used to read the correspondence are password protected.
No one is 100% invulnerable — if a breach occurs that puts your rights at risk, you will be notified and the CPDP informed within 72 hours.
8. Children
This site is not directed at children under 16 and we do not knowingly collect their data. Bookings are made by adults.
9. Changes to this policy
If something material changes — a new provider, a new purpose — we update the text and the date at the top. The version on this page is always the one in force.
Back to booking