Privacy Policy

1. Introduction

Accent Properties Ltd, operating under the brand Detelina Villas (hereinafter "we", "us", "the Company"), is committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have under applicable law — in particular Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the ePrivacy Directive (2002/58/EC), and the Bulgarian Personal Data Protection Act (ZZLD).

This Policy applies to all personal data collected through our website detelinavillas.com, by email, or in connection with your booking and stay at any property owned and operated by Accent Properties Ltd.

2. Who is the Data Controller?

The data controller responsible for your personal data is:

• Company: Accent Properties Ltd
• Address: ul. 717 3, 1619 Sofia, Bulgaria
• VAT number: 175057315
• Email: contact@detelinavillas.com
• Phone: +359 877 720 570

As a small business, we do not have a dedicated Data Protection Officer (DPO). For all data protection enquiries, please contact us directly at the email address above.

3. What Personal Data We Collect

When you make a booking enquiry, send us a message, or complete the registration process, we may collect:

• Full name (first name and family name)
• Email address
• Phone number
• Date of birth (required for tourist tax registration)
• Identification document number (passport or national ID card, required for tourist tax registration)
• Check-in and check-out dates
• Number of guests
• Any messages or special requests you send us

By providing your personal data, you confirm that the information you submit is accurate and up to date. It is your responsibility to notify us of any changes to your personal information.

When you visit our website, we automatically collect certain technical data through cookies and similar technologies. This data is collected via Google Analytics, Jetpack Stats and CookieYes (see Section 6 — Cookies for full details).

• IP address
• Browser type and version
• Pages visited and time spent on the site
• Referring website
• Device type and operating system

4. Why We Collect Your Data — Legal Bases

Under GDPR, we must have a legal basis for processing your personal data. We rely on the following:

We process your name, contact details, and booking information in order to manage your reservation, communicate with you about your stay, and provide the services you have requested.

We are required by Bulgarian tourism legislation to collect your name, date of birth and identification document number for registration in the local tourist tax register. We have no discretion in this matter — it is a legal requirement.

We use Google Analytics to understand how visitors use our website and improve our services. We have assessed that this processing does not override your interests or rights, particularly given that we use anonymised data and you may opt out at any time.

For non-essential cookies (such as analytics cookies), we rely on your consent, which you provide through our cookie consent banner. You may withdraw your consent at any time by adjusting your cookie preferences.

5. How Long We Keep Your Data

• Booking and guest data: retained for 5 years from the date of your stay, in accordance with Bulgarian accounting and tax legislation.
• Tourist tax registration data: retained for as long as required by Bulgarian tourism legislation (currently 2 years).
• Email correspondence: retained for up to 3 years from the date of the last communication.
• Website analytics data (Google Analytics): retained for 26 months, in accordance with Google's standard data retention settings.
• Cookie consent records: retained for 1 year from the date of consent.

After the applicable retention period, your data will be securely deleted or anonymised.

6. Cookies

Cookies are small text files stored on your device when you visit our website. They allow the site to remember your actions and preferences so that you do not have to re-enter them each time you visit or move between pages.

These cookies are required for the website to function and cannot be switched off. They include:

• CookieYes consent cookie — stores your cookie preferences. Duration: 1 year.

These cookies are only set with your consent. They help us understand how visitors interact with our website:

• Google Analytics (_ga, _ga_XXXXXX) — tracks page views, session duration, traffic sources and user behaviour in anonymised form. Duration: up to 2 years.

You can manage your cookie preferences at any time by clicking the cookie settings button on our website. You may also opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

Most browsers allow you to control cookies through their settings. Please note that restricting or disabling cookies may affect the functionality and performance of our website.

• Google Chrome — support.google.com/chrome/answer/95647
• Mozilla Firefox — support.mozilla.org
• Safari — support.apple.com/guide/safari
• Microsoft Edge — support.microsoft.com
• iOS (iPhone/iPad) — support.apple.com/en-us/HT201265

More general information about cookies can be found at www.aboutcookies.org.

7. Who We Share Your Data With

We do not sell, rent or trade your personal data. We share your data only in the following limited circumstances:

• Bulgarian authorities — we are legally required to share guest identification data with the local municipality for tourist tax registration purposes.
• Google LLC — as our analytics provider. Google processes data in accordance with its Privacy Policy and the EU-US Data Privacy Framework. For more information, see policies.google.com/privacy.
• Formspree Inc. — our contact form provider, used to receive your booking enquiries by email. Data is processed in accordance with Formspree's Privacy Policy.
• CookieYes — our cookie consent management provider. For more information, see cookieyes.com/privacy-policy.

All third-party providers we use are bound by data processing agreements and are required to process your data only as instructed by us.

8. International Data Transfers

Some of our third-party providers (including Google and Formspree) are based outside the European Economic Area (EEA). Where your data is transferred outside the EEA, we ensure that adequate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Participation in the EU-US Data Privacy Framework (in the case of Google LLC)

9. Your Rights Under GDPR

Under the GDPR and Bulgarian data protection law, you have the following rights:

• Right of access (Article 15) — you may request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — you may request that we correct any inaccurate or incomplete data.
• Right to erasure (Article 17) — you may request that we delete your data, subject to our legal retention obligations.
• Right to restriction of processing (Article 18) — you may request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Article 20) — you may request that we provide your data in a structured, commonly used format.
• Right to object (Article 21) — you may object to processing based on legitimate interests, including profiling.
• Right to withdraw consent (Article 7(3)) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Article 22) — we do not carry out any automated decision-making or profiling.

To exercise any of these rights, please contact us at contact@detelinavillas.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

• Website: cpdp.bg
• Address: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria
• Email: kzld@cpdp.bg

10. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration, including:

• Secure email communication
• Limited access to personal data on a need-to-know basis
• Use of reputable third-party services with their own security measures

Please note that no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this Policy periodically. Where changes are significant, we will take reasonable steps to notify you.