Information about the Data Controller:

INTER HOLIDAY SERVICE LTD is a company registered in the Commercial Register of the Registry Agency under UIC: 102899141, with its registered office at Zornitsa Residential Complex, Block 77, Entrance 1, Floor 6, Apartment 54, Burgas, Bulgaria.

Legal Grounds and Purposes for Processing Your Personal Data

We process your personal data on the following legal grounds:

• The Terms and Conditions for using our website;
• Your explicit consent – the specific purpose will be stated in each individual case;
• A legal obligation that we are required to comply with.

In the following paragraphs, you will find detailed information about how we process your personal data depending on the legal ground for processing.

For the Performance of a Contract

We process your personal data as necessary for the use of our website in accordance with our Terms and Conditions.

Purposes of processing (where applicable):

1. To verify your identity;
2. To provide the functionalities of our website.

On this basis, we only process data related to your user account.

Data collected on this ground are deleted two years after the termination of the contractual relationship, whether by expiration, cancellation, or another reason.

Based on Your Consent

We process your personal data on this ground only after obtaining your explicit, unambiguous, and voluntary consent.
Refusing to give consent will not have any negative consequences for you.

Consent is a separate legal ground for processing your personal data, and the purpose of the processing will be specified in that consent — it does not overlap with the purposes listed in this policy.

If you give us consent, until its withdrawal or the termination of any contractual relationship, we may create personalized product or service offers by performing detailed analyses of your basic personal data.

Data processed on this basis:
We may process data for direct marketing, including data about your website usage and social media profiles.

Sharing data with third parties:
We may provide your data to marketing agencies, Facebook, Google, or other similar platforms for advertising purposes.

Withdrawal of Consent

You may withdraw your consent at any time.
Withdrawal does not affect the performance of contractual obligations.

If you withdraw your consent, we will stop processing your personal data for the purposes mentioned above.
Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn.

To withdraw your consent, you simply need to use our website or contact us using the contact details provided.

Data retention period:
Data collected on this basis will be deleted upon your request or 12 months after initial collection.

How We Protect Your Personal Data

To ensure adequate protection of company and client data, we apply all organizational and technical measures required under the Personal Data Protection Act.

We have established internal rules to prevent misuse and security breaches, ensuring the protection and confidentiality of your data.

For maximum security during processing, transfer, and storage of your data, we may use encryption, pseudonymization, and other security mechanisms.

User Rights

Every user of the website has all rights under Bulgarian and EU data protection law.

You can exercise your rights by sending an email to our contact address.

Each user has the right to:

• Be informed about how their data is processed;
• Access their personal data;
• Request correction (if data is inaccurate);
• Request deletion of personal data (“right to be forgotten”);
• Request restriction of processing;
• Transfer data to another controller (“data portability”);
• Object to processing;
• Not be subject to a decision based solely on automated processing, including profiling;
• Seek protection through the courts or administrative authorities if their rights have been violated.

Right to Erasure (“Right to be Forgotten”)

You may request deletion of your personal data if:

• The data are no longer needed for the purposes for which they were collected;
• You withdraw your consent and there is no other legal ground for processing;
• You object to the processing and there are no overriding legitimate grounds;
• The data have been processed unlawfully;
• The data must be erased to comply with a legal obligation;
• The data were collected in connection with offering information society services to children and consent was given by a parent or guardian.

Right to Restrict Processing

You may request restriction of processing when:

• You contest the accuracy of the data — for a period that allows verification;
• The processing is unlawful, but you do not want the data deleted;
• The controller no longer needs the data but you require them for legal claims;
• You have objected to processing pending verification of whether our legitimate grounds override yours.

Right to Data Portability

You have the right to receive your personal data that you have provided, in a structured, commonly used, and machine-readable format, and to transmit them to another controller without hindrance, where:

• Processing is based on consent or a contractual obligation; and
• Processing is carried out by automated means.

You may also request direct transfer of data between controllers, where technically feasible.

Right to Object

You have the right to object to the processing of your personal data.
We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

If you object to processing for direct marketing, the processing will be stopped immediately.

Complaint to the Supervisory Authority

Every user has the right to lodge a complaint against unlawful processing of their personal data with the Commission for Personal Data Protection (CPDP) or the competent court.