This Privacy Policy describes what personal data we collect, process and store in connection with the use of the Opus Travel website and services, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and the Personal Data Protection Act of the Republic of Bulgaria.
1. Data controller
OPUS INVEST GROUP EOOD
Company ID (EIK): 208792019
Tour operator/travel agency licence РК-01-8735, issued by the Ministry of Tourism of the Republic of Bulgaria
Email for personal data enquiries: office@opustravel.eu
2. What personal data we collect
Depending on how you use the website, we process the following categories of data:
- Account data - first name, last name, email, phone, password (stored only as a hash, never in readable form)
- Booking data - travel date, number of travellers, special requests, booking history
- Traveller data - names, date of birth, nationality, identity card/passport number and expiry date (required by partner tour operators, hotels and airlines to complete the booking)
- Payment data - amount, method, transaction reference number. We do not store full bank card numbers - payments are processed by a licensed payment provider
- Technical data - IP address, browser type, cookies (see Section 8)
- Guest booking data - for bookings without an account: name, email, phone, traveller details
3. Legal basis and purposes of processing
| Data | Legal basis | Purpose |
|---|---|---|
| Account and booking data | Performance of a contract (Art. 6(1)(b) GDPR) | Creating and managing the booking |
| Traveller data (incl. passport details) | Performance of a contract / legal obligation | Providing the data to the hotel/airline for accommodation/flight |
| Email for promotions | Explicit consent (Art. 6(1)(a) GDPR) | Sending offers and news - only with separate, voluntary consent |
| Technical/cookie data | Legitimate interest / consent | Website security, statistics, personalisation |
4. Retention period
- Account data - while the account is active or until a deletion request
- Financial documents (invoices, payments) - 10 years, in accordance with the Accountancy Act of the Republic of Bulgaria, regardless of any request to delete the account
- Traveller passport details - until the trip is completed, unless longer retention is required by a partner (hotel/airline) under the local legislation of the destination
- Marketing consent data - until consent is withdrawn
5. Who we share data with
We share personal data only to the extent necessary to complete the booking, with:
- Hotel partners - for accommodation purposes
- Airlines - for issuing tickets
- Payment provider - for processing payments
- Hosting provider - for the technical operation of the website
- Google Analytics (Google LLC) - for website visit statistics, only if you have consented to "Analytics" cookies
- Public authorities - only where required by law
International data transfers: Some of our hotel and travel partners are established outside the European Union/European Economic Area. In such cases we put appropriate safeguards in place (e.g. the European Commission's standard contractual clauses) to protect your data when it is transferred outside the EU/EEA. If you have questions about a specific transfer, please contact us at the email address above.
6. Your rights
Under the GDPR, you have the right to:
- Access - to receive confirmation and a copy of the data we process about you
- Rectification - of inaccurate or incomplete data
- Erasure ("right to be forgotten") - see My account (for registered users) or here (for guest bookings)
- Restriction of processing
- Data portability - downloading your data in a structured format
- Object to processing based on legitimate interest
- Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal
- Lodge a complaint with a supervisory authority - the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg
To exercise your rights, use your account settings if you have an account, or write to us at office@opustravel.eu.
7. Data security
We apply appropriate technical and organisational measures to protect personal data - encrypted password storage, database access restricted to authorised staff only, and a secure (HTTPS) connection for data in transit.
8. Cookies
We use cookies divided into the following categories:
- Necessary - for the website to work (session, fraud protection); they do not require consent
- Analytics - to understand how the website is used; enabled only with your consent. We currently use Google Analytics 4 (Google LLC / Google Ireland Limited) - the data may be processed by Google outside the EU/EEA under Google's own safeguards for international data transfers (participation in the EU-U.S. Data Privacy Framework). More information: Google Privacy Policy.
- Marketing - for personalised adverts; enabled only with your consent
You can change your choice at any time using the "Cookie settings" link at the bottom of the website.
9. Minors
Our services are not aimed at persons under 18. We do not knowingly collect data from minors without the consent of a parent/guardian.
10. Changes to this policy
We may update this policy from time to time. In the event of significant changes we will notify you through the website or by email. The date of the last update is shown at the beginning of the document.
11. Contact
For questions about this policy or the processing of your personal data: office@opustravel.eu
This is an English translation for convenience. In case of any discrepancy, the Bulgarian version prevails.
