Privacy policy

VEST Ltd. (ВЕСТ ЕООД), UIC 102835904, operator of Hotel Caesar Palace in Sunny Beach, is the controller of the personal data collected through this website.

Contact for data protection matters: reservation@caesarpalace.eu · +359 554 222 36

What we collect, and why

Data	Why we collect it	Legal basis
Name, email, telephone	To create, confirm and manage your reservation	Performance of a contract
Stay details — dates, number of guests, room type	To provide the accommodation you booked	Performance of a contract
Special requests you send us	To meet them where we can	Performance of a contract
Payment confirmation and booking reference	To process the deposit and keep accounting records	Legal obligation
Identity documents at check-in	Guest registration required of hotels in Bulgaria	Legal obligation
Aggregate website usage	To understand and improve the site	Legitimate interest

We never see or store your card details. Card data is entered on our payment provider’s own secure page and is processed by them, not by us.

Who processes your data

We use the following processors, each under a data-processing agreement:

• Stripe — payment processing
• Resend — sending booking confirmation emails
• Vercel — website hosting and delivery

Your data may also be shared with public authorities where Bulgarian law requires it, such as guest registration.

How long we keep it

Reservation and accounting records are kept for the period required by Bulgarian accounting and tax law. Enquiries that do not become bookings are deleted once they are no longer needed. Website analytics are kept in aggregate only.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• rectify data that is inaccurate or incomplete
• erase your data, where we have no overriding legal obligation to keep it
• restrict or object to our processing of it
• data portability — receive your data in a machine-readable format
• withdraw consent at any time, where processing is based on consent
• complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg)

To exercise any of these rights, write to reservation@caesarpalace.eu. We will respond within one month.

Security

Data is transmitted over encrypted connections (HTTPS) and access is limited to staff who need it to do their job. Payment data is handled entirely by our payment provider under their PCI-DSS compliance.

Changes

We may update this policy. The date at the top of this page shows when it was last revised.