BONONIA ESTATE WINERY & RESORT
Politics of
privacy
Clear information about how we use your personal data and how you can exercise your rights.
On this page
01About this policy
Here we explain how your personal data is processed when using the BONONIA ESTATE WINERY & RESORT website: browsing content, purchases from the online store, customer profile, inquiries, reservations, business partnerships, and participation in advertised campaigns.
The policy applies to the personal data of visitors, customers, and representatives of business partners. For on-site accommodation, video surveillance, job applications, or other separate activities, additional information may be provided during data collection. External websites and booking platforms also have their own privacy policies.
02Who is responsible for your data
Online store and wine partnerships — „BONONIA ESTATE“ Ltd.
VAT number: 201666651.
Published address of management: Sofia 1000, Vrazhdenye district, Zone B-5-3, Middle Gora Street No. 27B.
Contact: sales@bononiaestate.com.
Hotel reservations and accommodation — „BONONIA RESORT“ Ltd.
ID No.: 206934167.
Published address: Sofia, Alexander Stamboliiski Blvd., no. 84, 11th floor.
Contact: hotel@bononiaestate.com.
For questions regarding your personal data, please use the contact information of the company with which the purchase, reservation, or inquiry is related, and indicate „Personal Data“ in the subject line. Do not send passwords, full card details, or copies of identity documents on your own initiative.
03What data we receive
Contact and inquiries. Name, email address, phone number, and the content of the message. In the case of a business inquiry — company, country, type of business, and provided business contact information. For events — the requested date, number of guests, and preferences, to the extent necessary for the offer.
Orders and profile. Names, shipping address, postal code, phone number, email, ordered products, quantities, amounts, chosen payment method, payment and delivery status, order history, and invoice data. Company data is personal data when it identifies an individual.
Reservations. Contact information of the booking holder, period of stay, number of adults and children, necessary information for the selected service and payment. Registration details upon check-in are collected separately in accordance with applicable legal requirements.
Technical data. IP address, device and browser data, access time, security logs, session identifiers, and data from authorized cookies. The specific technologies are described in the cookie section.
We receive the data primarily from you. When booking or delivering on behalf of another person, we may obtain the necessary data from them; from payment providers and couriers—payment confirmations and delivery details. If you provide foreign data, inform the relevant person about this policy and provide only the necessary information.
04Why we use the data
Purchase, delivery, booking and service — contract or steps requested by you before the contract (Art. 6, §1, item „b“ GDPR). We process the necessary data to prepare an offer, accept a request, arrange delivery or accommodation, and send service confirmations.
Accounting and regulatory requirements — a legal obligation (Art. 6, §1, item „v“). This includes mandatory invoices and reporting, the storage of required documents, and the response to lawful requests from competent authorities.
Security, protection of rights and business-to-business communication — legitimate interest (Art. 6, §1, item „e“). The interests are the protection of the site and client profiles from abuse, the handling of claims and communication with representatives of companies regarding specific business relationships. We assess the necessity and balance with your rights. You may object for reasons related to your specific situation.
Voluntary subscription and non-binding technologies — consent (Art. 6, §1, item a), when required. The refusal of advertising or analytical cookies is not a condition for making a purchase or sending a request.
The fields that we cannot process the specific request without are marked as mandatory. If you do not provide them, we may not be able to fulfill the service. The remaining fields are optional. Reading the policy does not constitute general consent for all purposes.
05Payments and delivery
With the selected Stripe method, including Apple Pay, the payment is processed through the respective payment service. To process the order, we use the necessary transaction data, such as the identifier, amount, status, and selected method. Do not submit card details through our contact forms.
When shipping via Speedy, the necessary recipient details, contact information, address or selected office, and cash on delivery, where applicable, are provided. For hotel reservations, the payment provider may be different from the one in the online store and is specified in the booking process.
Payment providers, banks and couriers may also process data as independent controllers for their legal obligations, security and fraud prevention purposes.
06With whom do we share information
Access is provided only to the extent necessary for the respective activity: authorized employees; providers of hosting, technical support, business mail and reservation services; payment providers and couriers; accountants, auditors and legal advisors; public authorities when legally authorized.
The providers that process data on our behalf operate under a contract and confidentiality and protection instructions. When the recipient is an independent administrator, their policy also applies.
07Processing outside the EEA
The use of international services may involve processing or access to data outside the European Economic Area. In such transfers, an applicable European Commission decision on an adequate level of protection or appropriate safeguards is required, for example standard contractual clauses and additional measures when necessary.
You can request information about the applicable warranties and how to obtain a copy of them through the contact details in this policy.
08How long we store the data
The duration depends on the purpose, type of document and applicable obligations. We do not store all data for a common period of time.
Orders, reservations and accounting documents: for the performance of the service and then for the applicable legal deadlines for the relevant documents. In the event of a claim, the relevant records may be retained until their final conclusion and the expiration of the applicable rights protection deadlines.
Inquiries without a subsequent contract: until the communication is completed and for a reasonable subsequent period for follow-up or protection regarding the specific inquiry. Client profile: While in use, with the separate application of the deadlines for orders and mandatory documents. The deletion of an account does not erase documents that the law requires to be kept.
Marketing: until the consent is withdrawn or the respective purpose is terminated. Minimal information about the opt-out can be kept so that you do not receive new unwanted messages. Technical records and backup copies: according to the required security period and the established deletion cycle. Cookies: according to the specified term for each technology.
09Cookies and Your Choice
Cookies and similar technologies can maintain the session, the shopping cart, security, and preferences. Strictly necessary technologies are used for the service you request. Non-essential analytical and advertising technologies require your prior consent when the law requires consent.
Consent must be withdrawn as easily as it was given. Limiting cookies from the browser is also possible, but it may disrupt the functionality of the shopping cart or the login to the account. Embedded maps, videos, and social services may use their own technologies and should be managed according to their respective categories.
10Announcements, campaigns and games
Requests for inquiry, order, payment, delivery or reservation are service messages. Receiving them does not mean an automatic subscription to advertising newsletters. If you opt for a voluntary subscription, you can unsubscribe through the link in the message or by writing to us.
Separate rules with the organizer, participation conditions and information about the prizes are provided for each game. Participant and winner data should be used only in the necessary volume for the game’s conduct, contact and delivery of the prize. The public announcement of the winner is described in advance with a specific volume of data, basis and deadline of publication.
11Your rights
Under the terms of the GDPR, you can request: access to your personal data and a copy; rectification of inaccurate data; deletion when the grounds exist; restriction of processing; portability of data you have provided when processing is automated and based on consent or contract.
You can object to processing on the basis of legitimate interest for reasons related to your specific situation. With regard to direct marketing, you can object at any time, including to related profiling. You can withdraw your consent at any time; this does not affect the legality of the processing before the withdrawal.
Send the request to the relevant contact listed above. In case of reasonable doubt regarding the identity, we may request additional, proportionate information. As a rule, we respond within one month of receiving the request. In cases of complexity or a large number of requests, the period may be extended by another two months, and we will notify you within the first month and explain the reason.
Rights are not absolute: for example, a legal obligation to store data may limit deletion. In the event of a refusal, we will explain the reasons and the possibilities of defense.
12Complaints and defense
You can file a complaint with The Commission for the Protection of Personal Data (KZDL) or to another competent supervisory authority in the EU, including in the country of your habitual residence or work. It is not mandatory to contact us first. You also have the right to legal protection.
The current addresses and requirements for filing a complaint are published on the KZDL website: cpdp.bg. Follow the order for electronic submission specified there.
13Security and updates
We implement appropriate organizational and technical measures based on the risk, including access control and system protection. No method of electronic transmission or storage guarantees absolute security. Please keep your account access data safe and notify us if you suspect abuse.
Do not submit health or other sensitive information in the free fields unless it is explicitly required and you have received information about how it will be processed. For children included in a hotel reservation, only the data necessary for the service should be provided. Online sales of alcohol are not intended for minors.
When changes occur to the services or processing, we update the policy and indicate the date of the last revision. When necessary, we provide additional notice or request new consent.
Questions about your personal data?
For hotel reservations: hotel@bononiaestate.com
