PRINCIPLES FOR PROCESSING PERSONAL DATA
The policy of TEMA OOD aims to ensure compliance with the provisions of the Regulation.
TEMA OOD collects and processes personal data lawfully, fairly, and in accordance with the principles and rights of individuals regarding the processing of their personal data.

TEMA OOD processes personal data of individuals only in the following cases:
• the processing is necessary for compliance with a legal obligation of TEMA OOD;
• the processing is necessary for the performance of a contract (including an order) with TEMA OOD, to which the individual is a party, or to take steps at the request of the individual prior to entering into a contract, where their identification is required;
• the individual has given their explicit consent for a clear and transparently defined purpose by TEMA OOD, for which the processing of their personal data is necessary;
• Processing is necessary to protect the vital interests of the individual whose personal data is being processed or another individual;
• Processing is necessary for the purposes of the legitimate interests pursued by TEMA OOD or by a third party, in accordance with the provisions of the Regulation;
• Other cases provided for in the Regulation.
TEMA OOD does not collect or process personal data of individuals that exceed its legal obligations or its business needs.
In all cases where it is necessary to use collected and processed personal data of individuals for purposes other than the original ones, TEMA OOD notifies the respective individuals, seeks their consent, and proceeds with processing their personal data for other purposes only after their explicit consent.
TEMA OOD collects and processes only the minimum necessary personal data of individuals that:
• Are provided for by law;
• Are needed to fulfill a contract;
• Are needed to fulfill the purposes for which they are collected.
TEMA OOD ensures that the processing of personal data of individuals is carried out with maximum accuracy and, whenever possible, always kept up to date.
TEMA OOD ensures that access to and processing of personal data of individuals is carried out by the minimum necessary number of persons (operators) who have the required competence for their processing and the necessary commitment to their protection.

RETENTION PERIODS
TEMA OOD retains personal data for the following periods:
• Data from the register of accommodated tourists as per Article 116 of the Tourism Act, which includes identification data of the accommodated persons and data related to hotel accommodation – In accordance with the procedure and period stipulated in the Tourism Act and the subordinate regulatory framework.
• Information related to requested and used services for hotel accommodation, events, and restaurant services, including for cancelled reservations for hotel accommodation (insofar as they are related to the refund of prepaid amounts and/or retention of due amounts) – From the time of making the respective reservation/request until 5 (five) years from the provision of the service/completion of the contract/cancellation of the reservation. In cases where the services are requested and used based on a contract with continuous performance, the period starts from the final performance and/or termination of the contract.
• Financial and accounting documents; invoices; authorization forms; other information related to tax and social security control – Up to 10 (ten) years, starting from the beginning of the year following the year in which the payment obligation for the respective year is due.
• Unstructured communication, correspondence, complaints, signals, and similar – 5 years.
• Data from video recordings – up to 1 week.
• Data processed based on the explicit consent of the Data Subject – From the moment consent is given until it is withdrawn by the Data Subject.
• Until requested by the individual for deletion, when there is a basis for such a request.
The personal data specified in this Policy may be processed for a longer period than those mentioned above if necessary to achieve the objectives outlined herein or to protect the rights and/or legitimate interests (including judicial proceedings) of TEMA OOD, or if the applicable legislation requires data processing for a longer period.

In all cases, TEMA OOD ensures that at least once a year, a review of the collected and processed personal data is conducted, and those that fall under any of the above scenarios are deleted without undue delay.

RULES FOR PERSONAL DATA PROCESSING
• Personal data is processed with the necessary levels and measures of protection.
TEMA OOD ensures the necessary levels of physical, organizational, and technological protection considering:
• the nature, scope, context, and purpose of the processed personal data;
• the likelihood, impact levels, and severity of the risk to the rights and freedoms of individuals in the event of a security breach of the processed personal data.
• their financial and organizational opportunities.
TEMA OOD also ensures all necessary measures for the timely recovery of collected and processed personal data in case of loss due to accidental, malicious, or force majeure events.
• Personal data is processed with controlled and traceable access.
TEMA OOD ensures the necessary and appropriate technical, organizational, and technological measures for controlled and traceable access to the personal data of individuals.
• Personal data is processed with the necessary accountability to comply with the Regulation.
TEMA OOD ensures the necessary accountability and registers to be able to prove that the provisions of the Regulation are being followed.

DATA SUBJECTS
In connection with the services provided, TEMA OOD processes information regarding the following Data Subjects:
• individuals visiting the hotel’s website;
• individuals making reservations on their own behalf or on behalf of another individual or legal entity through the Website;
• Individuals using the services provided by TEMA OOD, including, but not limited to, hotel accommodation services, restaurant services, and related service, as well as the provision of premises for the organization of other events, and individuals representing or otherwise acting on behalf of legal entities using these services;
• The services of TEMA OOD can only be requested by capable individuals who are at least 18 years old.

RIGHTS OF INDIVIDUALS WHOSE DATA IS PROCESSED
TEMA OOD ensures the observance of the rights of individuals whose personal data is collected and processed, which includes:
• The right to be informed about the processing of personal data;
• The right to access personal data – what data is held;
• The right to correct inaccurate personal data;
• The right to delete personal data – the right to be ‘forgotten’;
• The right to restrict the processing of personal data;
• The right to be informed about actions taken as a result of a request for correction, deletion, or restriction of the processing of personal data;
• right to data portability;
• right to object to the processing of personal data;
• right not to be subject to automated decision-making, including profiling.

PROCESSED PERSONAL DATA
Processed Personal Data as an Administrator:
• of employees;
• of individual clients;
• of individual suppliers;

PURPOSES FOR PROCESSING PERSONAL DATA
TEMA OOD, as the Administrator, performs the following operations and processes only the necessary personal data for the following purposes:
• for the conclusion, execution, and termination of employment contracts and the calculation of salaries and compensations for employees;
• acceptance, administration, and processing of reservations and their cancellation;
• administration, execution, and delivery of purchases made through the Website;
• administration and receipt of payments for the provided services, including remotely;
• for providing services to clients;
• ensuring an individualized approach in service provision, tailored to the preferences stated by the users;
• for the conclusion and execution of contracts with individual suppliers;
• for direct marketing for sales purposes;

RECIPIENTS AND CATEGORIES OF RECIPIENTS
In connection with the fulfillment of the purposes mentioned above, TEMA OOD provides personal data of individuals to the following recipients:
• National Revenue Agency (NRA) in relation to the calculation of the staff salaries;
• National Social Security Institute (NSSI) in relation to the calculation of the staff benefits;
• Occupational Health Service company in relation to the obligation to maintain an up-to-date health status of the staff and to conduct periodic medical examinations;
• General Labour Inspectorate, NSSI, and Ministry of Interior (MoI) – in relation to occupational accidents;
• Ministry of Interior (MoI) – in relation to the transmission of information about the hotel guests;
• Other state and municipal authorities and/or institutions – in relation to legal obligations towards them or in relation to legal requests from them for information containing personal data;
• Subcontractors for the fulfillment of contractual obligations.

VIDEO SURVEILLANCE AND SECURITY
In accordance with applicable legislation, TEMA OOD implements security measures that include the following technical and organizational means for access control and ensuring physical security against intrusions into buildings and facilities, as well as for the protection of the life and health of citizens: a video control system that performs 24-hour video surveillance and consists of recording and storage devices.
Video surveillance and recording may be conducted in publicly accessible areas and premises within the buildings of TEMA OOD, as well as in areas with a special access regime. No video surveillance is conducted in guest rooms, sanitary facilities, relaxation areas, and similar spaces. Data from video surveillance activities is stored for a period of seven days.
Through information boards placed in visible locations, data subjects and other visitors who may be recorded are informed about the use of technical means for monitoring and control, as well as any other relevant information related to the surveillance being conducted.

CONTACT INFORMATION
If you have any questions or uncertainties regarding the processing of your personal data or wish to exercise any of your rights, you can contact us at:
• Email: reservation@armirahotel.com
• Telephone: 0899 17 16 17
• Address: village of Starozagorski Bani, Armira SPA Hotel

COMPETENT SUPERVISORY AUTHORITY
In the territory of the Republic of Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection.
If you suspect that your rights related to the protection of your personal data have been violated, you can file a complaint at:
• Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
• Email: kzld@cpdp.bg
• Telephone: 02 / 91-53-518