1. Data Controller
KaVi Holidays EOOD is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR). For questions regarding the processing of your personal data, please contact us at:
2. What Personal Data We Collect
- Contact details: name, phone number, email address
- Booking data: destination, travel dates, number of travellers, preferences
- Technical data: IP address, browser type, pages visited (anonymised for analytics only)
3. Purposes of Processing
- Processing and managing bookings for travel packages
- Communicating with you about your enquiry or booking
- Fulfilling contractual obligations
- Sending offers and promotions (with your explicit consent only)
- Compliance with legal obligations
4. Legal Basis for Processing
- Contract: for processing bookings and providing travel services
- Legal obligation: for accounting and tax record-keeping
- Consent: for sending marketing communications
5. Retention Periods
- Booking data — 5 years (accounting and tax purposes)
- Contact data (without booking) — 12 months from last contact
- Marketing data — until consent is withdrawn
6. Sharing Data with Third Parties
We share data only with:
- Tour operators and hotels — solely in the context of a confirmed booking
- Accounting and legal services — when required by law
We do not sell personal data to third parties.
7. Your Rights (GDPR)
- Right of access — to receive a copy of the data we hold about you
- Right to rectification — to request correction of inaccurate data
- Right to erasure — to request deletion of your data (“right to be forgotten”)
- Right to restriction — to limit the processing of your data
- Right to data portability — to receive your data in a machine-readable format
- Right to object — to processing for marketing purposes
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
To exercise your rights, email us at kaviholidays@gmail.com. We will respond within 30 days.
8. Right to Lodge a Complaint
You have the right to lodge a complaint with the Commission for Personal Data Protection (Bulgaria): www.cpdp.bg
9. Cookies
This website uses only technically necessary cookies for the operation of the site. We do not use tracking or advertising cookies without your consent.
10. Changes to This Policy
For significant changes to this policy, we will notify you by email or with a prominent notice on the site. We recommend checking this page periodically.
