Privacy & Cookies
Last updated: 02.11.2026
1. Who processes your data
The data controller is Brontes BS OOD (company registration number, EIK: 205494900, VAT number: BG205494900), operating Hotel Terra Europe Brontes, 13 Stephan Karadzha Str., 7700 Targovishte, Bulgaria. Contact for privacy matters: info@terra-europe.com, phone +359 60 166 900.
2. What data we collect
- Booking/event inquiry form: full name, email, phone, company name (optional), check-in/check-out dates, number of guests, event date.
- Account registration: full name, email, phone, password (stored encrypted), email verification token.
- Newsletter opt-in: email address, only if you explicitly ticked the checkbox — unsubscribe anytime.
- Technical data: session cookie (PHPSESSID), strictly necessary for the site to function. IP address and timestamp in server security logs.
- On check-in: ID document data for foreign guests as required by the Bulgarian Tourism Act's guest registry — a separate legal obligation of the hotel, not based on consent.
We do not use advertising, tracking or analytics cookies (Google Analytics, Facebook Pixel, etc.) — only the strictly necessary session cookie above, which does not require consent under EU law.
3. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Processing an inquiry/reservation | Pre-contractual steps taken at your request (GDPR Art. 6(1)(b)) |
| Maintaining a user account | Performance of a contract (Art. 6(1)(b)) |
| Sending the newsletter | Explicit consent (Art. 6(1)(a)) — withdrawable anytime |
| Foreign guest registration | Legal obligation under the Tourism Act (Art. 6(1)(c)) |
| Site security, abuse prevention | Legitimate interest (Art. 6(1)(f)) |
4. Retention
- Inquiries that don't turn into a booking: up to 2 years.
- Records tied to a completed booking / accounting documents: per Bulgarian accounting law (up to 10 years).
- Account data: while the account is active, plus a reasonable period after closure.
- Server security logs: typically 6–12 months.
- Foreign guest registry: per the retention periods set by the Tourism Act.
5. Who we share data with
We do not sell or rent your data. It may be accessed by our hosting provider acting as a data processor, strictly for infrastructure maintenance, and disclosed to competent authorities where legally required (e.g. police guest registry).
6. Your rights
Under the GDPR you have the right to: access your data, request correction, request erasure (where no legal retention duty applies), restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (e.g. for the newsletter) without affecting the lawfulness of prior processing.
To exercise these rights, email info@terra-europe.com. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, kzld.government.bg).
7. Security
The site is served over encrypted HTTPS. Access to the admin panel containing inquiry and account data is restricted to authorized hotel staff.
8. Cookies
We use only strictly necessary cookies: PHPSESSID (session for reservations, registration and sign-in, until you close the browser; it is only set when you sign in or submit a form) and site_lang (remembers your language for 1 year, set when you choose a language). Hotel staff who sign in to the staff panel also get ks_staff (a marker that loads the staff panel, until the browser is closed); visitors never get it. Forms are protected by Cloudflare Turnstile, which checks that you are not a bot and is loaded only to protect the forms. The map is loaded from Google Maps only after you click "Show map"; before that nothing is sent to Google. Fonts are served from this site. We use no advertising or analytics cookies, so no cookie banner is shown.
9. Changes to this policy
We will update this page and the date above whenever we make material changes to how we process data.