Privacy Policy

The data controller is Armaco Holidays EAD, the company operating Armaco Residence, registered in Bulgaria with its seat at 12 Doncho Vatah Voivoda Street, 2077 Koprivshtitsa, Bulgaria.The data controller is Armaco Holidays EAD, the company operating Armaco Residence, registered in Bulgaria with its seat at 12 Doncho Vatah Voivoda Street, 2077 Koprivshtitsa, Bulgaria.

For any question about this policy or your personal data, write to reception@armaco-residence.com or call +359 899 05 05 50. Letters can be addressed to the hotel at the address above, marked "Personal data".

Reservations (rooms, restaurant, wellbeing treatments): name, nationality, contact details, arrival and departure dates, number and names of guests, room and rate, special requests, payment and invoicing details. We need this data to conclude and perform the accommodation contract.

Guest registration: Bulgarian law (Tourism Act) obliges hotels to register every guest with identity-document data and to report it to the national tourist register. This is a legal obligation we cannot waive.

Gift vouchers: name and e-mail of the buyer and of the recipient, the personal message you add, the voucher value and its unique code, and the payment reference.

Enquiries: what you send us through the contact form, e-mail, telephone, WhatsApp or Viber, together with your name and contact details, so that we can answer you.

Website use: IP address, browser and device type, pages visited, referring page and — only where enabled — analytics and marketing identifiers set by cookies (see section 4).

Reviews: ratings and review texts you publish on Google, Booking.com or TripAdvisor are public; we display them on our website under the name you chose on those platforms.

On your first visit, our server may look up your IP address for a moment in a country database kept on the server itself, only to choose the language of the site; for this purpose the address is neither stored nor passed on. IP geolocation by DB-IP

We process your data on the following bases of Article 6 GDPR:

• performance of a contract or steps before entering into one — reservations, vouchers, wellbeing and restaurant bookings (Art. 6(1)(b));
• compliance with legal obligations — guest registration under the Tourism Act, accounting, tax and consumer law (Art. 6(1)(c));
• our legitimate interests — answering enquiries, preventing fraud and abuse, securing the website and improving our services (Art. 6(1)(f));
• your consent — marketing e-mails and non-essential cookies; you can withdraw it at any time (Art. 6(1)(a)).

Strictly necessary cookies keep the site working and need no consent: your language (NEXT_LOCALE, 1 year), your cookie choice (armaco_consent, 6 months), the remembered closing of a notice or pop-up, and the anti-spam check of our forms (Google reCAPTCHA or Cloudflare Turnstile). Our booking engine (Clock Software) and, for gift vouchers, our payment provider Stripe set the technical cookies they need to process a booking or a payment.

Analytics and marketing cookies are used only with your consent, which you give or refuse in the cookie banner. Until you agree, no Google or Meta tool is loaded.

• Analytics: Google Analytics 4 (Google Ireland Ltd; cookies _ga and _ga_…, up to 2 years) shows us in aggregate how the site is used.
• Marketing: Google Ads (_gcl_au, 90 days) and the Meta pixel (Meta Platforms Ireland Ltd; _fbp, 90 days) measure how our advertising performs and show our offers to earlier visitors on Google, Facebook and Instagram. The Google Maps map on the contact page also loads only with this consent or when you click “Show the map”; Google may then set its own cookies.

You can change or withdraw your consent at any time under “Cookie settings” at the bottom of every page; withdrawal does not affect processing carried out before it. You can also block or delete cookies in your browser; the site will keep working, but some conveniences (such as your remembered language) will be lost.

We share personal data only with service providers that act on our instructions and are bound by data-processing agreements: our hosting provider (servers located in the European Union), e-mail delivery services, our card-payment processor (Stripe — we never see or store full card numbers), booking and channel-management systems, and the analytics and captcha providers named above.

If you book through a third party such as Booking.com, Expedia or TripAdvisor, that platform is an independent controller of the data you enter there and forwards to us what we need for your stay.

Public authorities receive data where the law requires it — in particular the Ministry of Tourism's guest register and the tax administration.

Some providers (Google, Meta, Stripe) process data in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

• Reservation, invoicing and payment records: 10 years after the end of the year of your stay, as required by the Bulgarian Accountancy Act.
• Guest-register data: for the period set by the Tourism Act, then deleted.
• Gift vouchers: until the voucher has been redeemed or has expired, plus the accounting retention period above.
• Enquiries and correspondence: up to 24 months after the last contact, unless a reservation followed.
• Marketing consents: until you withdraw them.
• Website analytics: according to the retention set in the tool (Google Analytics: 14 months by default).

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to request erasure, to restrict or object to processing, to receive the data you gave us in a portable format and to withdraw any consent without affecting processing carried out before withdrawal.

To exercise a right, e-mail reception@armaco-residence.com. We answer within one month and may ask you to confirm your identity first.

You may also lodge a complaint with the Bulgarian supervisory authority: Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, kzld@cpdp.bg — or with the authority of the EU country where you live.

The website is served over encrypted connections (TLS). Access to reservation and guest data is restricted to trained staff with individual accounts and role-based permissions; systems are backed up regularly and kept up to date. Card payments are handled entirely by our payment processor on PCI-DSS-certified infrastructure.

Our services are addressed to adults. Data about children is processed only as part of a family reservation and is provided by the parent or guardian making the booking.

We update this policy when our services or the law change. The current version is always published on this page with the date of the last update. Material changes affecting an existing reservation will be communicated to you by e-mail.

Armaco Holidays EAD — Armaco Residence, 12 Doncho Vatah Voivoda Street, 2077 Koprivshtitsa, Bulgaria. E-mail: reception@armaco-residence.com. Telephone: +359 899 05 05 50 (24-hour reception).Armaco Holidays EAD — Armaco Residence, 12 Doncho Vatah Voivoda Street, 2077 Koprivshtitsa, Bulgaria. E-mail: reception@armaco-residence.com. Telephone: +359 899 05 05 50 (24-hour reception).