Legal information
The data controller is KALPACITE EOOD, UIC 204422620, VAT number BG204422620, registered address: Bulgaria, Gotse Delchev 2900, 1 Hristo Silyanov St., entrance A. The company is represented by its manager Vasil Dimitrov Orakov. For privacy questions, contact us at kalpacite@gmail.com or +359 897 459 208.
KALPACITE EOOD is a single-member limited liability company registered on 24 January 2017, with main economic activity 55.10 - hotels and similar accommodation. kalpacite.com is used to present Kalpacite guest houses and receive enquiries and booking requests.
For bookings or enquiries we may process name, phone, email, stay dates, guest count, selected rooms, stay notes and booking source information. The admin system may also store operational notes, booking statuses and payment information.
We may process identification data such as first and last name; contact data such as phone and email; stay data such as arrival date, departure date, adults, children and selected rooms; technical data such as IP address, device, browser and language preference where needed for security, statistics or cookies; communication data from messages, notes and special requests; financial and operational data such as deposit, payment status, booking source, Gifto/Makaroon voucher partner and internal notes.
Processing is based on contract performance or steps before entering into a contract for bookings; legal obligations for accounting, tax and registration requirements; legitimate interest for protecting company rights, managing availability, preventing abuse and improving the service; consent for optional marketing and analytics cookies or marketing communication where requested.
We use this data to process and confirm bookings, check room availability, communicate with guests, provide the stay, process partner vouchers, administer payments and deposits, issue and retain accounting documents, manage enquiries, improve the website, measure campaigns after consent and protect our rights in disputes or misuse.
Personal data in the booking and admin system is stored with application-level encryption for sensitive fields. Names, phone numbers, emails, notes and internal notes are encrypted before database storage using AES-256-GCM and decrypted only when legitimately needed in the admin panel. Admin access is restricted through sessions with HttpOnly cookies, SameSite=Strict, automatic idle expiry and access permissions. No system can guarantee absolute security, and in case of an incident we will take the necessary actions under applicable law.
Data may be accessed by the manager and authorised staff handling bookings; accountants, legal and technical providers; hosting, email and analytics providers; partners such as Gifto or Makaroon only when the guest requests a booking using such a voucher; public authorities where required by law.
Google, Meta and Microsoft may process online identifiers and technical data outside the European Economic Area. Where such processing is used, it relies on an applicable safeguard such as an adequacy decision, standard contractual clauses, supplementary technical and organisational measures or another valid GDPR mechanism. Optional tracking technologies are enabled only after the relevant consent.
Online identifiers such as cookie IDs, device/browser data, IP address and user agent may be personal data under the GDPR even where we do not know the visitor's name. Necessary booking operations use browser session storage and the local consent record. With analytics consent, the website may use Google Analytics 4/Google Tag Manager, Microsoft Clarity if configured, first-party booking analytics with pseudonymous session/visitor identifiers, UTM parameters, booking-step events and embedded Google Maps. With marketing consent, Meta Pixel, Meta Conversions API and Google Ads conversion tracking may be used. We do not send names, phone numbers, emails, free-text notes or children's details to GA4, Meta, Clarity or Google Ads; those details are sent only to the booking backend for the booking request. Third-party providers may independently process technical identifiers under their own policies.
Analytics, marketing and embedded third-party technologies are enabled only after an active visitor choice. Rejecting optional cookies does not block access to the website or booking process. Consent can be withdrawn at any time through the Cookie settings link in the footer; after withdrawal we stop new event sending and attempt to delete known first-party tracking cookies and storage identifiers where the browser permits.
Marketing emails are sent only where there is an appropriate basis, such as consent or another permitted communication with a guest. Every marketing or follow-up email includes a clear unsubscribe button. After unsubscribing, the email address is stored in a suppression list so it is not used for future marketing messages.
We keep data for as long as needed for the booking, guest communication, statutory accounting and tax periods, defence of claims and legitimate business needs. Unconfirmed enquiry data may be kept for a shorter period, while data related to actual bookings and accounting documents may be kept for legally required periods. Afterwards, data is deleted, securely archived or anonymised where applicable.
You may request access, correction, deletion, restriction, objection, portability, withdrawal of consent for future processing and lodge a complaint with the Bulgarian data protection authority. To exercise rights, contact kalpacite@gmail.com. We may request additional information to verify identity before acting on a request.
We do not knowingly collect data from children through the website without a parent or legal guardian. Where a booking states the number of children, this is used only to organise capacity and the stay.
