Data protection

Privacy Policy

Last updated: December 2025 · In accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Data Controller

The controller of your personal data is SHOKOLINA TRAVEL EOOD, a Bulgarian limited liability company, VAT BG20811481, registered office at str. Bojour No 5A, 1434 Sofia, Bulgaria, operating the D&V Travel™ brand.

Contact: office@dvtravelbulgaria.com · +359 88 540 6555

2. What personal data we collect

To book and deliver our tours, we collect the following personal data:

  • Three names (first, middle, family)
  • Bulgarian Personal ID (ЕГН) or passport number for non-residents
  • Email address
  • Phone number
  • Travel date, tour selection and number of guests
  • Any notes you voluntarily provide (e.g. dietary or accessibility needs)
  • Payment data is processed directly by Stripe Payments Europe Ltd. We do not store full card numbers.

3. Why we collect this data and on what legal basis

  • Performance of a contract (Art. 6(1)(b) GDPR) — to process your booking, deliver the tour and provide you with the related services.
  • Compliance with a legal obligation (Art. 6(1)(c) GDPR) — to declare bookings to the Bulgarian National Tourism Registry and competent authorities under the Bulgarian Tourism Act, and to keep accounting records under the Bulgarian Accountancy Act.
  • Legitimate interest (Art. 6(1)(f) GDPR) — to respond to your enquiries and maintain the security of our systems.

4. Who we share data with

  • Stripe Payments Europe Ltd. — payment processing
  • The Ministry of Tourism / National Tourism Registry of the Republic of Bulgaria — declaration of booked tours as required by law
  • The National Revenue Agency (NRA / НАП) — accounting and tax obligations
  • Professional local guides and partner carriers strictly to the extent needed to deliver the tour you booked

We do not sell your personal data and we do not transfer it to third countries outside the EU/EEA without an adequate safeguard.

5. How long we keep your data

  • Booking and accounting records: 10 years from 1 January of the year following the booking, as required by the Bulgarian Accountancy Act.
  • Marketing consents: until you withdraw them.
  • Contact-form enquiries: up to 24 months from the last contact.

6. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Request erasure ("right to be forgotten"), subject to our legal-retention obligations (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing based on legitimate interest (Art. 21)
  • Withdraw consent at any time where processing is based on consent (Art. 7)

To exercise any of these rights, write to office@dvtravelbulgaria.com.

7. Supervisory authority

You have the right to lodge a complaint with the Commission for Personal Data Protection of the Republic of Bulgaria (КЗЛД):

2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia · +359 2 915 35 18 · kzld@cpdp.bg · www.cpdp.bg

8. Cookies

We use only strictly necessary cookies and local storage for session and language-preference purposes. We do not use third-party tracking or advertising cookies. Stripe may set cookies on its hosted checkout pages — please see the Stripe Privacy Policy.

Note

This document is prepared carefully but is not a substitute for legal advice. We recommend periodic review by a lawyer practising Bulgarian and EU data-protection law.

WhatsAppChat with us directly