MAGICAL TOURS BULGARIA
Privacy Policy & GDPR Notice
magicaltoursbulgaria.com
Last Updated: April 2026 | Effective Date: April 2026
|
Your privacy matters as much to us as your adventure does. This document explains, in plain English, exactly how we collect, use, and protect your personal information – and what rights you have under EU and Bulgarian law. |
We are all keen mountaineers and nature lovers.
We take the same care with your data as we do with your safety on the mountain.
Magical Tours Bulgaria is a licensed travel operator based in Dulovo, Bulgaria, specialising in mountain, nature, and adventure tours across the Bulgarian landscape. We are a team of passionate mountaineers and nature lovers who have turned a lifelong hobby into a profession – and we guarantee the highest level of service on every trip.
|
Company Name |
Montravel EOOD, |
|
Website |
https://magicaltoursbulgaria.com |
|
Based in |
17 G.Benkovski Str. Dulovo 7650, Bulgaria |
|
Contact Email |
info@magicaltoursbulgaria.com |
|
Data Controller |
Magical Tours Bulgaria (a legal brand of the company is the data controller under GDPR) |
|
Supervisory Authority |
Commission for Personal Data Protection (CPDP) – www.cpdp.bg |
As a data controller, we are subject to the supervision of the Commission for Personal Data Protection (CPDP) of the Republic of Bulgaria – the independent authority responsible for enforcing GDPR and the Bulgarian Personal Data Protection Act (PDPA).
The General Data Protection Regulation (Regulation (EU) 2016/679 – “GDPR”) is a landmark European Union law that came into full force on 25 May 2018. It is the world’s strongest privacy legislation, applying to every organisation that collects or processes personal data belonging to individuals in the EU – including travel agencies like ours.
GDPR is built on seven core principles. We are fully committed to all of them:
Lawfulness, Fairness & Transparency – We only process your data on a valid legal basis and always tell you what we are doing and why.
Purpose Limitation – Your data is collected for specific, explicit purposes and never used incompatibly with those purposes.
Data Minimisation – We only collect the data we actually need to provide your tour and keep you safe.
Accuracy – We keep your data accurate and up to date, and act promptly on any correction requests.
Storage Limitation – We do not hold your data any longer than necessary.
Integrity & Confidentiality – We protect your data with appropriate technical and organisational security measures.
Accountability – We can demonstrate our compliance at any time.
In Bulgaria, the GDPR is complemented by the Bulgarian Personal Data Protection Act (Zakon za Zashtita na Lichnite Danni), most recently amended in December 2024. Our practices comply with both frameworks. The supervisory authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria – www.cpdp.bg.
We collect personal information only when there is a genuine, lawful reason to do so. The table below sets out what we collect, the purpose, the legal basis under GDPR, and how long we keep it:
|
Type of Data |
Purpose |
Legal Basis |
Retention |
|
Name, email, phone, nationality |
Booking & tour management |
Contract performance (Art. 6(1)(b) GDPR) |
5 years |
|
Passport / ID details (where required) |
Legal compliance for cross-border tours |
Legal obligation (Art. 6(1)(c) GDPR) |
5 years |
|
Payment information (via secure processor) |
Processing payments |
Contract performance |
As required by law |
|
Enquiry & communication records |
Customer service & correspondence |
Legitimate interest (Art. 6(1)(f) GDPR) |
3 years |
|
IP address, browser, device info |
Website security & analytics |
Legitimate interest / consent |
13 months |
|
Marketing preferences |
Sending newsletters & offers |
Consent (Art. 6(1)(a) GDPR) |
Until withdrawn |
|
Emergency contact details |
Safety during tours |
Vital interests (Art. 6(1)(d) GDPR) |
Duration of tour |
We do not collect any special categories of sensitive personal data (such as health, religious, or political information) unless you voluntarily provide it in connection with a specific tour requirement – for example, a dietary or medical need for a multi-day mountain trip. In such cases, we process it solely to keep you safe, with your explicit consent.
We collect personal data through the following channels:
Booking & Enquiry Forms – When you complete a booking or send an enquiry through our website.
Email & Direct Communications – When you contact us by email, phone, or social media.
Our Website – Automatically, via cookies and analytics tools when you visit magicaltoursbulgaria.com (see Section 6 on Cookies).
Third-Party Platforms – If you book or review us through TripAdvisor, Facebook, Instagram, or similar platforms, we may receive limited profile information in accordance with those platforms’ terms.
During Tour Delivery – When you participate in one of our tours, we may record information necessary for safety or legal compliance.
We use your information to deliver exceptional travel experiences. Specifically, we use it to:
Confirm, manage, and deliver your tour booking.
Communicate with you before, during, and after your tour.
Process payments securely through our payment partners.
Comply with Bulgarian and EU legal obligations (e.g., record-keeping, tax, insurance).
Ensure your safety during tours, including sharing essential details with guides, drivers, and emergency services when necessary.
Send you newsletters, special offers, and tour recommendations – but only if you have given us your consent to do so.
Analyse and improve our website and services through anonymised analytics.
Respond to reviews or feedback you share publicly.
|
We will never sell your personal data to third parties. We do not use your information for automated profiling or decisions that significantly affect you without human involvement. |
A cookie is a small text file placed on your device when you visit a website. Cookies help websites remember your preferences, keep you logged in, and allow site operators to understand how visitors use their site. Some cookies are essential for the site to function; others are optional and used for analytics or marketing purposes.
When you first visit magicaltoursbulgaria.com, you will see a cookie consent banner. In accordance with the EU ePrivacy Directive and the Bulgarian Electronic Communications Act, we will only place non-essential cookies on your device after you have given your informed, explicit consent. You can change your preferences at any time.
|
Cookie Type |
Name / Provider |
Purpose |
Duration |
|
Strictly Necessary |
Session (WordPress / PHPSESSID) |
Enables navigation, form submission, and security |
Session |
|
Analytics |
Google Analytics (_ga, _gid) |
Anonymised traffic analysis – helps us improve our site |
Up to 2 years |
|
Functional |
Language / currency preference |
Remembers your preferences for a personalised experience |
1 year |
|
Marketing (opt-in only) |
Facebook Pixel, Google Ads |
Shows relevant tour ads to users who have visited our site |
90 days |
You are in control. You can manage or withdraw cookie consent at any time by:
Clicking the “Cookie Settings” link in the footer of our website.
Adjusting your browser settings to block or delete cookies (note: this may affect site functionality).
Using browser privacy extensions such as Privacy Badger or uBlock Origin.
For more information about cookies and how to manage them, visit www.allaboutcookies.org.
We only share your personal data when necessary and always within a lawful framework. Your data may be shared with:
Tour Guides & Drivers – Trusted members of our team who need your booking details to deliver your tour safely.
Accommodation & Activity Partners – Hotels, guesthouses, or activity providers included in your tour itinerary. These third parties process your data as independent controllers and have their own privacy policies.
Payment Processors – Secure, PCI-DSS-compliant providers (such as Stripe or PayPal) who handle your payment details. We never store card numbers ourselves.
Email Marketing Services – If you opt in to our newsletter, we may use a provider such as Mailchimp to send communications. These providers operate under data processing agreements with us.
Analytics Providers – Google Analytics (with IP anonymisation enabled) to understand website usage.
Legal & Regulatory Authorities – Bulgarian courts, the CPDP, tax authorities, police, or emergency services where required by law.
We do not transfer your personal data outside the European Economic Area (EEA) except where: (a) the recipient country has been granted an adequacy decision by the European Commission; or (b) appropriate safeguards are in place (e.g., EU Standard Contractual Clauses). Google Analytics data may be processed in the United States – we have ensured this is covered by Google’s Data Processing Addendum and applicable transfer mechanisms.
As a data subject under GDPR, you have powerful rights over your personal information. We are fully committed to honouring them promptly and without charge:
Right to Access (Art. 15) – You can request a copy of the personal data we hold about you.
Right to Rectification (Art. 16) – You can ask us to correct any inaccurate or incomplete data.
Right to Erasure / ‘Right to be Forgotten’ (Art. 17) – You can request deletion of your data where there is no compelling reason for us to continue holding it.
Right to Restrict Processing (Art. 18) – You can ask us to limit how we use your data in certain circumstances.
Right to Data Portability (Art. 20) – You can request your data in a structured, machine-readable format to transfer to another provider.
Right to Object (Art. 21) – You can object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent – Where we process data based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
Right Not to be Subject to Automated Decision-Making (Art. 22) – We do not make solely automated decisions with significant effects on you.
|
To exercise any of these rights, simply contact us at info@magicaltoursbulgaria.com with the subject line ‘Data Subject Request’. We will respond within 30 days. If your request is complex, we may extend this by a further two months – but we will always tell you within the first 30 days. |
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) at www.cpdp.bg, or with the supervisory authority in your country of residence if you are outside Bulgaria.
We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by Bulgarian or EU law. Our general retention schedule is:
Booking & financial records: 5 years (required by Bulgarian tax law – Zakon za Schetovodstvoto).
Customer communications and enquiries: 3 years from last contact.
Marketing data (newsletter subscribers): Until you unsubscribe or withdraw consent.
Website analytics data: Up to 13 months (in line with CNIL guidance adopted across the EU).
Tour safety records: 3 years from date of tour.
When data is no longer required, it is securely deleted or anonymised in an irreversible manner, in line with Article 4 of the Bulgarian Personal Data Protection Act and GDPR Article 5(1)(e).
We take data security seriously. We have implemented the following technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse:
Secure HTTPS encryption on our website.
Password-protected and access-controlled internal systems.
Regular software updates and security patches.
Restricted staff access – only those who need your data to do their job can access it.
Third-party processors are vetted and bound by Data Processing Agreements.
Regular reviews of our data protection practices.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CPDP within 72 hours and, where required, inform you directly without undue delay – in accordance with GDPR Articles 33 and 34.
Our tours are designed for adults and families. We do not knowingly collect personal data from children under the age of 14 without the explicit, verifiable consent of a parent or legal guardian. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.
Our website may contain links to third-party websites – for example, booking platforms, national park information, or travel partners. These sites have their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices or content of external websites.
We review and update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:
Update the ‘Last Updated’ date at the top of this document.
Post a clear notice on our website homepage.
Where appropriate, notify you by email.
We encourage you to review this page periodically. Your continued use of our website and services after changes have been published constitutes your acceptance of the updated policy.
We welcome any questions, concerns, or requests regarding this Privacy Policy. Please do not hesitate to reach out – we are a small, personal team and we take every enquiry seriously.
|
|
info@magicaltoursbulgaria.com |
|
Website |
https://magicaltoursbulgaria.com/privacy-policy/ |
|
Postal Address |
Montravel EOOD, 17 G.Benkovski Str. Dulovo 7650, Bulgaria |
|
Supervisory Authority (CPDP) |
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria – www.cpdp.bg |
This Privacy Policy is governed by the laws of the Republic of Bulgaria and EU Regulation 2016/679 (GDPR).
© 2026 Magical Tours Bulgaria. All rights reserved.