Functional cookies
These cookies allow us to provide you with a more personalized service (for example saving your last offer search) and thus make the most optimal use of our site’s functions. They do not store your personal information.

Cookies for precision targeting
These are dynamic cookies of Facebook, Google, etc. We do not use such cookies, but if you click on advertising messages on the site, they may be triggered by our advertising partners. They also do not store any personal information.

It is within your power to set the cookies you receive from our site. To do this, enter the settings of the browser you are using and follow the instructions. Note that if you restrict certain types of cookies, you may also restrict the functionality of the site on your own device.

Special categories of data we process:
EGN (Uniform Civil Number) – in cases where this is necessary to fulfill our contractual relationship, or if we are required by law.

Sensitive data: data about your state of health (when taking out medical insurance and/or when an insurance event occurs during travel, as well as a sick leave if you are our employee)

Family ties (where necessary for the purposes of the contract – for example a minor under your care or taking advantage of a honeymoon promotion)

Data source:
Data subject (ie you)

Public register available to the public – TR, IR, National Tourist Register under the Ministry of Tourism

Travel agents who are data processors for the purposes of the services we provide you

Tour operators – partners

Traders who are data processors – (company travel requests)

Purposes and principles of use of the personal data we collect:
Processing of your data is for the purpose of fulfilling (and/or concluding) a contract for the provision of a tourist service – an organized trip, a separate element of it, or a related service. (identity card/passport are required for hotel check-in, telephone number for contacting you and/or the person specified by you in the event of an insurance event, e-mail – for sending boarding pass and plane ticket) basis Art. 6, para. 1 of the Regulations, namely:

Fulfillment of the obligations of “ORANGE TOUR” OOD under the contract with you; (including: to protect the rights and legal interests of you and/or the persons you represent, so that we can protect your vitally important interests (in the event of an insured event and you are currently unable to react).

Compliance with a legal obligation that applies to “ORANGE TOUR” OOD (please see selective information about this in the section on the grounds that give us the right to process your data).

For the purposes of the legal (legitimate) interest of “ORANGE TOUR” OOD. Express consent received from you as a customer;

“ORANGE TOUR” OOD accepts and stores only the data that is necessary and relevant to the service provided.

“ORANGE TOUR” OOD does not accept or process personal data “by default”, even when received from another administrator after a request for their transfer, and does not store all received data.

If the received data contains data from third parties, “ORANGE TOUR” OOD stores it under the control of the requesting entity. These data are managed only for his needs, but not for other purposes of “ORANGE TOUR” OOD. ORANGE TOUR” OOD accepts and stores only the data that is necessary and relevant to the service provided.

“ORANGE TOUR” OOD does not accept or process personal data “by default”, even when received from another administrator after a request for their transfer, and does not store all received data.

If the received data contains data from third parties, “ORANGE TOUR” OOD stores it under the control of the requesting entity. This data is managed only for his needs, but not for other purposes of “ORANGE TOUR” OOD.

If you are our employee:
In addition to the above purposes (as far as the execution of contracts with customers is carried out through you), also for the protection of your rights and our legitimate interests, as well as for the protection of your rights and legitimate interests, for the purposes of labor, tax and social security legislation (KT , CSR, DOPK) and for the purposes of contractual relationships in fulfillment of your job description. The processing of data on your health condition is necessary for the purposes of preventive or occupational medicine, as well as according to the Medical Examination and CSR Act (for sick leave compensation, maternity insurance, etc.)

The grounds that give us the right to process your data are:
The processing is necessary to comply with our legal obligation:

The law obliges us to process your data for the purposes of your tourist trip and/or issuing a tourist voucher, and/or reservation form, and/or for hotel accommodation, issuing plane tickets and/or related services: Tourism Law, CONVENTION ON INTERNATIONAL CIVIL AVIATION, Civil Aviation Law, Law of Obligations and Contracts, TOR, Statute and Regulations of the International Air Transport Association (IATA), International Convention for the Carriage of Passengers and Baggage by Rail (CIV), International Convention on Railways transports (COTIF), Regulation (EU) No. 1177/2010, Regulation (EC) No. 261/2004, Regulation (EC) No. 2006/2004, etc.

According to the Insurance Code, to take out medical insurance in connection with your trip and/or to announce an event to the insurer

According to the Code of Civil Procedure and VAT for the purposes of taxation (when issuing invoices)

According to the Civil Registration Act (the mandatory hotel registration in the place where you will stay)

According to the Law on electronic documents and electronic authentication services (when paying through POS terminals). It is IMPORTANT to note that through a virtual POS, the payment is made directly to the bank, through the BORICA system. We do not process financial and banking information. Only your bank and the BORICA system do this. In this sense, paying through a virtual POS terminal is no different from paying through a physical POS terminal.

Under the Banks and Banking Act (in relation to payments and under the Anti-Money Laundering Measures Act)

***In addition to the above-mentioned normative acts, others are also in force
related to them.

Processing of your data based on a contract concluded with you.

Processing of your data based on a request by telephone or through another means of mass communication.

For statistical purposes (in case of interest in a certain tourist product).
To exercise or defend legal claims.
When you entrust “ORANGE TOUR” Ltd. with the processing of personal data of a third party for the use of a service, “ORANGE TOUR” Ltd. acts as a processor of personal data.
When booking additional travel services for your trip or vacation through our hyperlink(s), without using the rights that
apply to travel packages according to Directive (EU) 2015/2302. In such a case, “ORANGE TOUR” Ltd. acts solely on your instructions as a user of the service and only to the extent that it can have control over the personal data that you process. “ORANGE TOUR” Ltd. has no control over the content and data that you, as a service user, choose to upload to the provider’s service (regardless of whether this data is personal or not). In this case, “ORANGE TOUR” Ltd. is not included in the process of deciding whether the service will be used for processing personal data, for what purposes and whether they are protected. Accordingly, the responsibility of “ORANGE TOUR” Ltd. in this case is limited to 1) complying with the instructions of the service user according to the contract and the general conditions of the reservation system and 2) providing information about the service and functionalities through its interface.

Legitimate interests pursued by us or by third parties – our partners – would be the following:
We are a commercial company that works as a tour operator and agent.

Our legitimate interest is directly related to the subject of our activity, to fulfill our contractual relations – provision of a tourist service.

The interests of “ORANGE TOUR” OOD and third parties in the field of trade, legal certainty and tax policy arise from the nature of our commercial activity.

We are an insurance agent
Third parties who work for us are accountants, tour operators, agents, carriers, lawyers, tour guides, museum workers, insurers. Their legitimate interest derives directly from their commercial activity.
Organizations/persons that may receive your personal data would be:
Tourist agents and members of BATA and АБТТА registered in the national tourist register of the Ministry of Tourism and/or the corresponding tourist registers of another country (item 6- of the PRZ of the tourism law)

Hoteliers (Civil Registration Act) Our servicing accounting firm (Accounting Act) Administrations before which you apply for a visa Air carriers and IATA members

Carriers (when required by international agreement)

Law firm/advocate/lawyer (in case of protection of our legitimate interest)

Insurance Company National Insurance Company

The bodies of state power

III. Processing principles.

We adhere to the following principles when processing your data:

legality, good faith and transparency; limitation of processing purposes;
relevance to the purposes of the processing and minimization of the data collected;
accuracy and timeliness of data;
limitation of storage in order to achieve the objectives;
integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

IV. Consent:

By agreeing to accept this Privacy Statement (personal data privacy notice), you give us permission to process your personal data only for the purposes we specify.

Consent is necessary for us to process both types (ordinary and special) of personal data, but it needs to be explicit.

In cases where we ask for consent for special (sensitive) personal data, we always justify why and how this information will be used.

You can withdraw your consent at any time by submitting an application for withdrawal of consent or using a free text email (letter).

V. Transfer of personal data to a country outside the EU or to an international organization
“ORANGE TOUR” Ltd. notifies you in case of intention to transfer part or all of your personal data to third countries or international organizations.

We do not intend to transfer your personal data to third parties without your prior consent, unless it is necessary for the purposes of the contract (for example, travel to a country with a visa regime).

VI. We do not sell your data to anyone!
“ORANGE TOUR” OOD may, at its own discretion, provide part or all of your personal data to a relevant department, for the fulfillment of processing purposes in compliance with the requirements of Regulation (EU) 2016/679.

VII. Data retention period
(“ORANGE TOUR” OOD) stores your personal data in the following terms:

1. On legal grounds:
According to Art. 91 of the Law on Tourism, 2 years (plus 6 months for the movement of a legal file “without movement”, after the date of expiry of the above-mentioned period),
Until the expiration of the general five-year statute of limitations for contractual relations, (e.g. Art. 111 of the Law on Obligations in connection with Items 60-68 of the DRZ to the Law on Tourism) (with the possibility of extension up to 6 months for the movement of a legal file
“no movement”, after the expiry date of the above term),

According to the Accounting Law – 10 years, and/or until the completion of the audit and/or cross-check by the National Revenue Agency (if the same has not been completed before the expiration of the 10 years).

In the case of employment and insurance legal relations – 50 (fifty) years.

In court proceedings until the expiration of 5 years after the filing of the case in court. (with a view to collection of costs) In the case of related cases (for example, where one appears prejudicial to the other, the time limit expires for both cases with the expiration of the fifth year in relation to the last one in time).

For contractual reasons (unless the processing is on a legal basis and the Law requires us to keep your data for a longer period):
When purchasing a plane ticket and/or hotel reservation through us – until you receive the relevant ticket or voucher, your data is immediately deleted from the system, insofar as we are the data processors between you and the Administrator who provides you with the final service – for example, the airline. Your data may be saved exceptionally if you have created a user profile under your control to use discounts in the system and/or if you have given your consent for the purposes of the company’s marketing policy (direct and/or indirect). In this case, you have the right to withdraw your consent at any time and depending on the system – if you have access with a customer profile to delete the data yourself and/or ask to be forgotten (and the data deleted), and/or write to us– free text of the email indicated above or by hand. (please see your rights below in the declaration point VIII),

Upon expiry of the period in which claims may be made under the contract,

Your data will be stored on paper and electronic media, with a developed policy and organizational security measures in accordance with the Regulation.

1. Upon your consent – as long as it is necessary for the purposes for which it was given or upon withdrawal of consent: See the data destruction procedure here.

VIII. Your rights are as follows:
At any time while we store or process your personal data, you (according to legal terminology you are called the data subject) have the following rights:

you have the right to request a copy of your personal data from (“ORANGE TOUR” OOD) and the right to access your personal data at any time;

you have the right to request from (name of controller) your personal data in a form convenient for transfer to another personal data controller, or to request that we do so without being hindered by us;

you have the right to ask (administrator’s name) to correct, without undue delay, your inaccurate personal data, as well as data that is no longer up-to-date;

you have the right to request from (“ORANGE TOUR” OOD) that your personal data be deleted without undue delay in the presence of any of the following grounds:

the personal data are no longer necessary for the purposes for which they were collected; when you have withdrawn your consent;

when you have objected to the processing, when the processing is unlawful;

where the personal data must be deleted in order to comply with a legal obligation under EU law or the law of a Member State that applies to us as a personal data controller;

ATTENTION: We may refuse to delete your personal data for the following reasons:

o for compliance with a legal obligation on our part or for the performance of a task of public interest,

o for reasons of public interest in the field of public health;

o for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, to the extent that deletion is likely to make impossible or seriously hinder the achievement of the purposes of this processing;

when personal data were collected in connection with the provision of information society services.

 

ATTENTION: We may refuse to delete your personal data for the following reasons:

– for compliance with a legal obligation on our part or for the performance of a task of public interest,

o for reasons of public interest in the field of public health;

– for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, to the extent that deletion is likely to make it impossible or seriously hinder the achievement of the goals of this processing;

to establish, exercise or defend legal claims.

– when exercising the right to freedom of expression and the right to information;

IX You:
you have the right to ask (“ORANGE TOUR” OOD) to limit the processing of your personal data, in which case the data will only be stored, but not processed. Our refusal to limit will be expressly only in writing, and we are obliged to motivate it with the lawful reason;

you have the right to withdraw your consent to the processing of your personal data at any time with a separate request addressed to the Administrator;

you have the right to object to certain types of processing, such as direct marketing (unsolicited communications);

you have the right to object to automated processing, including profiling;

you have the right not to be subject to a decision based solely on automated processing involving profiling;

if we need to use your personal data for a new purpose that is not covered by this data protection declaration, we will provide you with a new data protection notice and, when and where necessary, we will request your prior consent for the new processing.

All of the above requests will be forwarded if there is a third party (recipients including non-EU and international organizations) processing your personal data).

X. You have the right to appeal to a European Supervisory Authority
In the event of a breach of your rights under the above or applicable data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:

Name: Personal Data Protection Commission
Headquarters and management address: Sofia 1592, “Prof. Tsvetan Lazarov”
No. 2

Correspondence details: Sofia 1592, “Prof. Tsvetan Lazarov” No. 2

4. Phone: 02 915 3 518

E-mail: kzld@government.bg, kzld@cpdp.bg
Website: www.cpdp.bg

In the event that you wish to file a complaint regarding the processing of your personal data by (“ORANGE TOUR” OOD, third parties, including non-EU and international organizations), you can do so at the indicated contact details of “ORANGE TOUR” OOD or directly to the Data Protection Officer, at the above contacts.

You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are not mandatory and you can make your requests in any form that contains a statement to that effect and identifies you as the data owner.

ADDITIONAL INFORMATION ON Privacy Statement What is personal data?

According to the General Data Protection Regulation, personal data is defined as:

“Any information relating to an identified natural person or an identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier or by one or more characteristics specific to the physical, the physiological, genetic, psychic, mental, economic, cultural or social identity of that natural person;”.

Also, individual data that when collected together can lead to the identification of a specific individual also constitutes personal data.

Personal data that has been anonymized in such a way that the individual is not identified or can no longer be identified is no longer considered personal data. For data to be truly anonymized, the anonymization must be irreversible. If they can be reused

You can read more about which data is personal, how and why we use your data and what the protection mechanisms are here: https://www.orange-tours.com

ADDITIONAL INFORMATION ON Privacy Statement What is personal data?

According to the General Data Protection Regulation, personal data is defined as:

“Any information relating to an identified natural person or an identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier or by one or more characteristics specific to the physical, the physiological, genetic, psychic, mental, economic, cultural or social identity of that natural person;”.

Also, individual data that when collected together can lead to the identification of a specific individual also constitutes personal data.

Personal data that has been anonymized in such a way that the individual is not identified or can no longer be identified is no longer considered personal data. For data to be truly anonymized, the anonymization must be irreversible. If it can be used to re-identify an individual, it remains personal data and falls within the scope of the GDPR.”

WHICH DATA IS NOT PERSONAL?
Examples of data that is not considered personal data include:

company registration number;

email address, such as info@friendship.com; anonymous data.

Why does “ORANGE TOUR” Ltd. collect and store personal data?
In order to provide you with the travel services, it is necessary for us to collect personal data in order to fulfill (and/or conclude) a contract for the provision of a travel service – an organized trip or a separate element of it or a related service. (identity card/passport are required for hotel check-in, your telephone number to contact you and/or a person specified by you in the event of an insurance event, your e-mail

– for sending a boarding pass and plane ticket) basis Art. 6, para. 1 of the Regulation, namely:

Fulfillment of the obligations of “ORANGE TOUR” OOD under the contract with you; (including: to protect the rights and legal interests of you and/or the children you represent or the elderly for whom you are an assistant and so that we can protect your vital interests if an insured event occurs and you in you are unable to react at this time)

Compliance with a legal obligation that applies to ORANGE TOUR OOD (please see selective information about this in the section on the grounds that give us the right to process your data).

For the purposes of the legal (legitimate) interest of “ORANGE TOUR” OOD and your legitimate interest (for example under an insurance policy) and/or with your consent.

We guarantee that the information we collect and use is necessary (urgent) to provide our service and does not aim to invade your personal space.

For the purposes of communication with advertising and marketing purposes,

“ORANGE TOUR” OOD will ask you for additional consent.

How do you use my personal data?
In this privacy notice, we detail the purposes and reasons for collecting and processing your personal data for We are required by law to process your data for the purposes of your tourist trip and/or issuing a tourist voucher, and/or booking form, and/or for hotel accommodation, issuance of air tickets and/or related services: Tourism Act, CONVENTION on INTERNATIONAL CIVIL AVIATION, Civil Aviation Act, Obligations and Contracts Act, TOR, Statute and Regulations of the International Air Transport Association (IATA) , International Convention for the Carriage of Passengers and Baggage by Rail (CIV), International Convention for Carriage by Rail (COTIF), Regulation (EU) No. 1177/2010, Regulation (EC) No. 261/2004, Regulation (EC) No. 2006/2004 and others.

Under the Insurance Code to take out medical insurance in connection with your trip and/or to announce an event to the insurer

According to the Code of Civil Procedure and VAT for the purposes of taxation (when issuing invoices)

According to the Civil Registration Act (the mandatory hotel registration in the place where you will stay)

According to the Law on the electronic document and electronic authentication services (when paying through POS terminals).

According to the Banks and Banking Act (in connection with payments, your names and EGN should be indicated)

When booking additional travel services for your trip or holiday through our hyperlink(s) without benefiting from the rights that apply to travel packages under Directive (EU) 2015/2302

***In addition to the above-mentioned normative acts, other related ones are also in force.

2.5.2. Processing of your data based on a contract concluded with

you.

1. Processing is based on your consent. (when we make a reservation for you, including if you use our services by telephone or other means of mass communication and, in the event that any of the above legal grounds are not present); We need your consent for the following purposes:

1. For direct marketing purposes (for example, so we can send you hot offers or last minute offers).
2. For statistical purposes. (So we can assess which offer is best for you)
3. For profiling (customer account, points collection program, etc.)
Consent is not required (except on a legal basis) also when we process your data for any of the following purposes:
For reasons of public interest in the field of public health
for statistical purposes (in case of interest in a certain tourist product or for Google Adwords).
for the exercise or defense of legal claims.
Will you forward and share my personal data with other organizations or individuals?
We do not sell your data to third parties, nor will we pass it on for any gain.

“ORANGE TOUR” OOD may provide your personal data to our service sub-providers who have concluded a contract with us.

All third parties who may receive your data are required to keep your data secure and use it only to fulfill their obligations to us. When they no longer need your data to fulfill these obligations, they will have detailed instructions for their destruction in accordance with the procedures established by “ORANGE TOUR” OOD.

Where we intend to pass on special (sensitive) personal data to a third party, we will only do so after obtaining your consent. (there will be an exception only if we are legally obliged to do otherwise).

Recipients of your data may also be government authorities, to whom we provide them under specific and clear legal obligations.

How will you store and safeguard my personal data that you collect?
“ORANGE TOUR” Ltd. collects, stores and uses the information provided by you in a manner compatible with the requirements of the General Data Protection Regulation (GDPR). We will endeavor to keep the information accurate and up to date.

We will not store your information longer than is reasonably necessary to fulfill the specific purposes for which it was collected and for which you are notified here.

Some of the terms of storage of the information depend on legal obligations to keep documents and information in certain minimum terms. (see point VII in detail)

We have taken all foreseeable technical and organizational measures to ensure protection of your data from unauthorized access.

Can I find out what personal data of mine you have and process?
“ORANGE TOUR” OOD, at your request, is obliged to tell you what information we store about you and how it is processed.

In case we have your personal data, you can request the following information:

Contact details of the organization processing or on behalf of which your data is processed. (In some cases this may be a representative in the EU).

Contact details of the Official you can contact Purposes of the processing;

Legal basis for the processing;

Relevant categories of personal data being processed;

Recipients or categories of recipients to whom they are or will be disclosed;

Recipients in third countries or international organizations if there is a transfer of personal data to them, as well as the guarantees that the security of the data with them will be at least at the level in the EU;

If the processing is based on the legitimate interests of “ORANGE TOUR” OOD or a third party, information about these interests.

Anticipated period for which the personal data will be stored;

Details of your rights to request rectification or erasure of personal data or restriction of processing of personal data, and to object to such processing;

Information about your right to withdraw your consent at any time; Details of your right to appeal to a European Supervisory Authority;

Information on whether the provision of personal data is a mandatory or contractual requirement or a requirement necessary for the conclusion of a contract, as well as whether you are obliged to provide the personal data and the possible consequences of not being able to provide such data.

The source from which your personal data was collected, in cases where it was not collected directly from you.

All details and information about the presence of automated decision-making, such as profiling and any meaningful information about the relevant logic of these operations, as well as the meaning and expected consequences of this processing.

How can I access my data that has been processed?
It is necessary to complete an access request, which can be found here (link to form), or to make a request to the indicated contact details of (“ORANGE TOUR” OOD), or directly to the indicated contact details of the Data Protection Officer.

To verify your identity, it is necessary to verify your identity unambiguously – personal documents, customer number, electronic card.

Location:
Country: ……………………………………………………………………………………………
Address:………………………………………………………………………………… Phone:……………………………………………………………………………………

Web page: …………………..…………………………………………………………………

Our Data Protection Officer can be contacted directly here:

El. mail: gdpr@orange-tours.com

Tel: +3592-9500095.

Information and requests are processed free of charge, except in cases regulated by law, in which the Administrator has the right to set a reasonable fee.

CONSENT

By agreeing to the Privacy Statement regarding our Personal Data Processing Policy, you expressly consent to us processing your personal data for the stated purposes.