1. Who processes your data

The data controller is:

bungala.bg, Bulgaria.
Email: info@bungala.bg

For any questions about your personal data write to info@bungala.bg.

2. What data we collect

  • Owners: username, email, password (stored only encrypted), phone, inquiry email, links to social networks and website, address and location of the place, photos, prices, payment history. For “Get verified” – tourist register number or a photo with a code (visible only to the administrator).
  • Guests: name, email and message when sending an inquiry; name and text of a review.
  • Technical data: IP address – temporarily, for protection against attacks and spam; cookies needed for the site to work (see the Cookie Policy).

We do not sell personal data or use it for third-party advertising.

3. Why we process it

  • To provide the service (contract, Art. 6(1)(b) GDPR): account, publishing listings, forwarding inquiries to the owner, paid services.
  • Legitimate interest (Art. 6(1)(f)): security, fraud and spam protection, checking listings and reviews, improving the site.
  • Legal obligation (Art. 6(1)(c)): accounting records of payments.
  • Consent (Art. 6(1)(a)): only if we use analytics or advertising cookies in the future – we will ask for your consent first.

4. Who receives the data

  • The owner of the place – receives the name, email and message of an inquiry.
  • Guests – see the contact details the owner chose to show in the listing.
  • Our providers processing data on our behalf: hosting and email (SuperHosting.BG, Bulgaria); Anthropic (automatic translation and checking of listing and review texts – data may be processed in the USA under EU standard contractual clauses); Cloudflare (“I am not a robot” check, if enabled); the payment provider for card payments – card details never reach us.
  • Maps: the map in listings is from Google Maps and loads only after you click “Show map”; the map for choosing a location is from OpenStreetMap. In both cases your browser sends its IP address to their servers.
  • Public authorities – only when required by law.

5. How long we keep it

  • Account and listing data – while the account exists; deleted when you delete your account unless the law requires otherwise.
  • Guest name and email from an inquiry – 60 days, then deleted automatically.
  • IP addresses for protection – 15 minutes to 1 hour.
  • Accounting records of payments – 10 years (Bulgarian Accountancy Act).
  • Backups – up to 30 days.

6. Your rights

You have the right of access, rectification, erasure (“Delete my account” in “My listings”), restriction, portability, objection and withdrawal of consent. To exercise them write to info@bungala.bg – we reply within one month.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the authority in your country.

7. Security

We use a secure connection (https), encrypted passwords, login attempt limits, two-factor login for administrators and regular backups.

8. Children

Only persons over 18 may have an account. We do not knowingly collect children’s data.

9. Changes

When this policy changes, the date at the top is updated. We will notify you of material changes.