This policy explains what we learn about you when you use this site, enquire, book or stay with us, and what we do with it. In short: we collect what we need to answer you and host you, we do not sell it, and you can ask to see it or have it deleted.
1Who is responsible for your data
Arc Stay LTD (Арк Стей ООД), registered in Bulgaria under company number (ЕИК) 207449829, with its registered office at 5 Plovdiv Street, 9000 Varna, Bulgaria, is the controller of the personal data described here.
For anything in this policy — a question, or to use one of your rights — write to office@arcstay.com or call +359 876 888 044.
2What we collect and why
When you send an enquiry
The contact, group and property-management forms ask for your name and email address, and whatever else you choose to tell us: dates and number of guests, details of your property, a phone number, a message.
We use it to answer you and, if you ask, to prepare a quote or an offer. The legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR), and our legitimate interest in replying to people who contact us (Article 6(1)(f)).
When you send a form, a copy of the enquiry is written to our server log before it is emailed to us, so that nothing you send is lost if email fails. We also email you a confirmation.
When you book
The booking form on our apartment pages is provided by Hospitable, the reservation system we use. It collects the names and contact details of the person booking, the dates and number of guests, and payment details. The payment itself is handled by the payment provider behind that form; we never see your full card number.
We use booking details to provide your stay and to stay in touch with you about it (Article 6(1)(b)), and keep the records that tax and accounting law require (Article 6(1)(c)).
If you book through Airbnb or Booking.com, that platform collects your data under its own privacy policy and passes on to us what we need to host you.
When you stay
Bulgarian law requires accommodation providers to register every guest in the national tourist information system (ЕСТИ). For that we record details from your identity document — only those the law asks for. The legal basis is that legal obligation (Article 6(1)(c)).
When you email, call or message us
We keep the conversation so we can follow up and both know what was agreed (Article 6(1)(b), or 6(1)(f) if no booking follows).
When you visit the site
Our hosting provider records technical details of each request — IP address, browser, the page asked for and when — to keep the site running and secure (Article 6(1)(f)). These logs are kept for a short time.
The site's fonts are served from our own domain, so opening a page does not contact Google or any other font service. Maps open on Google Maps only if you click through to them.
We do not make decisions about you by automated means, and we do not build profiles of visitors.
5Transfers outside Europe
Vercel, Resend and Hospitable are based in the United States, so some of your data is processed there. Those transfers rely on the EU–US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's standard contractual clauses.
6How long we keep it
- Enquiries that do not lead to a booking or a contract: 12 months after our last contact, then deleted.
- Booking and payment records: as long as tax and accounting law requires — up to ten years in Bulgaria.
- Guest registration records: for the period set by the law that requires them.
- Emails and messages about a stay: until any claim about it would be time-barred — generally five years under Bulgarian law.
- Server logs: a short time, as set by our hosting provider.
- Your cookie choice: 6 months, then we ask again.
7Your rights
You can ask us, free of charge, to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete it, where we are not required to keep it;
- limit how we use it while a question about it is settled;
- give you the data you provided in a common machine-readable format;
- stop using it on the basis of our legitimate interests — we then stop unless we have compelling grounds;
- withdraw a consent you gave, at any time — this does not affect what was done before.
Write to office@arcstay.com. We reply within one month, and may first ask you to confirm who you are.
You can also complain to a data protection authority — in the EU country where you live or work, or in Bulgaria, where we are: the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, cpdp.bg. We would be grateful for the chance to put things right first.
8Keeping it safe
The site is served only over an encrypted connection. Access to enquiries and bookings is limited to the people at Arc Stay who need it, and to the services listed above.
9Changes to this policy
When this policy changes, the date at the top changes with it.