How we handle your data

Who is responsible

Sea Stay is operated by a sole trader registered in Bulgaria, UIC 181415578. Full company details are available in the Commercial Register (registryagency.bg). We are the data controller — meaning we decide what is collected and why. You can reach us at seastay@gmail.com or +359 88 568 4549.

Booking requests

When you send a booking request we collect your name, email address, phone number, the property and dates you're interested in, the number of guests, and anything you write in the message field.

We use it for one thing: to reply to you about that request and, if you go ahead, to arrange your stay. Our lawful basis is your consent, which you give by ticking the box on the form. You can withdraw it at any time by emailing us, and we'll delete the enquiry.

We keep booking enquiries for 12 months so we can find previous correspondence if you contact us again, then delete them. If your request turns into a stay, the booking record is kept for as long as accounting and tax rules require.

Online check-in and the tourist register

Before arrival we collect, for every guest staying at the property including children: first and last name, date of birth, nationality, document type, document number and gender. Bulgarian citizens are also asked for their ЕГН (personal identification number), because the register requires it for them.

We collect this because Bulgarian law requires accommodation providers to register every guest. Our lawful basis here is legal obligation, not consent — which means we can't offer you the choice of skipping it, and we can't use the data for anything else.

These details are submitted to the Unified System for Tourist Information (ESTI), operated by the Ministry of Tourism. They may also be made available to the authorities entitled to see the register.

We delete our own copy within 30 days of your departure, once the registration is complete and any statutory record-keeping period has passed. The record held in ESTI itself is governed by the Ministry, not by us.

Who else sees your data

Form submissions from this website are delivered to us by Web3Forms (Nexoslab Software Solutions LLP), which processes them on our behalf and stores a copy for 30 days before deleting it. Our email is provided by Google (Gmail). Both act as processors on our behalf: they handle the data only to deliver it to us. Our website is hosted by Netlify (Netlify, Inc.).

We never sell your data, and we don't share it with advertisers or use it for marketing.

Where your data is held

Our providers store and process data outside Bulgaria, including in the United States. Google and Netlify are both certified under the EU–US Data Privacy Framework, which is the arrangement the European Commission recognises for transferring personal data to US companies. Transfers to Web3Forms are covered by the Standard Contractual Clauses approved by the European Commission.

You can read each provider's own privacy terms at google.com/privacy, netlify.com/privacy and web3forms.com/privacy.

What you can ask us to do

Under the GDPR you have the right to:

• ask for a copy of the personal data we hold about you
• have inaccurate details corrected
• have your data deleted, where we're not legally required to keep it
• object to or restrict how we use it
• withdraw consent you've given, at any time
• receive your data in a portable format

Email seastay@gmail.com and we'll respond within one month. There's no charge. Note that we can't delete a registration already submitted to ESTI, because keeping it is a legal requirement rather than our choice.

Cookies

This website doesn't use tracking or advertising cookies, and there's no analytics running on it.

Complaints

If you think we've handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), or to the supervisory authority in your own country.