Privacy policy

Data controller

The data controller is APEX Rooftop Ltd., EIK 200000000, VAT BG200000000, 9000 Varna, Bulgaria. For any question about your data, email [email protected].

What we collect

• Name, email and phone number entered when booking.
• Date, table, number of guests, estimated arrival and special requests.
• Payment details: amount, status, card brand and last 4 digits. The full card number is processed only by Stripe.
• Technical data: IP address and browser data needed to keep the site secure.

Why we use it

• To perform the reservation contract (Art. 6(1)(b) GDPR).
• To send confirmations and important messages about your reservation.
• To meet accounting and tax obligations (Art. 6(1)(c) GDPR).
• To prevent fraud and protect the site (legitimate interest, Art. 6(1)(f) GDPR).

We never use your data for marketing without your explicit consent and we never sell it.

Who we share it with

• Stripe Payments Europe Ltd. for payment processing.
• Our hosting and email providers within the EU.
• Public authorities when required by law.

How long we keep it

Reservation data is kept for 3 years after the visit date. Accounting records are kept for 10 years as required by the Bulgarian Accountancy Act.

Your rights

You have the right to access, correct, erase, restrict, port and object to the processing of your data. Use the email above to exercise them. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg), 2 Tsanko Tserkovski Blvd, Sofia 1592.

Security

The site uses an encrypted connection (HTTPS). Access to the admin panel is protected and limited to authorised staff.