Your data,and what we do with it.

01About this notice

This notice explains which personal data we collect when you buy travel from us, travel on a booking we made, write to us or visit this website; why we need it; who we share it with; how long we keep it; and what rights you have.

It is written for two groups of people. Clients are the people or companies who ask us for travel and pay for it. Travellers are the people who travel. You can be one or both: a company is a client and its employees are travellers; a person booking a trip for themselves is both.

02Who we are

The controller of your personal data is БЪЛГЕРИЪН ТУРС ЕООД (Bulgarian Tours EOOD), UIC 206222522, trading as Lufthansa City Center Bulgarian Tours, with registered seat and management address at 121 Evlogi i Hristo Georgievi Blvd, Oborishte district, Sofia, Bulgaria.

For anything about your personal data, write to air@lcc.bg, call +359 89 560 66 77, or write to our office at 14 Tzar Osvoboditel Blvd, 5th floor, Sofia 1000.

03What we collect and why

Flights

To make a reservation we need the client's name, phone number and email address, so we know who asked and can reach them; and each traveller's full name as in the passport, the route and dates, and the date of birth of any child, because airlines and booking systems require them.

To issue a ticket we may also need, depending on the airline and the destination country, a traveller's date of birth, nationality, passport or ID card number and validity, an address at the destination, and a frequent flyer number if the traveller wants miles credited. If you do not give us data the airline requires, we cannot issue the ticket.

Legal basis: steps taken at the client's request before a contract and the performance of that contract (Article 6(1)(b) GDPR), and the airlines' and destination countries' legal requirements (Article 6(1)(c)).

Special requests

A meal preference can reveal religious beliefs, and a request for wheelchair or other assistance reveals information about health. We pass on such requests only because you ask us to, and only to the airline or hotel that needs them. Your request is your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time; without it we cannot arrange the service.

Groups, hotels, transfers and insurance

For group bookings we collect the name list and the details the airline requires for each traveller, along with the client's contact details for deposits and deadlines. For hotels, transfers and travel insurance we collect what the supplier or insurer requires, typically names, dates of birth, and passport or ID details. The legal basis is the performance of the contract.

Invoices

We issue invoices with the client's details as Bulgarian accounting and tax law requires. For companies these are company details; for private clients they are the name and address, and other identifiers only where the law requires them. Legal basis: legal obligation (Article 6(1)(c)).

Email and phone

When you write or call us, we keep the correspondence with your booking so we can follow it up and show what was agreed. If an enquiry does not lead to a booking, we keep it for up to 12 months in case you come back to it. Legal basis: our legitimate interest in handling enquiries and keeping a record of what we agreed (Article 6(1)(f)).

04This website

This website sets no cookies and uses no analytics or advertising tools. The request page sends nothing by itself: it opens your own email program with your request filled in, and nothing reaches us until you send that email. Its fonts and images are served from our own server, so visiting it does not send your data to third parties.

Like any web server, our hosting provider records technical access logs (IP address, date and time, and the page requested) to keep the site secure and working. These logs are kept for a short period under the hosting provider's own retention rules and are not used to identify visitors.

05Who we share data with

• Airlines, hotels, transfer companies, insurers and other suppliers of the services you booked, with the data each of them requires.
• Global distribution and booking systems through which we reserve and issue tickets, with the data the booking requires.
• Partner agencies in the Lufthansa City Center network, only when one of them helps with your trip at the destination.
• Service providers who work for us under contract and only on our instructions, such as our email, IT and accounting providers.
• Public authorities, when the law requires it.

We do not sell personal data and we do not use it for profiling or automated decisions.

06Transfers outside the EU

Travel takes data where you go. When your trip involves an airline, hotel or authority outside the European Economic Area, we transfer the data needed for that trip because it is necessary to perform the contract you asked for (Article 49(1)(b) GDPR). Where we work with a service provider outside the EEA on an ongoing basis, we use an adequacy decision or the European Commission's standard contractual clauses.

07How long we keep data

• Booking files for flights, groups, hotels and other services: five years after the end of the trip.
• Invoices and other accounting documents: for the periods required by Bulgarian accounting and tax law.
• Enquiries that did not lead to a booking: up to 12 months.
• Documents needed in a dispute or an inspection: until the dispute or inspection has ended and the related claims have expired.

After that, we delete the data or destroy the documents securely.

08How we protect data

Only the people who handle your booking can see your data. We use professional booking and email systems with access controls, keep our providers under confidentiality obligations, and review how we store and handle data.

09Your rights

You have the right to:

• know whether we process your data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted when we no longer need it or have no legal basis to keep it;
• have the processing restricted while a question about it is resolved;
• receive the data you gave us in a structured, machine-readable format;
• object to processing based on our legitimate interest;
• withdraw your consent at any time, without affecting processing that took place before.

Write to air@lcc.bg. We reply within one month. We may ask you to confirm your identity before we act on a request.

If you believe we process your data unlawfully, you can complain to the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg, or to the supervisory authority where you live or work.

10If someone else booked for you

If your employer, a colleague or a relative booked your trip, we received your data from them. We use it only to arrange that trip, and you have all the rights described above.

11Changes to this notice

We update this notice when our services or the law change. The date at the top shows when it last changed.