Privacy Policy

1. Who processes your data

The controller of your personal data is NIKI APART EOOD. We process data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Personal Data Protection Act.

We are not required to appoint a data protection officer. For any questions regarding your personal data, write to us at info@nikiapart.com.

2. What data we process, why and how long we keep it

We process only the data needed for the respective purpose.

Inquiry form, email and phone

Data	name, phone, email, the selected apartment, the check-in date, the number of nights, the message and the date of submission
Purpose	to respond to your inquiry, to check whether the apartment is available and to arrange and confirm the booking
Legal basis	steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to inquiries (Art. 6(1)(f))
Retention period	1 year from the last correspondence, unless the inquiry leads to a booking – in that case we keep it for as long as necessary to perform the booking and as required by the Accountancy Act

Inquiries from the form are sent to our email info@nikiapart.com and are also kept in the website's admin area, which only authorised persons can access.

Accommodation – guest register

Data	names, date of birth, nationality, type and number of identity document, arrival and departure dates
Purpose	to check you in and register your stay, as required by the Tourism Act
Legal basis	legal obligation under the Tourism Act (Art. 6(1)(c) GDPR)
Retention period	the period set in the Tourism Act and its implementing acts; after that the data is deleted

The data is submitted to the Unified Tourist Information System (ЕСТИ), maintained by the Ministry of Tourism. We do not make copies of your identity documents unless the law requires it.

Bookings through Booking.com and Airbnb

Data	names, email or messages through the platform, phone number, dates of stay, number of guests and amount
Purpose	to carry out the booking, contact you about check-in and settle the payment
Legal basis	performance of a contract (Art. 6(1)(b) GDPR) and legal obligations under accounting law (Art. 6(1)(c))
Retention period	as long as needed for the stay and settling payments; data in accounting documents – 10 years under the Accountancy Act

Booking.com and Airbnb also process your data as independent controllers, under their own privacy policies.

Website security

Data	IP address, date and time, visited address, browser data, login attempts to the admin area
Purpose	protecting the website from attacks, spam and abuse, fixing technical problems
Legal basis	legitimate interest in keeping the website secure and working (Art. 6(1)(f) GDPR)
Retention period	server and security logs – usually up to 90 days, unless they are needed to investigate a specific incident

Google Maps – only with consent

The website contains embedded Google Maps showing the location of the apartments. The maps load only after you give your consent through the cookie banner; until then, your browser does not connect to Google. When the map loads, Google receives your IP address and browser data. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings. Processing by Google is governed by Google's privacy policy.

Google reviews

The guest reviews shown on the website were published by the guests on Google and are stored on our server as text. When you browse the website, your browser does not connect to Google because of them.

We do not make decisions based solely on automated processing that have legal effects for you. We do not sell personal data.

3. Who we share data with

We share data only to the extent necessary, with:

• the hosting provider of the website (Super5, on a Hetzner server in Germany, EU);
• the hosting email server (Super5, Germany, EU) – this service is used to send and receive the website's emails and the emails of info@nikiapart.com;
• Google – for Google Maps, only after consent;
• the website security provider (the server firewall and the website's security plugins) – IP addresses during attack attempts;
• the Ministry of Tourism – the guest register data, through ЕСТИ;
• public authorities (National Revenue Agency, Consumer Protection Commission, courts, etc.) where we are required to by law.

The providers that process data on our behalf are bound by a contract and by our instructions.

4. Transfers outside the EU

Some providers (Google, whose Google Maps are embedded in the website) or their affiliates are located in the USA. The transfer is based on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework for companies certified under it, or on standard contractual clauses approved by the European Commission.

5. Your rights

To exercise your rights, write to us at info@nikiapart.com or send a letter to our address. We respond within 1 month; for complex requests, this period may be extended by a further 2 months, in which case we will notify you. We may ask you to confirm your identity. Exercising your rights is free of charge.

6. Do you have to provide us with data?

You do not need to provide us with personal data to browse the website.

The required fields in the inquiry form are needed so that we can respond to you and check the available dates.

Any consent we ask you for is voluntary, and refusing it does not limit your use of the website.

7. Security

The website runs entirely over a secure connection (HTTPS). Only authorised persons have access to personal data. We use a firewall, login attempt limiting and regular backups. Nevertheless, no method of transmission over the internet is completely secure. In the event of a security breach that poses a high risk to you, we will notify you without delay.

8. Children

The website is not intended for persons under the age of 14, and we do not knowingly collect their data. If you believe that a child has provided us with data, write to us and we will delete it.

9. Cookies

How we use cookies and how to change your choice is described in the Cookie Policy.

10. Changes

We may amend this policy when we change the way we process data or when the law changes. The current version is always on this page, with the effective date at the top.