Last updated: 23 June 2026

This Privacy Policy explains how Ivanka Todorova, trading as TRIPSTOTAKE. (“we”, “us” or “our”), collects and processes personal data in connection with https://tripstotake.bg, our tours, guided experiences, audio tour/digital product offers, partner referrals, customer communications and related business activities.

1.1. Controller

The controller of personal data is:

Ivanka Todorova, UIC: 180358284 , registered address: Bulgaria, 4400 Pazardzhik, 4 Dunav str..

Contact details:

  • Email: hello@tripstotake.bg
               
  • Data protection contact: info@tripstotake.bg
              
  • Phone: +359 898 441 677
              
  • Website: https://tripstotake.bg
              
  • Data Protection Officer: not appointed

1.2. Personal data we process

Depending on how you interact with us, we may process the following categories of personal data:

  • Identity data: name, surname, company name, role or position.
              
  • Contact data: email address, phone number, social media contact, billing address or company address.
              
  • Booking and service data: selected tour or Service, preferred date and time, group size, language, meeting point, itinerary preferences, travel interests, special requests, booking reference and communication   
               
  • Corporate booking data: company details, contact person, participants’ names or group information where provided.
              
  • Payment and billing data: payment status, invoice details, payment reference, billing details and accounting records. Full card data is normally processed by payment providers, not by us.
              
  • Digital product data: access links, codes, platform references, audio tour purchase or bulk-order details where applicable.
              
  • Communication data: emails, contact form content, phone notes, complaint details and customer support communications.
              
  • Marketing data: newsletter subscription status, marketing consent, preferences, unsubscribe records and campaign engagement.
              
  • Technical and analytics data: IP address, device information, browser type, operating system, referring page, pages visited, approximate location, cookie identifiers, consent preferences and analytics events.
              
  • Review/testimonial data: feedback, name, city or country, review content and photos where voluntarily provided.
              
  • Supplier, contractor and partner data: names, contact details, contract information, bank details, invoices and business communications.
              
  • Recruitment or HR data: CV, application information, identity/contact details, qualifications and interview notes where applicable.

1.3. Special categories of data

We do not intentionally request sensitive personal data unless it is necessary for accessibility, safety or the proper performance of a Service. You may voluntarily provide information such as mobility limitations, accessibility needs, dietary requirements or health-related information relevant to a tour or experience.

Where such data reveals health, disability, religious or similar special-category information, we will process it only when necessary and lawful, for example with your explicit consent, to perform appropriate accessibility arrangements, or where another GDPR condition applies. Please do not provide sensitive information that is not necessary for the Service.

1.4. Purposes and legal bases

We process personal data for the following purposes and legal bases:

  • Responding to inquiries and booking requests: steps before entering into a contract; legitimate interests in customer communication.
              
  • Booking, confirming and performing Services: performance of a contract.
              
  • Customising tours and experiences: performance of a contract; legitimate interests; explicit consent where special-category data is involved.
              
  • Processing payments, invoices and accounting: performance of a contract; legal obligations; legitimate interests in financial administration.
               
  • Customer support, complaints and dispute handling: performance of a contract; legitimate interests; legal obligations.
               
  • Sending newsletters and marketing offers: consent, unless another lawful basis applies for existing business contact communications where permitted by law.
              
  • Website analytics and improvement: consent for non-essential analytics cookies where required; legitimate interests for strictly necessary security and website operation.
              
  • Security, fraud prevention and website maintenance: legitimate interests; legal obligations.
              
  • Working with suppliers, contractors and partners: performance of a contract; legitimate interests; legal obligations.
              
  • Recruitment and HR administration: steps before entering into a contract; legal obligations; legitimate interests; consent where applicable.
              
  • Legal claims and regulatory compliance: legal obligations; legitimate interests in defending and enforcing rights.

1.5. How we collect personal data

We collect personal data:

  • Directly from you when you contact us, complete a form, request a tour, book a Service, subscribe to marketing, submit a complaint or provide feedback;
              
  • Automatically through cookies, server logs and analytics technologies, subject to your cookie choices;
              
  • From payment providers, booking platforms or third-party platforms where necessary to confirm payment or booking status;
              
  • From Third-Party Providers involved in a Service, where necessary for coordination;
              
  • From public sources or business contacts in a lawful and limited manner.

1.6. Recipients and third parties

We may share personal data with the following categories of recipients where necessary:

  • Guides, contractors and service providers involved in delivering a tour or experience;
              
  • Third-party platforms such as VoiceMap where the audio tour or digital product is accessed through that platform;
              
  • Independent partners such as Top Rent A Car where you choose to interact with or book through them;
              
  • Payment processors such as Paypercut EOOD where you choose to pay bookings and experiences accessed through bg platform.
  • Banks and accounting providers;
              
  • Website hosting, IT support, email, form, backup and security providers;
              
  • Analytics, tag management and cookie consent providers, such as Google Analytics, Google Tag Manager and cookie consent tools where implemented;
              
  • Marketing/email service providers where newsletters are used;
              
  • Professional advisers, auditors, insurers and legal representatives;
              
  • Public authorities, courts, regulators and law enforcement where required by law.

Where a third party determines its own purposes and means of processing, it acts as an independent controller and its own privacy notice applies. Where a third party processes data only on our documented instructions, it acts as a processor and must be bound by a data processing agreement.

1.7. International data transfers

Some providers, such as analytics, email, hosting, app, platform or payment providers, may process data outside the European Union / European Economic Area. Where this happens, we will use appropriate safeguards such as an adequacy decision, standard contractual clauses, transfer risk assessments or other lawful transfer mechanisms.

If Google Analytics, Google Tag Manager, VoiceMap, payment platforms or other international providers are used, their current data transfer terms and privacy documentation must be checked during implementation.

1.8. Retention periods

We retain personal data only as long as necessary for the relevant purpose, unless a longer period is required by law. Default retention periods should be confirmed and may be adjusted in the internal retention schedule.

Typical retention periods:

  • General inquiries that do not lead to a booking: up to 24 months after the last communication.
               
  • Booking and customer service records: up to 5 years after completion of the Service, unless needed longer for claims or legal compliance.
              
  • Accounting, tax and invoice records: [10 years or applicable statutory period].
              
  • Payment transaction records: as required by payment providers and accounting law.
              
  • Complaint and dispute records: up to 5 years after resolution or longer if legal proceedings are pending.
              
  • Marketing consent records: until withdrawal plus a reasonable period to prove consent and maintain suppression lists.
              
  • Newsletter data: until unsubscribe or inactivity cleanup.
              
  • Cookie consent logs: [period set by consent tool], usually 6 to 24 months.
              
  • Analytics data: according to the analytics tool settings, e.g. GA4 user-level/event retention settings selected in Google Analytics.
              
  • Recruitment data: up to 6 months after the end of the recruitment process, unless a longer period is agreed or required by law.
              
  • Supplier and partner records: for the contract term plus applicable limitation and accounting periods.

 

1.9. Your GDPR rights

Subject to legal conditions, you have the right to:

  • Access your personal data;
              
  • Request correction of inaccurate or incomplete data;
              
  • Request deletion of data;
              
  • Request restriction of processing;
              
  • Object to processing based on legitimate interests or direct marketing;
              
  • Request data portability;
              
  • Withdraw consent at any time, without affecting processing before withdrawal;
              
  • Not be subject to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects.

To exercise your rights, contact us at info@tripstotake.bg. We may need to verify your identity before responding.

1.10. Complaints

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with another competent EU supervisory authority.

Bulgarian Commission for Personal Data Protection:

Website: https://cpdp.bg

Address and complaint channels: 1592 Sofia, 2 Prof. Tsvetan Lazarov blvd.;

email: kzld@cpdp.bg;

1.11. Marketing communications

We will send newsletters, offers or promotional messages only where we have a lawful basis, usually your consent. You may unsubscribe at any time by using the unsubscribe link in the message or by contacting us.

Marketing consent is voluntary and is separate from acceptance of the Terms. Withdrawal of marketing consent does not affect your booking or access to Services.

1.12. Cookies and analytics

The Website uses cookies and similar technologies. Strictly necessary cookies support website functionality and security. Analytics or marketing cookies are used only where implemented and where valid consent is obtained, unless an exemption applies.

A separate Cookie Policy explains the categories of cookies, the use of Google Analytics / Google Tag Manager where implemented, and how you can manage or withdraw your consent.

1.13. Security measures

We apply appropriate technical and organisational measures, including access control, confidentiality obligations, secure passwords, limited access to booking data, secure communication with service providers, backups, update management, malware protection, provider due diligence, internal procedures for data subject rights and data breach response.

No system is completely secure. You should also take reasonable care when communicating with us and avoid sending unnecessary sensitive information.

1.14. Children

The Website and Services are intended to be booked by adults. We do not knowingly collect personal data from children for marketing. If a tour includes minors, the booking should be made by a parent, guardian, teacher, company representative or another responsible adult.

1.15. Automated decision-making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this Privacy Policy.

1.16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on the Website with the relevant “Last updated” date.

1.17. Contact

For privacy questions or rights requests, contact us via email: info@tripstotake.bg