Privacy policy
What personal data we collect, how we use it and how to exercise your rights
In short
We are a Bulgarian company running a travel booking platform for travellers in Bulgaria and Greece, in several languages. We collect what we need to take your booking, get you to your experience, and help you when something goes wrong. We share your details with the Host who is actually providing your Service, and with the companies that process our payments and run our website. We do not sell your data. You can ask us what we hold, correct it, or have it deleted.
Who is responsible for your data
The data controller is AROYO BRACHA LTD.
Company
AROYO BRACHA LTD
UIC Registration No.
208385190
Registered address
Petar Parchevich 29, Sofia 1000, Bulgaria
Phone
Privacy contact
What we collect
You give us
- Name, email address, phone number
- Booking details: Service, dates, number of guests, ages of children
- Special requests: dietary needs, accessibility needs, medical notes you choose to share, and anything else you tell us matters for your trip
- Passport or ID details, only where a Host or the law requires them for a specific booking, and only for that booking
- Driving licence details, for car rental only
- Messages you send us, on the Platform, by email, or on WhatsApp
- Reviews and photos you choose to publish
- Account details, if you create an account
We generate or receive
- Booking history and payment status
- Support conversation history
- Technical data: IP address, device and browser type, pages viewed, referring page, and how you move through the site
- If session replay is enabled: recordings of your interactions with pages on our site — clicks, scrolling, mouse movement and form field interactions. Payment fields and password fields are masked.
We do not store your full card number. Payments are handled by our payment processor and card details never reach our servers.
Why we use it, and our legal basis
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Take and manage your Booking, pass it to the Host, confirm it, handle changes and cancellations | To give you what you paid for | Performance of a contract, Art. 6(1)(b) |
| Take payment and issue refunds | Same | Performance of a contract, Art. 6(1)(b) |
| Answer questions and provide support, in Hebrew, including on WhatsApp | Same | Performance of a contract, Art. 6(1)(b) |
| Booking emails: confirmation, final details, review invitation | Same | Performance of a contract, Art. 6(1)(b) |
| Special requests — dietary, accessibility, health | To make the Service work for you | Explicit consent, Art. 9(2)(a) |
| Passport or licence details | A Host or the law requires it | Contract + legal obligation |
| Accounting, tax and statutory records | Bulgarian law requires it | Legal obligation, Art. 6(1)(c) |
| Fraud prevention, security, keeping the Platform working | To run a safe service | Legitimate interests, Art. 6(1)(f) |
| Understanding how the site is used | To make the Platform better | Consent, Art. 6(1)(a) + ePrivacy |
| Marketing emails about Bulgaria, Greece and offers | To tell you about things you may want | Your consent, Art. 6(1)(a) |
Marketing is separate and optional. Accepting our Terms does not sign you up for marketing. You opt in, and you can unsubscribe in one click in any marketing email. Booking emails are not marketing and continue regardless, because you need them.
Who we share it with
The Host providing your Service. Your name, phone number, guest count, ages of children where relevant, and any special request that affects delivery. Hosts receive what they need to serve you and no more. Hosts are independent controllers of the data they receive.
Our payment processor. Stripe (Ireland, EU) handles card payments and refunds. Where the Deposit option is used, the cash portion is paid directly to the Host and we receive no payment data for it.
Service providers acting for us
| Provider | What it does | Where |
|---|---|---|
| Stripe | Card payments, refunds | Ireland / EU |
| PostHog | Product and funnel analytics | EU (eu.posthog.com) |
| Google Analytics | Website statistics | EU / US |
| WhatsApp (Meta) | Support and booking conversations | EU / US |
| Vercel and Render | Running the Platform | EU / US |
These act on our instructions under data processing agreements.
Authorities, where the law or a court order requires it.
We do not sell your personal data, and we do not share it for anyone else's advertising.
Sending data outside the EU
Most of our Hosts are in Bulgaria and Greece, inside the EU, so no transfer arises.
Where a Host is outside the EU, or where a provider processes data outside the EU, we rely on:
- an adequacy decision where one exists. Israel has an EU adequacy decision, so sending your details to Israel is treated as equivalent to sending them within the EU; or
- Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed.
You can ask us which mechanism applies to a specific transfer.
How long we keep it
We keep personal data only as long as it is needed for the purpose it was collected for: booking and payment records — for the retention periods required by Bulgarian accounting and tax law; sensitive details such as passport data or health notes — deleted shortly after the Service is delivered; marketing contact details — until you unsubscribe; and everything else — until it is no longer necessary or you ask us to delete it.
Reviews you published stay on the site indefinitely, unless you ask us to remove yours.
Cookies and tracking
Cookies that are strictly necessary — keeping you logged in, holding your basket, security — run without consent because the site cannot work without them.
Everything else — analytics, behaviour measurement, session replay — runs only after you consent, and you can change or withdraw that at any time via the cookie settings on the site.
Full details in the Cookie policy.
Your rights
You can ask us to:
Access
Tell you what we hold about you and give you a copy
Rectification
Correct anything inaccurate or incomplete
Erasure
Delete your data, unless we must keep it for accounting or legal reasons
Restriction
Restrict how we use it, in certain circumstances
Portability
Give you your data in a portable format, or send it to another provider
Objection
Stop using it where we rely on legitimate interests
Stop marketing
At any time, no reason needed
Withdraw consent
Without affecting what was lawful before you withdrew it
Email hello@makeyourtravell.com. We reply within one month. There is no charge.
Children
You must be 18 to make a Booking.
We do not collect children's names. If children join a trip, the parent or guardian making the Booking provides only their number and ages — so the Host can run the experience safely and price correctly.
We do not market to children and we do not build profiles of them.
Security
The Platform runs over HTTPS. Card data is handled by our payment processor and does not reach our servers. Access to booking data inside the company is limited to the people who need it.
Sign-in links sent by email expire and are single use.
No online system is completely secure. If a breach occurs that puts your rights at risk, we will tell you and the regulator as the law requires.
Automated decisions
We do not make decisions about you by automated means alone, and we do not profile you in any way that has a legal or similarly significant effect.
Changes to this policy
We may update this policy. We will publish material changes prominently on the Platform and update the date at the top. Where a change requires your consent, we will ask for it.
Contact
Questions, requests, or anything about your data:
hello@makeyourtravell.com · +359 87 934 3468
AROYO BRACHA LTD, Petar Parchevich 29, Sofia 1000, Bulgaria
Got a question? Talk to us
A real human answers everything, plain and simple, no fine print