Privacy policy

Your personal data deserves responsible handling. This policy explains how Global Consult BG EOOD (Глобал Консулт БГ ЕООД) processes data in connection with the multilingual website https://www.globaltour-bg.com, inquiries and Global Tour travel services.

Processing is subject to Regulation (EU) 2016/679 (GDPR), applicable since 25 May 2018, and Bulgarian law. Last updated: 12 October 2026.

1. Controller and contact

The controller is Global Consult BG EOOD, company identification number 200106758, trading as Global Tour. Registered address: Sofia, Studentski Grad, block 57, entrance В.

For data protection questions and rights requests: info@globaltour.bg; telephone +359 2 868 0 500. You may also submit a request at a Global Tour office.

The technical description below concerns www.globaltour-bg.com. When using another of our websites or an external service, also read the privacy information provided there.

2. Data we receive

An inquiry may include your name, email, telephone, country, preferred dates, number of travellers, chosen programme, itinerary, transfer addresses, flight details and additional information you provide voluntarily.

A booking or contract may require names as shown in identity documents, a Bulgarian personal identification number (ЕГН) or another applicable identifier, identity document details and expiry date, payment information and invoice details. The specific data depends on the service, carrier, visa and insurance requirements and legal obligations. Not all these details are needed for an initial inquiry.

We also process correspondence, contractual documents and information relating to requests or complaints. Data may come from you, a person making a group booking, an authorised travel agent or a supplier involved in providing the service. If you provide another traveller's data, inform them of this policy and ensure you have the necessary basis.

Health conditions, allergies, disability or assistance needs should be provided only when necessary for the trip. Processing this information also requires an applicable condition under Article 9 GDPR, such as explicit consent where necessary. Children's data is provided by a parent, legal representative or someone with the necessary authority.

When you visit the website, its infrastructure may process IP addresses, browser and device information, timestamps, requested pages and diagnostic data. To limit abuse, the application uses technical identifiers derived from the connection address. These are not equivalent to fully anonymous data.

3. Purposes and legal bases

Inquiries, quotations, bookings and travel services — taking steps at your request before a contract and performing a contract, under Article 6(1)(b) GDPR.

Accounting, tax documents, statutory requirements and cooperation with competent authorities — compliance with a legal obligation, under Article 6(1)(c) GDPR.

Website security, abuse prevention, managing correspondence and protecting legal claims — legitimate interests under Article 6(1)(f) GDPR, subject to assessing necessity and balancing those interests against your rights.

Marketing and optional functions requiring consent — separate, informed consent under Article 6(1)(a) GDPR. Withdrawal does not affect the lawfulness of processing before withdrawal.

Data necessary for a specific service or a legal obligation may be a condition for providing that service. If it is missing, we will explain which services cannot be provided. Sending an inquiry is not consent to advertising.

4. Confidentiality and recipients

Data is not sold. Access is limited to what is necessary for staff and authorised persons bound by confidentiality obligations.

To provide the requested services, data may be shared with travel agents and operators, airlines and other carriers, hotels, insurers, guides and other suppliers. Depending on their role, they may act as independent controllers or processors.

The multilingual website uses Sites/Cloudflare hosting and infrastructure, Resend correspondence services when the integration is active, and Geoapify for address searches and routing. These operations transmit the data needed for the function, such as email content and addresses or the entered addresses and coordinates. External maps are described in section 7.

Data may also be provided to accounting, legal or technical providers and competent authorities on a lawful basis. Where a provider acts as a processor, the arrangement must meet Article 28 GDPR. You may request information about the specific recipients of your data.

5. Transfers outside the European Economic Area

International travel or a technology provider may involve transfers outside the EEA. Such transfers must comply with Chapter V GDPR through an applicable adequacy decision, appropriate safeguards such as standard contractual clauses, or a specifically permitted derogation.

For the recipients, countries and safeguards in your case, including how to obtain a copy or information about them, contact info@globaltour.bg. Using the website is not blanket consent to all international transfers.

6. Retention

Retention depends on the purpose and type of data. Inquiries and correspondence are kept while needed to respond, communicate further about the same trip or protect a related legal claim. Contractual and accounting documents are retained for applicable statutory periods and, where necessary, until a dispute is resolved.

Data processed on consent is used until consent is withdrawn or its purpose ends, unless another basis permits retention. A minimal record of an opt-out may be retained to respect your marketing choice.

Technical records are retained according to security and diagnostic needs and the relevant service settings. The application periodically cleans up expired rate-limit records; infrastructure log retention depends on the provider.

You may request the period or criteria applicable to your data. When the basis for retention ends, data is subject to deletion or anonymisation, also taking account of applicable archiving and backup rules.

7. Cookies, local storage and external maps

The website uses localStorage and sessionStorage for functions such as remembering language, locally saving an itinerary or trip variant, and restoring a form where this feature is available. When reviewing an updated programme, form details may be saved temporarily in the current session; restoration is valid for 30 minutes.

Local preferences and saved variants remain in your browser until removed through the available function or browser settings. Clearing them may remove language choices and saved plans. Submitted inquiries are stored separately in the agency's system.

When an embedded Google Maps map loads, your browser connects to Google and may transmit technical information, including an IP address, and use cookies according to Google's service and settings. After following an external map or social network link, that service's policy applies. Signing out of a social network does not by itself prevent all technical data collection.

Analytics or advertising technologies that legally require consent need a prior choice. Information and controls must reflect the tools actually enabled. Cookies can also be managed in your browser. Clearing local storage does not delete inquiries already submitted to the agency.

8. Newsletter and marketing

An inquiry or booking does not automatically subscribe you to a newsletter. Where a subscription is offered, its details are used for the specified messages on the applicable legal basis.

You may withdraw consent or object to direct marketing at any time through the available unsubscribe link in a message or at info@globaltour.bg. Opting out of marketing does not stop necessary communications about your inquiry, contract or trip.

9. Security

We apply technical and organisational measures appropriate to the risk: restricted access, protection of administrative functions, request controls and measures against unauthorised use. Staff and providers with access have confidentiality and data protection obligations.

Do not send bank card details by email. Provide identity documents and sensitive information only when necessary and through a channel agreed with our team.

10. Your rights

Subject to the GDPR conditions, you have the following rights:

1. Information about processing and access to your personal data, including a copy.
2. Correction of inaccurate or incomplete data.
3. Erasure where the legal conditions are met. This does not override obligations to retain certain documents.
4. Restriction of processing in the cases provided by law.
5. Receipt of data you provided in a structured, commonly used, machine-readable format and transfer to another controller, where applicable.
6. Objection to processing based on legitimate interests and, at any time, to direct marketing.
7. Withdrawal of consent for processing based on it.
8. Protection against decisions based solely on automated processing with significant effects, subject to Article 22 GDPR.

Website calculators support planning and quotation preparation. Our team confirms the booking and trip conditions.

11. Requests and complaints

Send requests to info@globaltour.bg, specifying the right you wish to exercise and information that helps us identify the relevant inquiry or contract. Where we have reasonable doubts about identity, we may request proportionate additional verification information.

We respond without undue delay and normally within one month. Complex or numerous requests may require an extension of up to two further months; we will notify you of the reasons within the first month. Requests are normally free; the law permits exceptions for manifestly unfounded or excessive requests.

You may complain to the Bulgarian Commission for Personal Data Protection (КЗЛД): 1592 Sofia, 2 Prof. Tsvetan Lazarov Boulevard; kzld@cpdp.bg; https://cpdp.bg. Read its official complaint instructions, including the requirements for electronic submission. You may also complain to a competent supervisory authority in another EU country as provided by the GDPR and seek a judicial remedy.

12. Updates and further information

When purposes, providers or features change, we update the processing information. The current version is published on this page with its revision date.

Booking and required details: https://www.globaltour-bg.com/pages/travel-booking?lang=en. Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng.

13. Visit statistics and tracking choices

Native statistics start only after your explicit permission. We measure public page views, sessions and unique browsers, language, device type, traffic source and approximate country/region supplied by the infrastructure. Location is not a GPS coordinate and may be inaccurate. Administration, previews and recognisable bots are excluded.

The browser stores global-tour:statistics:consent:v1 (a choice for 180 days), global-tour:statistics:visitor:v1 (a random identifier for 30 days) and global-tour:statistics:session:v1 (a session until 30 minutes without a new page view). No statistics identifiers are created without permission. If local storage is unavailable, the choice and identifiers may work only in the current tab.

The server stores hashed random identifiers, time, a public path without personal parameters, language, device, country/region and source category/domain. The module does not store raw IP addresses, names, emails or form data and does not infer gender or age. Records have an intended retention period of 90 days; bounded cleanup runs when visits arrive. Abuse prevention uses a separate hourly hash derived from the connection address, with cleanup after 48 hours. Hashed identifiers are pseudonymous rather than necessarily anonymous data.

Google Analytics 4 is optional and runs only when the agency has configured an identifier and you allow statistics. Demographic and advertising signals require a separate choice. Without that permission, advertising storage, advertising user data and personalisation are denied. Google may use _ga and _ga_… cookies and process technical data including an IP address under https://policies.google.com/privacy. GA4 retention depends on the relevant property settings; any international transfers depend on the provider’s applicable terms and safeguards. Gender and age reports are aggregated, may be missing or restricted by Google and do not describe every visitor.

Use “Statistics settings” at the bottom of a public page to allow, refuse or withdraw your choice at any time. Withdrawal stops future measurement and clears statistics identifiers and GA4 cookies in this browser; it does not automatically erase earlier server records. Saved itineraries and necessary preferences remain separate. This choice controls statistics; external maps and services are described elsewhere in this policy. To exercise your rights, contact info@globaltour.bg.

Measuring website actions

With analytics permission and measurement enabled, we record programme opens, searches, searches without results and enquiry steps: starting the form, attempting submission and confirmed receipt. We store the action type, page path without query or parameters, language, date and a pseudonymous session identifier. This report does not store search words or form contents. Events are retained for up to 90 days. A session with a form start but no recorded success does not prove travel abandonment. Change your choice using statistics settings; after refusal we send no new actions.