Introduction
Last updated: 8 October 2026
This Privacy Policy describes how GIS Galaxy EOOD, trading as GIS Galaxy, collects, uses, stores and protects the personal data of website visitors, customers and people submitting enquiries through online forms, email, telephone or other communication channels.
For us, personal data protection is an important part of the trust between a travel agency and its customers. We process personal data only when necessary to provide information, prepare an offer, arrange travel, communicate with customers, meet contractual or legal obligations, and improve our services and website operation.
This policy applies to all services presented through the GIS Galaxy website, including air travel, coach itineraries, individual itineraries, hotel accommodation, holidays, cruises, excursions, transfers, conference and academic tourism, and other related travel services.
Data Controller Details
The personal data controller is:
GIS Galaxy EOOD
Company registration number: 175415584
VAT number: BG175415584
Travel Agency Licence: РК-01-8590
Registered address: Burgas, Zornitsa residential district, block 15, entrance G, floor 8, apartment 24
For questions about personal data processing, exercising your rights or further information, please contact us using the details published on the website.
Personal Data We Collect
Depending on how you use our website and services, we may process the following categories of personal data:
- first name and surname
- email address
- phone number
- city, country or correspondence address, where necessary
- information supplied through a contact or enquiry form
- preferred destination
- travel period
- number of travellers
- travellers' ages, where needed for an offer, hotel accommodation, insurance, transport or booking
- preferred travel type: holiday, excursion, cruise, air travel, coach itinerary, individual itinerary, hotel, transfer or conference tourism
- budget and preferences
- special requirements voluntarily provided by the customer
- information necessary for a booking, invoicing or delivery of a particular travel service
- communication-related information: messages, enquiries, clarifications, offers and subsequent correspondence
- technical information about website use where necessary for security, statistics or functionality.
For an actual booking or agreed service, additional information may be required, such as identity document details, date of birth, nationality, passport or identity card number, traveller details, insurance information or other data required by travel service providers, airlines, hotels, tour operators, cruise companies, insurers or public authorities.
Purposes for Which We Use Personal Data
Personal data is processed for the following main purposes:
- responding to enquiries submitted through the website, email or telephone
- preparing individual travel proposals
- providing information about offers, destinations, itineraries, hotels, transport, cruises and transfers
- arranging air travel, coach itineraries, holidays, excursions, cruises and individual itineraries
- arranging conference, academic and professional travel
- booking travel services
- issuing documents, vouchers, confirmations, invoices or other necessary materials
- communicating with customers before, during and after travel
- assisting with changes, clarifications, cancellations or questions
- administrative and accounting services
- meeting legal obligations
- protecting rights and legitimate interests
- improving service quality and website operation
- marketing communications where applicable and supported by the relevant legal basis or consent.
Legal Basis for Processing
Personal data may be processed on one or more of the following bases:
- taking steps at the customer's request before entering into a contract
- performing a contract or travel service
- complying with a legal obligation
- legitimate interests, such as communicating about an existing enquiry, protecting rights, preventing misuse or improving service
- consent where required, for example for certain marketing communications or non-essential cookies.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Recipients with Whom We May Share Data
To deliver the services you request, we may need to share some personal data with trusted partners and providers, including:
- tour operators
- airlines
- hotels and accommodation providers
- transport companies
- cruise companies
- insurance partners
- excursion and local service organisers
- conference and academic tourism partners
- payment operators
- accounting, legal or administrative advisers
- IT providers, hosting providers, CRM systems or technical support providers
- public authorities where required by law.
We share only the data necessary for the particular service, booking, communication or legal obligation.
International Data Transfers
For travel services involving journeys outside Bulgaria or the European Union, certain personal data may need to be shared with partners, providers or institutions in the destination country. These may include airlines, hotels, tour operators, cruise companies, local agencies, transport partners or border and visa authorities.
In such cases, data is shared only to the extent necessary to deliver the requested service or comply with applicable requirements.
Retention Period
We retain personal data only for the period necessary to fulfil the purposes for which it was collected and to meet legal, accounting, tax or contractual obligations.
Data submitted in an enquiry may be kept for a reasonable period for follow-up communication, offer preparation, customer service and evidence of correspondence. Data relating to an actual booking, invoice or contract may be kept for the periods required by applicable legislation.
When retention is no longer necessary, data is deleted, anonymised or archived under internal rules and legal requirements.
Data Security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, unlawful disclosure or misuse.
Access to personal data is limited to people, employees, partners or providers who need it to deliver a particular service, maintain systems, communicate with customers or meet a legal obligation.
Although we take steps to protect data, information transmitted over the internet cannot be guaranteed to be completely secure. We therefore recommend not sending sensitive personal data through unsecured channels unless necessary and expressly requested.
Your Rights
Under applicable data protection legislation, you may request:
- access to personal data we process about you
- correction of inaccurate or incomplete data
- deletion of personal data where legal grounds exist
- restriction of processing
- objection to processing based on legitimate interests
- data portability where applicable
- withdrawal of consent where processing is based on consent
- information about data recipients where applicable.
To exercise your rights, contact us using the website's contact details. We may request additional information to verify your identity where necessary to protect data.
Right to Complain
If you believe the processing of your personal data breaches applicable legislation, you have the right to lodge a complaint with the competent supervisory authority.
In Bulgaria, this is the Commission for Personal Data Protection. Its contact details are published on its official website.
Cookies and Technical Data
The website may use cookies and similar technologies for normal operation, security, statistics, content improvement and, with consent, marketing purposes. Detailed information is published in our Cookie Policy.
Some cookies are necessary for website operation and do not require consent, while others, such as statistical or marketing cookies, may be used only with the user's relevant consent.
After consent to analytics cookies, we use Google Analytics 4, provided by Google, for statistics about visits, page views, browser and device. We do not send enquiry form content, names, phone numbers or email addresses. For the initial page measurement, we exclude URL parameters and fragments. Advertising features and Google signals are disabled. Google's processing is also governed by its privacy policy: https://policies.google.com/privacy.
You may withdraw consent through Cookie Settings at the bottom of the page. This stops further measurement and deletes Analytics cookies from your browser; withdrawal does not affect processing already carried out.
Policy Changes
This Privacy Policy may be updated following changes to legislation, services, technical systems, partners or personal data processing practices. The current version will always be published on this page.