AYA ESTATE PRIVACY POLICY

I. INTRODUCTION
For us at AYA Estate, the protection of your personal data is of paramount importance. This Policy aims to inform you under what conditions, for what purposes, on what legal basis and for what period we process your personal data when you use our website, shop in the online store or use our services.
AYA Estate is a multifunctional complex that brings together activities in the fields of winemaking (Aya Estate Vineyards), hospitality and gastronomy (Aya Hotel), equestrian sports (Aya Equestrian Centre), as well as culture and art (ArtHall).
If you are under 18 years of age, your personal data is only processed with the consent of a parent or legal representative, where applicable under applicable law.

II. GENERAL CONCEPTS
Some concepts important for a better understanding of this policy:
" Personal data " – this is any information that relates to a natural person and which, alone or in combination with other information, can lead to his identification or identifies him.
" Personal data subject " – living natural persons who are identified or identifiable through the personal data processed.
" Processing of personal data " – this is any action that we perform or may perform with your personal data, including, but not limited to, their collection, analysis or destruction.
" Personal data controller " – the company that determines the purposes and means of data processing.
" Personal data processor " – a third party that processes personal data on our behalf, based on our assignment and in accordance with the instructions provided by us (e.g. IT support providers, an agency responsible for marketing campaigns, or courier service providers).
" Management Financial Group " Group of Companies ( " MFG Group " )  – all companies that are directly or indirectly controlled by Management Financial Group AD, which are registered and operate both on the territory of the Republic of Bulgaria and abroad, and carry out financial and non-financial activities. An up-to-date list of all companies, part of the MFG Group, as well as information about their activities, is available here.
"Joint controllers " – two or more controllers who jointly determine the purposes and means of processing personal data, based on an agreement for the processing and protection of personal data between joint controllers.
" Digital Assets " – the website www.aya-estate.com and all landing pages maintained by the Company, as well as web, native and mobile applications available to customers.

III. PERSONAL DATA ADMINISTRATORS
Within the framework of AYA Estate's activities, personal data is processed by the following companies:
•    "Seawines" AD, UIC 202972213, with registered office and management address: Sofia, 106 Bulgaria Blvd. for online wine trading, organizing tastings, as well as managing the winery and its adjacent areas;
•    "Borgo Estates" EAD, UIC 208442588, with registered office and management address: Sofia, 106 Bulgaria Blvd. for the provision of hotel, restaurant and related services, including accommodation, guest service, SPA and wellness services, event organization and other activities related to the management and operation of tourist and entertainment facilities.
Each of the companies acts as an independent controller of personal data in relation to the processing operations related to its own activities. In certain cases, the companies may act as joint controllers, as described below in this Policy.

For additional information or questions regarding the protection of your personal data, our team is at your disposal at the following coordinates:
•    winery@aya-estate.com 
•    Tel: 0800 4 0008

IV. CATEGORIES OF PERSONAL DATA, PURPOSES AND GROUNDS
The Companies process personal data in connection with the provision of their respective services, as described in Section III of this Policy.
In this context, companies process the following categories of personal data:
Customer data – names, telephone, email and address. Depending on the service, additional data such as country (for online orders) and date of birth, nationality and car registration number (for hotel accommodation) may also be processed. This data is used to provide services, process orders and provide customer service, on the basis of fulfilling a contract or taking steps prior to entering into a contract.
Payment data – information about payment method, amount, transaction status and billing. It is used to process payments and fulfill accounting and legal obligations, based on the performance of a contract and/or legal obligation.
Logistics data – delivery address and data from waybills (where applicable, for example in online sales), used for the delivery of purchased products, on the basis of the performance of a contract.
Technical data – IP address, cookies and information about the use of the website or online services. This data is used to ensure functionality, security and system maintenance, based on legitimate interest and, where applicable, consent (for cookies).
Video surveillance – video surveillance is carried out at the company's sites (including a winery, hotel complex and restaurants), in which video recordings (image and motion) are processed, in order to ensure the security of property, employees and visitors, on the basis of legitimate interest.
2. Processing of personal data for marketing and personalized offers
The Companies process the following categories of personal data: identification and contact data (name, email, telephone), data on purchases, reservations and services used, data on preferences and interests, marketing and behavioral data, technical data (e.g. IP address and website usage), as well as demographic data (e.g. age and gender, when provided) to personalize services and offers, improve the customer experience and send marketing messages to the Companies and other companies in MFG Group, including through inter-brand marketing and loyalty programs, based on analysis of behavior, preferences and selected interests, incl. via email, SMS or messaging applications (e.g. Viber).
The processing is carried out on the basis of consent for marketing and profiling. Based on this consent, the Company may exchange personal data with other companies in the MFG Group for direct marketing purposes, such companies may act as independent controllers, and in individual cases joint administration is also possible, when the companies jointly determine the purposes and means of the processing. The data may also be provided to external marketing service providers. You can withdraw your consent at any time and stop receiving marketing communications via the opt-out link in each message or by contacting us at winery@aya-estate.com.

V. DATA STORAGE PERIODS
Personal data is stored for the period necessary to achieve the purposes for which it was collected. Administrators within Aya Estate apply the principle of storage limitation, minimizing the storage period to that necessary for the relevant processing.
After the basis ceases to exist and the purposes are achieved, personal data are deleted or anonymized, unless applicable law requires their further storage.
The specific storage periods are as follows:
Data included in accounting documentation and invoices : stored in accordance with applicable tax and accounting regulations for the relevant legally established period.
Data processed in connection with contracts and services : stored for a period of up to 5 years from the termination of the relevant legal relationship, unless a longer period is applicable according to law.
Data processed on the basis of consent : stored until consent is withdrawn or the purpose for which it was collected ceases to exist, whichever occurs first.
Data processed for the protection of rights and legitimate interests : stored until the relevant limitation periods expire or until the relevant proceedings are concluded.
Video surveillance data : stored for a period of up to 2 (two) months from their creation, except in the event of an incident, legal dispute or legal requirement, in which case they may be stored for a longer  period necessary to protect the legitimate interests of the administrator or to assist in an investigation by the competent authorities.

VI. SHARING DATA WITH THIRD PARTIES
Your personal data may be provided to certain categories of recipients who process the information on behalf of the administrators or in compliance with a legal obligation.
Such categories of recipients include:
–    technical service providers (IT support, hosting, software systems, booking platforms)
–    video surveillance service providers
–    courier and logistics companies
–    payment service providers
–    professional consultants (legal, accounting, tax)
–    third parties in connection with a sale, acquisition or restructuring of the business
–    marketing agencies acting as data processors
–    cloud service providers, in order to ensure the functioning of the services
–    competent public authorities if there is a legal basis
2. Data processing within the MFG Group
Based on your consent, AYA Companies Estate may exchange personal data with other companies in MFG Group for direct marketing purposes, including for the provision of products and services (including financial) through personalized offers. The data may be provided to these companies, which process them as independent administrators, as well as to external marketing service providers. In individual cases, joint administration is possible, when the companies jointly determine the purposes and means of processing.
3. Automated processing and profiling
If you have given your consent, automated processing and profiling of your personal data may be carried out for the purposes of providing personalized offers by the AYA Estate Companies and other companies of the MFG Group. This includes analysis of the history of purchases, services, reservations, customer experiences and visits, as well as your preferences and behavior, including, where available, categories of interests and demographic characteristics such as age and gender that you have selected.
Automated profiling allows the provision of personalized products, services and integrated offers from the Company and other companies in the MFG Group, selection of appropriate marketing and advertising messages and participation in common loyalty programs. This profiling does not lead to automated decisions with legal consequences for you.

VII. HOW DO WE PROTECT YOUR PERSONAL DATA?
We implement appropriate organizational, technical and physical measures to protect personal data, including encryption, pseudonymization, access control and monitoring systems, to prevent accidental loss, misuse, alteration, disclosure or unauthorized access. Access to the data is provided only to authorized employees and partners with a justified business need, who are bound by a confidentiality obligation and process the data in accordance with our instructions. We have procedures in place to respond to security breaches and, if necessary, notify the affected individuals and competent regulators in accordance with applicable law.

VIII. YOUR RIGHTS AS A DATA SUBJECT
You have the following rights under GDPR:
1. Right to information
You have the right to receive information about the processing of your personal data: purposes, legal basis, storage periods, categories of recipients, etc. If automated decision-making or profiling is applied, you will be informed about the purposes and consequences of this.
2. Right of access
You may request a copy of all personal data we process about you. Additional requests for data may be subject to a reasonable administrative fee.
3. Right to correction
You have the right to request correction or completion of incomplete or inaccurate data.
4. Right to erasure (“right to be forgotten”)
You can request the deletion of personal data if:
•    They are not necessary for the purposes for which they were collected;
•    You withdraw consent and there is no other legal basis;
•    You consider the processing to be unlawful.
Deletion may be restricted if the law requires storage or there are legal obligations, pending proceedings or the need to protect rights.
Where processing is based on your consent (including for marketing and personalization), you have the right to withdraw it at any time.
You can do this by:
-    the unsubscribe link in any marketing message or
-    by contacting us at: winery@aya-estate.com
Withdrawal of consent does not affect the lawfulness of the processing carried out previously. The data may continue to be processed if there is another legal basis.
5. Right to restriction of processing
You can request restriction of processing if:
•    You dispute the accuracy of the data;
•    The processing is unlawful, but you do not want erasure;
•    The data is not necessary for us, but is needed to protect your rights;
•    You object to processing based on legitimate interest.
6. Right to portability
You can receive your personal data in a structured, machine-readable form and transfer it to another controller when the processing is based on consent or a contract and is carried out by automated means.
7. Right to object
You can object at any time to processing based on legitimate interest. If you have given consent for marketing, you have the right to withdraw it without giving a reason.
8. Right to lodge a complaint
If you believe that we have violated applicable data protection legislation when processing your data and as a result have affected your rights, please contact us. Of course, you also have the right to file a complaint with the Personal Data Protection Commission, which is the supervisory authority in the field of personal data protection at: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. , tel. 02/91-53-518, e-mail: kzld@cpdp.bg.

IX. HOW TO EXERCISE YOUR RIGHTS?
We respond to your requests within 30 calendar days. In exceptional cases, this period may be extended by another 2 months, and we will notify you within 1 month of receiving the request.
Applications are submitted:
•    In person or by a person expressly authorized by you at the Company's registered office address.
•    By email: winery@aya-estate.com
•    By phone: 0800 4 0008
If you submit your request through a proxy, the power of attorney should contain explicit authority to represent you before the personal data controller(s) specified in this Privacy Policy, with the right to submit requests on your behalf to exercise personal data protection rights.
The exercise of rights is free of charge, except in rare cases of repeated requests that require significant resources – in which case a reasonable administrative fee may be charged.
When submitting a request electronically, we will also provide the information electronically unless you request otherwise.
The identification of the person submitting the request is carried out by an authorized official of the company when we have reasonable doubts about his identity.
This Privacy Policy was updated on 17.06.2026.