Get your card
Last updated: 5 November 2026
1.1. Welcome to https://sofun.bg (the “Website”), created for and on behalf of SoFun Ltd (“СоФън“ ООД), UIC 205127929, with registered office and address of management at Sofia, Zapaden Park, bl. 52, entr. A, fl. 1, ap. 1, email info@sofun.bg, WhatsApp and Viber +359 886 631 723.
1.2. This Privacy Policy explains how we collect, use and disclose your personal data when you use this Website and the services of the Controller. It also includes the rules on cookies (section 8).
1.3. Please read this Privacy Policy carefully. If you have any questions about it, contact us at info@sofun.bg or by WhatsApp and Viber at +359 886 631 723.
2.1. SoFun Ltd (the “Controller”) is a limited liability company with UIC 205127929, registered office and address of management at Sofia, Zapaden Park, bl. 52, entr. A, fl. 1, ap. 1, email info@sofun.bg, WhatsApp and Viber +359 886 631 723, website https://sofun.bg.
3.1. Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Contact: +359 2 915 3519; kzld@cpdp.bg; www.cpdp.bg
4.1. The Controller is committed to protecting the personal data of visitors and clients in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and applies technical and organisational measures that match current technology and the risks of the processing.
4.2. This Privacy Policy provides information about: the personal data collected and processed; the purposes of processing; retention periods; whether providing data is mandatory or voluntary; how data is processed and protected; recipients; data subjects’ rights and how to exercise them; the right to object; cookies and third-party tools; and changes to this policy.
5.1. Terms such as “personal data”, “processing”, “restriction of processing”, “profiling”, “controller”, “processor”, “recipient”, “third party”, “consent” and “personal data breach” have the meaning given to them in Article 4 of the GDPR.
6.1. Personal data is processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes; limited to what is necessary; kept accurate and up to date; stored no longer than necessary; and processed with appropriate security, including protection against unauthorised processing, loss, destruction or damage.
7.1. Special categories of data
The Controller does not collect or process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic, biometric or health data, or data about sex life or sexual orientation). Please do not send such data. If you do, the Controller will delete it immediately.
7.2. Data collected directly from you
7.2.1. When you write to the Controller by WhatsApp or Viber
The Controller communicates with clients in writing. When you write by WhatsApp or Viber, the Controller processes your name, phone number and the content of your messages in order to reply and to arrange your booking. The legal basis is steps taken at your request before entering into a contract and the performance of a contract. Messages are carried by the services of Meta Platforms (WhatsApp) and Rakuten Viber, which have their own privacy policies. If you call on WhatsApp, the Controller replies in writing. Outside working hours you receive an automatic message.
7.2.2. When you use the forms on the Website
When you send a message through the “Contacts” form, the booking forms on experience pages or the email forms on the home page, the Controller processes your name, email address, phone number (optional), preferred date, number of participants and any other information in your message, in order to communicate with you, arrange the booking and keep records. The legal basis is steps taken at your request before entering into a contract. The email forms are sent through the Web3Forms service.
7.2.3. When you email the Controller
The Controller processes your email address and any other information in your email (for example name, phone number or address) in order to reply and keep records. The legal basis is steps taken at your request before entering into a contract.
7.2.4. When you register a user profile
The Controller processes your name, email address and whether you live in Bulgaria or are visiting as a tourist, which determines the type of SoFun Card. The legal basis is the conclusion and performance of a contract and the Controller’s legal obligation to issue invoices.
7.2.5. When you book an experience, buy a SoFun Card or a gift voucher
Booking an experience: the Controller processes your name, phone number or email, date, number of participants, transfer address (if requested) and any special requirements. The data needed to carry out the booking (name, number of participants, date and contact phone) is shared with the Partner who provides the experience.
Buying a SoFun Card: the Controller processes your name, email address and the start date of the card. Payment is processed by Stripe. The Controller does not receive or store your payment card details.
Gift voucher: the Controller processes the buyer’s details (name, email or phone), the personal message, the recipient’s name (if given) and the voucher number. When the voucher is used, the details the recipient provides for the booking are also processed.
The legal basis is the conclusion and performance of a contract and the Controller’s legal obligations for accounting and invoicing.
7.2.6. When you subscribe to the newsletter
When you subscribe through the “Subscribe” form, the Controller processes your email address to send news about experiences and offers from SoFun. The legal basis is your explicit consent, which you can withdraw at any time through the unsubscribe link in each message or by writing to the Controller. Addresses are stored in the Website’s system. If an external sending service is used in the future, this policy will be updated beforehand.
7.2.7. Partners, hosts and employers
When you use the “Get involved with your business”, “Join as host” or “For your employees” forms, the Controller processes your name, company name, phone number, email, address and note in order to discuss and carry out cooperation. The legal basis is steps taken before entering into a contract and the Controller’s legitimate interest.
7.2.8. Reviews
If you leave a review on the Website, your name or nickname and the text of the review are published on the Website. The legal basis is your consent, given by publishing the review.
7.3. Data from third parties
The Controller does not normally receive personal data from third parties. If it has good reason to suspect an infringement of intellectual property or similar, it may obtain data from public registers (such as the Commercial Register or the EUIPO trademark register) in order to bring a claim, on the basis of its legitimate interest and the law.
7.4. Data collected automatically
7.4.1. When you visit the Website, the Controller may automatically collect:
7.4.2. Processing needed for the operation and security of the Website is based on the Controller’s legitimate interest. Processing through analytics and advertising tools takes place only after you give consent through the cookie banner.
7.4.3. With your consent the Website uses Google Analytics 4 (visit statistics), Hotjar (analysis of page behaviour, including session recordings and heatmaps), Google Ads and Meta Pixel (measuring advertising). The Website also uses Tawk.to live chat and Google reCAPTCHA to protect forms from abuse.
8.1. Cookies are small text files that the Website sends to your device and that are stored in your browser. They allow the Website to work properly, remember your choices and, with your consent, collect statistics and measure advertising. More information is available at http://www.allaboutcookies.org/.
8.2. Depending on how long they are stored, cookies are session cookies, deleted when you close the browser, or persistent cookies, which stay on your device for a set period or until deleted.
8.3. By function, the cookies used on the Website are:
8.4. Analytics and advertising cookies are set only with your consent. The storage period of each cookie is shown in the cookie banner, under the customisation settings.
8.5. You can give, refuse or withdraw your consent at any time through the cookie banner or with the button below.
8.6. You can also manage and delete cookies in your browser settings. More information is available at https://www.aboutcookies.org/how-to-control-cookies/ and www.youronlinechoices.com. You can stop Google Analytics from collecting data at https://tools.google.com/dlpage/gaoptout. Restricting or deleting cookies may affect some features of the Website.
8.7. The Website contains buttons, tools and content from third parties, which may set their own cookies under their own policies. The Controller is not responsible for the privacy practices of these third parties.
9.1. Data provided directly by you is processed only to:
9.2. Data collected automatically is processed to improve the effectiveness and functionality of the Website, prepare anonymous statistics, provide better service, administer the Website and adapt it to visitors’ preferences.
9.3. The Controller does not use personal data for purposes other than those in this section.
10.1. Enquiries and correspondence: for the time needed to reply and handle the request, and for one year after the reply.
10.2. Clients who ordered a service: for as long as needed to perform the contract and for ten years afterwards, as required by law.
10.3. Newsletter subscribers: until you unsubscribe or the service is discontinued.
10.4. Gift vouchers: until the voucher is used or refunded, and for the statutory retention period for accounting documents.
10.5. WhatsApp and Viber correspondence: for the period in section 10.1.
10.6. Analytics and advertising data: for the lifetime of the relevant cookie and in line with the settings of the relevant service.
10.7. In other cases, the Controller keeps personal data no longer than necessary, taking into account legal obligations, the purpose of storage, any contract with you, the need for future contact and any other legal basis.
11.1. Providing personal data is voluntary, but the data requested is needed for the services offered. If you do not provide it, the Controller cannot provide the requested service or reply to your message, you cannot create a user profile or receive the newsletter, and without a phone number or email address the Controller cannot confirm a booking.
12.1. The Controller processes personal data by automated and non-automated means.
12.2. The Controller processes personal data itself or through processors acting on its behalf: the hosting and website maintenance provider, Stripe (payments), Web3Forms (email forms), CookieYes (cookie consent), Google (analytics, advertising and bot protection), Meta (advertising and WhatsApp), Hotjar (analytics), Tawk.to (live chat) and an accounting services provider.
13.1. The Controller takes appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, unauthorised access, alteration or disclosure. Data is stored on secure servers; the Website uses an SSL certificate and an encrypted connection (https) for sending data and logging in; the Controller verifies the identity of anyone exercising the right of access; and the Controller never asks for your username and password by email or any other message.
13.2. For more information about these measures, contact us at info@sofun.bg or by WhatsApp and Viber at +359 886 631 723.
14.1. The Controller may disclose personal data to:
14.2. The Controller does not sell personal data to third parties.
14.3. Some of the providers in section 12.2 (for example Google, Meta, Stripe and Tawk.to) may process data outside the European Union, including in the United States. In such cases the transfer is based on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the European Commission.
15.1. Under the GDPR you have the right to: access your data; have inaccurate data corrected; have your data erased (“right to be forgotten”) where Article 17 GDPR applies; restrict processing where Article 18 GDPR applies; data portability; object to processing (see section 17); withdraw your consent at any time, without affecting the lawfulness of earlier processing; not be subject to a decision based solely on automated processing, including profiling; be informed without undue delay of a personal data breach likely to result in a high risk to you; lodge a complaint with a supervisory authority; an effective judicial remedy against a supervisory authority and against the Controller or a processor; and compensation for damage suffered as a result of a breach of the GDPR.
16.1. You can exercise your rights by a written request to the Controller, by post to the address in section 2 or by email, stating your name, address and other identification details, a description of the request, the date and your email address.
16.2. The request is made personally. The Controller keeps requests in a separate register.
16.3. Before replying, the Controller verifies your identity to reduce the risk of unauthorised access and identity theft, and may ask for a copy of an identification document if you cannot be identified from the data held.
16.4. The Controller reviews the request and informs you of the action taken within one month of receiving it. Where necessary, this period may be extended by two further months, taking into account the complexity and number of requests.
16.5. The Controller informs you of any extension within one month of receiving the request, with the reasons for the delay. If you submit the request electronically, the information is provided electronically where possible, unless you ask otherwise.
16.6. If the Controller does not act on your request, it informs you without delay and at the latest within one month of the reasons and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
16.7. The Controller communicates any correction, erasure or restriction of processing to each recipient to whom the data was disclosed, unless this is impossible or involves disproportionate effort, and tells you about these recipients on request.
17.1. You have the right to object at any time, on grounds relating to your particular situation, to processing based on the Controller’s legitimate interests. The Controller will stop processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
17.2. Where data is processed for direct marketing, you may object at any time, and the data will no longer be processed for that purpose. You can object by post or by email, stating that you do not wish to receive marketing messages.
18.1. The Website contains buttons, tools and content linked to services of other companies, such as a link to the website developer, the Tripadvisor logo and reviews and Google Maps. These websites are independent and the Controller is not responsible for damage or loss resulting from their use. We recommend reading their privacy policies.
19.1. This Privacy Policy may be updated at any time. The updated version is published on this Website with a new “Last updated” date and applies from publication.
20.1. If you have any further questions about this Privacy Policy, contact us at info@sofun.bg or by WhatsApp and Viber at +359 886 631 723.
20.2. This policy is published in Bulgarian and English. In case of any discrepancy, the Bulgarian text prevails.
