Privacy Policy
Last updated: 23 October 2026
This Privacy Policy explains how LockTrip collects and uses personal data when you use locktrip.com, our apps and our related services (together, the "Services"), including when you book through an AI assistant connected to your LockTrip account.
1. Who we are
The controller of your personal data is LockTrip Ltd., a company registered in Bulgaria under UIC 204752244, with its registered address at 78 Alexander Malinov Blvd., 4 Mladost residential area, 1799 Sofia, Bulgaria ("LockTrip", "we", "us").
For any privacy question or request, contact us at [email protected] or by post at the address above.
2. What personal data we process
Account data: name, email address, phone number, password and account preferences.
Booking data: the names of the guests, travel dates, the accommodation booked, special requests and booking history.
Payment data: the amount, currency, payment method and status of your payments. Online card payments are entered with our payment processors, and we do not store your full card number or security code. If your booking is guaranteed by card and paid at the property, we pass your card details to the accommodation provider for that guarantee and do not keep them. If you pay in cryptocurrency, we process the wallet address and transaction details; these are also recorded on a public blockchain, which we do not control.
Identity verification data: in some cases, a copy of an identity document and a photo of you (see section 3).
Communications: messages, emails, chats and calls with our customer support, including recordings and transcripts where a chat or call is recorded. Our customer support uses AI-assisted tools, and some chats and calls may be answered by an AI assistant.
Technical and usage data: IP address, device and browser information, pages viewed, searches, and data collected through cookies and similar technologies.
Partner and affiliate data: if you join our affiliate or business programmes, the details needed to run your participation and pay any amounts due.
Data from AI assistants: if you connect an AI assistant to your LockTrip account, the requests it sends on your behalf (see section 6).
Most of this data comes from you. Some comes from others: for example, a person who books for you gives us your name as a guest, a sign-in provider you choose to use gives us your name and email address, and accommodation providers and payment processors send us confirmations about your booking and payment.
3. Why we use your data and our legal basis
Creating and managing your account; searching, booking and managing accommodation; taking payment; sending booking confirmations and service messages. Legal basis: performance of a contract with you, or steps you ask us to take before entering into one (GDPR Art. 6(1)(b)); for other guests named in a booking, our legitimate interest in providing the booking (Art. 6(1)(f)).
Customer support, including handling complaints, changes, cancellations and refunds. Legal basis: performance of a contract (Art. 6(1)(b)), and our legitimate interest in resolving your requests, keeping a record of our communications and improving our support (Art. 6(1)(f)).
Preventing fraud and payment abuse, and keeping the Services secure. Legal basis: our legitimate interest in protecting our customers and our business (Art. 6(1)(f)).
Running our affiliate and business programmes, including payments and invoicing. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation (Art. 6(1)(c)).
Accounting, tax and other legal obligations, and responding to lawful requests from authorities. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
Establishing, exercising or defending legal claims, including payment disputes. Legal basis: our legitimate interest (Art. 6(1)(f)).
Analysing and improving the Services, and measuring the effectiveness of our advertising. Legal basis: our legitimate interest in understanding how the Services are used and improving them (Art. 6(1)(f)).
Marketing emails about our services. Legal basis: your consent (Art. 6(1)(a)), or, for similar services to existing customers, our legitimate interest (Art. 6(1)(f)). Every marketing email lets you unsubscribe, and you can opt out at any time.
Where we rely on legitimate interests, you can object (see section 9). Some data is needed to make a booking; if you do not provide it, we cannot complete the booking.
To protect customers and us against fraud, we check payments automatically before a booking is confirmed. The check uses the booking and payment details, the device and connection used, and patterns linked to fraud. Because of this check, a booking may be held or refused. If that happens, you can contact us to have a person review the decision, to give your point of view and to contest it.
In some cases, such as a booking held for fraud checks or a large refund, we may ask you for a copy of an identity document and a photo of yourself, so that we can check that you are the account holder or cardholder. You decide whether to provide them; if you do not, we may not be able to release the booking or complete the refund. We use this data only for the verification and delete it once we no longer need it for that purpose or for a related legal claim.
4. Who we share your data with
We share personal data only as needed for the purposes above, with:
Accommodation providers (hotels and the wholesalers or platforms that supply their rooms), which need the guest names, booking details and, for bookings paid at the property, card details to guarantee the booking, to provide your stay;
Payment processors and banks, to take payments and issue refunds;
Service providers who work for us under contract, for hosting, email and messaging, analytics, security, and customer support, including AI-assisted support tools;
Advertising and analytics providers, to measure and improve the Services and our advertising;
AI assistants you connect, which receive the information they request on your behalf;
Professional advisers, such as accountants, auditors and lawyers;
Public authorities, courts and law enforcement, where the law requires it or to protect our rights;
A successor or acquirer, if all or part of our business is reorganised, merged or sold.
We do not sell your personal data.
5. International transfers
Some recipients are located outside the European Economic Area. When you book accommodation outside the EEA, or a stay supplied through a provider based outside the EEA, we send your booking data there because this is necessary to provide the booking you asked for. When our service providers process data outside the EEA, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses approved by the Commission. You can contact us to obtain a copy of these safeguards.
6. AI assistants you connect
You can connect a third-party AI assistant to your LockTrip account and authorise it to search and book for you. When you do, we receive the requests it sends for you (for example destinations, dates, guest details and booking actions) and a record of your authorisation. We send back to the assistant what is needed to answer you, such as offers, booking details and payment links, which may include personal data of you and your guests.
We use this data only to provide the Services you asked for. The legal bases, sharing and retention rules in this policy apply to it in the same way as to bookings made on our website. We do not receive your other conversations with the assistant. The assistant's provider is responsible for how it handles your conversations, under its own terms and privacy policy. You can disconnect the assistant at any time, and the access you granted to it also expires automatically.
7. How long we keep your data
We keep personal data only for as long as we need it for the purposes described in this policy. Booking, payment and accounting records are kept for the periods required by tax, accounting and other applicable laws, and for as long as needed to handle any dispute or legal claim. When data is no longer needed, we delete or anonymise it.
8. Security
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we give access only to people and service providers who need it.
9. Your rights
Under data protection law, you have the right to:
access the personal data we hold about you and receive a copy;
correct inaccurate or incomplete data;
ask us to delete your data;
restrict our processing in certain cases;
receive your data in a portable format;
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw your consent at any time, without affecting processing carried out before you withdrew it.
You can delete your account from your account settings, or send any request to [email protected]. We may ask you to confirm your identity. We reply within the time limits set by law, normally one month. When you delete your account, we delete your account details, but we keep records of your bookings and payments where the law requires it or where they are needed to handle a dispute or legal claim, as described in section 7.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Bulgaria, this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, [email protected], www.cpdp.bg.
10. Cookies
We use cookies and similar technologies (in our apps, software tools that work in a similar way) that are needed for the Services to work, for example to keep you signed in and remember your search. We also use them to analyse how the Services are used and to measure our advertising. You can block or delete cookies at any time in your browser or device settings. The Services will keep working, although some features may not.
11. Children
Our Services are not intended for children. Bookings must be made by adults, and we do not knowingly collect children's data except as guest details provided by the adult making the booking.
12. Changes to this policy
We may update this Privacy Policy at any time. Changes take effect when the updated policy is published on this page. The version published here is always the current one, and the date at the top shows when it was last updated.