Privacy policy

This policy covers the website myburgas.com ("the website"), the site's web apps — "MyBurgas Go" for public transport (myburgas.com/transit) and "Trains to and from Burgas" (myburgas.com/bdz) — and the MyBurgas GO mobile app for Android. "We" and "us" mean the data controller named below.

Here we explain what data we process, for what purpose and on what legal basis, how long we keep it, who receives it and what rights you have. The sections on cookies, advertising and Google Analytics apply to the website and the web apps, those on Stay22 and Booking.com/CJ to the website only; the mobile app has a section of its own. If you believe this policy has not been complied with, write to us at contact@myburgas.com.

Due to the nature and volume of the data processed, we are not required to and have not appointed a data protection officer. For all matters related to the protection of personal data, you can reach us at contact@myburgas.com.

Data controller: MyBurgas.com, Burgas, Bulgaria. E-mail for anything about personal data: contact@myburgas.com.

What data we collect

We collect the following categories of data:

• Technical and usage data — IP address, browser type and version, operating system, language, device type, referring page (the page you came from), the pages you visited, the date and time of access, and approximate location at city/country level, derived from the IP address.
• Device/browser identifiers — stored via cookies and similar technologies (see the cookies section).
• Server log data — records generated automatically for requests to the site and to our servers api.myburgas.com and apibdz.myburgas.com (see "Server logs and hosting"). Not only the apps call those servers: while they are on screen, the airport page and the Central station page ask every 30 seconds for the next buses and trains — with only the stop or station number and the time.
• Information you provide — when you write to us by email or through the contact form: your name, email address and the content of your message.
• Precise location — only when you ask for it — in the web apps and the mobile app, when you tap a location button (stops near you, "My location", the nearest station), and on the Blue and Green zone pages, when you tap "Where am I?". On the zone pages your location is compared with the zone map only in your browser and is neither sent nor stored anywhere. How the apps use it is set out in their sections below.

We do not knowingly collect special categories of personal data (for example, data on health, ethnic origin or political views), and we ask that you do not send us any such data.

The web apps: MyBurgas Go (/transit) and "Trains to and from Burgas" (/bdz)

Location. MyBurgas Go uses your device's location only after you tap a button. For stops near you and for a route from "My location", the coordinates, rounded to about 11 metres, are sent to our server api.myburgas.com as part of the query. The last position is kept in the browser (sessionStorage, rounded to about 110 metres) until you close the tab.

The train app (/bdz) uses your location only when you ask for it. When the planner looks for the nearest station, the coordinates are sent to our server apibdz.myburgas.com. The Map's "My location" button only shows where you are: the position is kept in the browser (sessionStorage) until you close the tab and is not sent anywhere.

The page address. A route's start and end picked on the map or from the address search become part of the page address, so they can appear in myburgas.com's server logs when a page is loaded with that address (see "Server logs and hosting"). The text you type into "From" and "To" is also sent to our address server geo.myburgas.com — without your location.

On the device. Favourite stops and lines, recent searches, settings, downloaded timetables and map tiles are kept only in the browser (localStorage, sessionStorage, IndexedDB and the app's cache) and are never sent anywhere. "Clear saved data" in Settings deletes all of it. If you download the map around your favourite stops or stations in Settings, the tiles come from our server and the requests for them appear in the server logs, as with any map you open.

The Android app. In Chrome on Android the page checks, on the device only, whether the MyBurgas GO app is installed, so that it does not offer you a second install. The answer is never sent anywhere. Cookies and Google Analytics in the web apps are the same as on the website and follow your choice in the consent banner.

The MyBurgas GO mobile app (Android)

What the app does. MyBurgas GO shows timetables, real-time departures, a live vehicle map and journey planning for public transport in Burgas. It has no accounts or sign-up and never asks for your name, e-mail or phone number. It contains no ads, analytics or tracking.

What the servers receive. The app connects only to our two servers: api.myburgas.com (timetables, real-time data, alerts and journey planning) and geo.myburgas.com (address search). With every request the server receives the phone's IP address, the time of the request, the app version and what the answer needs: stop, line and trip numbers.

Stops near you. The phone itself finds the nearest stops and sends only their numbers. The numbers show roughly where you are, but your position itself is not sent.

Saved stops on the Stops tab. While the Stops tab is on screen (on a wide screen, while its list is visible), the numbers of your first three saved stops are sent to api.myburgas.com to show their next departures — together with the numbers of the stops near you (in the same request when they fit), or on their own when the app does not know where you are. The request repeats about every 5 seconds and stops a few seconds after you leave the tab or the app; nothing is sent in the background. This lets the server see which stops you saved, together with the stops near you. Your location, an account or a device identifier is never sent.

Address search. When you type in the "From" and "To" fields (from 3 characters), the text you type and the app's language are sent to geo.myburgas.com to find addresses and places in Burgas. The search always covers the same area around Burgas, and your location is never sent there. Stops are searched on the phone itself, so nothing is sent for text that looks like a stop code.

Home-screen widget. If you put the MyBurgas GO widget on your home screen, the number of the stop you chose for it (if you chose none, your first saved stop) is sent to api.myburgas.com — the same request a stop page makes, together with the general lists of alerts and cancelled trips — to show that stop's next departures. This happens when you place the widget, when you refresh it, when you leave the app (if the widget's departures are more than a minute old), when you change the language or your first saved stop, and about every 30 minutes while it shows a stop — only with an internet connection and when the battery is not low; Android may delay this request. Without a connection nothing is sent: the widget shows the downloaded timetable. This lets the server see which stop you follow. Your location, an account or a device identifier is never sent.

Journey planning. The start and end points are sent, rounded to about 11 metres, together with the name of each place you picked. If you choose "My location" as the start or the end, that point is your position, and no name is sent for it.

App settings. Every time the app starts — including when it starts in the background to check the alerts for your saved stops and lines or to refresh the home-screen widget (each at most every 30 minutes while it is on) — and after that at most every 6 hours, the app downloads a small settings file from api.myburgas.com; if the server does not answer, it tries again a few minutes later. That request carries only the app version.

Legal basis. We process these data to answer the request you made (a timetable, departures, a route) and to keep the service secure and working — legitimate interest, Art. 6(1)(f) GDPR.

How long they are kept. The servers do not keep the contents of requests (the numbers, points and names in a route, or the text you search for) — they use them only to answer. The web servers' records hold the IP address, the date and time, the requested address, the response code and size, the referring page and the app identifier (its name and version), and are deleted within 15 days; for the address search, the requested address is recorded without the text you typed. The app never stores your location anywhere.

Who receives the data. Both servers are our own, in Bulgaria, and the request data do not leave the European Economic Area. We do not sell them and do not share them with anyone for advertising.

Location on the phone. The app asks for your location only when you use a feature that needs it: stops near you, "My location", the map's location button or the ride assistant. Your location is never saved on the phone, never shown in notifications and is sent only as described above. The ride assistant, which you start yourself for a specific trip, uses your location while the ride lasts; it works on the phone only and stops on its own at your stop.

What stays on your phone. Only the device keeps your settings, saved stops and lines, recent searches (never your location; an address you picked is kept with its name and coordinates), reminders, downloaded timetables, and each home-screen widget's stop and last departures. Settings and saved stops and lines may be included in Android's encrypted backup (Android 9 and later) or in a transfer to a new phone; the widgets' data is never in the backup. The widget shows the stop's name and departures to anyone who sees your home screen.

Deleting. "Delete all local data" in Settings removes all your data from the phone: settings, saved stops and lines, recent searches, reminders, downloaded timetables and the widgets' data (a widget stays on the home screen, showing no stop). Only the app's copy of the built-in map and its temporary files stay; uninstalling the app removes those too. A copy in your Android/Google backup is not deleted that way: it follows your phone's backup settings and is replaced by the next backup. To remove it, delete the backup in your Google account or in Android Settings → Google → Backup.

Notifications. Notifications are created on the phone: the ride assistant, reminders and changes to your saved stops and lines. There is no notification server. For changes, the app downloads the general list of alerts and compares it on the phone, so your saved stops and lines are never sent for alerts (for the home-screen widget and the Stops tab, see above). On the lock screen, notifications show the stop where you get off, or a reminder's stop; if your phone hides sensitive content on the lock screen, only the line and the count or countdown show there.

Your rights are set out in "Your rights". The server does not link requests to a person, so give us the date, time and your approximate IP address so that we can find the records.

Data and licence. Source: „Бургасбус“ ЕООД / Община Бургас · Data: Община Бургас / „Бургасбус“ ЕООД · CC BY 4.0. Real-time data: „Бургасбус“ ЕООД. The map is from OpenStreetMap (© OpenStreetMap contributors, ODbL); it is built into the app and is not loaded from the internet. Address search results are also OpenStreetMap data. MyBurgas GO is not an official app of Burgas Municipality or Burgasbus.

Age. The app is meant for people aged 16 and over.

Cookies and similar technologies

We use cookies and similar technologies (including tracking pixels and local storage in the browser) for the purposes listed below. We divide them into four categories:

• Necessary (strictly necessary) — required for the core operation of the site, for storing your consent preferences and for security. They do not require consent, as the site cannot function without them.
• Analytics — help us understand how visitors use the site (see Google Analytics). They load only after you choose "Accept all" in the cookie banner.
• Advertising — would allow ads to be shown, including personalised ones (see Google AdSense). The site shows no ads at the moment; if it starts to, advertising cookies will load only after "Accept all".
• Partner — the Booking.com search and CJ's pixels on the hotel pages, and CJ's pixel on the Polish airport page. They load only after "Accept all"; you can also load the Booking.com search yourself with its button. The Stay22 map loads only when you press "Show the map".

Cookies and local storage we use

The durations are approximate and are determined by the respective provider; they may change. Which cookies you see depends on your choice in the cookie banner. Advertising cookies (e.g. from Google) will be placed only if the site starts to show ads.

Managing consent

You can give, change or withdraw your consent at any time via the "Cookie settings" link at the bottom of every page. "Accept all" allows the analytics, advertising and partner cookies and pixels; "Essential only" and "Don't allow cookies" do not. Withdrawing consent stops their use but does not delete cookies already placed (for example Google Analytics' _ga) — you can delete those in your browser settings. There you can also manage and delete all cookies; blocking some of them may affect how the site works.

Advertising by Google AdSense

The site may show ads through Google AdSense. At the moment no ads are shown; if that changes, ads and advertising cookies will load only after you choose "Accept all". For that case, we inform you that:

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this site or to other websites.
• Google's use of advertising cookies enables Google and its partners to serve ads to users based on their visits to this site and/or other sites on the internet.
• Web beacons and pixels may also be used to display and measure ads.
• Users can opt out of personalized advertising by visiting Google Ads Settings. Alternatively, they can opt out of the use of cookies by third-party vendors for personalized advertising at www.aboutads.info/choices, and users in the EU can also do so at Your Online Choices.
• If the site starts to show ads from other vendors or ad networks as well, we will list them in the "Recipients and third parties" section below, together with links to their policies, where you can opt out of cookies for personalised advertising when the vendor offers this option.

You can read more about how Google uses data from sites and apps that use its services at policies.google.com/technologies/partner-sites.

Google Analytics

To analyse traffic, we use Google Analytics — a service provided by Google. It loads only after you choose "Accept all" in the cookie banner. When its Google Signals feature is on, Google Analytics also sends data to Google's stats.g.doubleclick.net domain.

• You can prevent the collection of data by Google Analytics by installing the Google Analytics opt-out browser add-on, or by declining analytics cookies via "Cookie settings".
• The processing of data by Google is governed by the Google Privacy Policy.

Stay22 — booking map on the hotel pages and the hotel lists

The hotel pages of the directory, and the directory's lists of hotels in Burgas and the nearby resorts, carry a booking map from Stay22 Inc. (Montreal, Canada), a partner service that shows accommodation and prices around the hotel or in the place concerned. If you choose an offer in the map, you pass through Stay22's site to the booking site, and our site may earn a commission on a booking.

The map does not load automatically — it appears only after you press the “Show the map” button. Until you load it, no request is sent to Stay22.

When you load the map, Stay22 receives your IP address, information about your browser, the address of our site and, on a hotel page, which hotel you are viewing, and sets two cookies on its own domain: __cf_bm, which guards against automated traffic, and session22, a session identifier for the map. We process this data on the basis of legitimate interest (Art. 6(1)(f) GDPR) — running and funding the site. You can choose not to load the map, block the stay22.com domain in your browser, or object at any time through the contact form. Previously, most pages also loaded a Stay22 script, which may have left entries such as sid22 and hip22 in your browser's local storage; the site no longer uses them, and you can delete them by clearing this site's data in your browser.

Booking.com and CJ — affiliate links

On the hotel pages of the directory, the "Book on Booking.com" button and the Booking.com search form below the map lead through affiliate links of CJ (Commission Junction), through which the site may earn a commission on a booking. The form from Booking.com B.V. (the booking.com and bstatic.com domains) and two 1×1-pixel images from CJ (so-called pixels) that count how often the links are shown load only after you choose "Accept all" in the cookie banner. Without that consent, a "Show the Booking.com search" button stands in the form's place: the form loads only if you press it, and the pixels do not load. Booking.com sets the bkng cookie in the form. With these requests Booking.com and CJ receive your IP address, information about your browser, the address of our site and which hotel you are viewing (each page has its own pixel); CJ's pixels set no cookies. If you press the "Book on Booking.com" button or search in the form, you pass through CJ's site to Booking.com, which process the data under their own policies.

On the Polish version of the airport page there are, in two places, CJ affiliate links to LOT Polish Airlines: the text link "Loty do Burgasu" to LOT's flights to Burgas, and a LOT banner. The banner image (from CJ's domains ftjcfx.com and yceml.net) loads with the page, and CJ's 1×1-pixel image only after you choose "Accept all"; both count how often the links are shown. With these requests CJ receives your IP address, information about your browser and the address of our site; these images set no cookies. If you click the link or the banner, you pass through CJ's site to LOT's site; both process the data under their own policies.

We process the Booking.com form and CJ's pixels on the basis of your consent (Art. 6(1)(a) GDPR and Art. 5(3) of Directive 2002/58/EC), and the form also when you ask for it yourself with its button. You can withdraw your consent at any time via "Cookie settings". The LOT banner on the Polish airport page loads on the basis of legitimate interest (Art. 6(1)(f) GDPR) — running and funding the site; you may object at any time through the contact form or at contact@myburgas.com. You can also block the booking.com and bstatic.com domains and CJ's domains (tkqlhce.com, anrdoezrs.net, jdoqocy.com, dpbolvw.net, kqzyfj.com, lduhtrp.net, ftjcfx.com, awltovhc.com, tqlkg.com, yceml.net) in your browser.

"Open in Google Maps" and "Open in Apple Maps" buttons

For your convenience, the site offers "Open in Google Maps" and "Open in Apple Maps" buttons for certain locations. These buttons are ordinary links — they do not load Google or Apple content into our site and do not send any data to them until you click on them. If you choose to open a location, the link redirects you to the Google Maps or Apple Maps application or website, where the Google Privacy Policy and the Apple Privacy Policy apply, respectively. The interactive maps on the site itself are rendered using Leaflet, as described below.

Interactive maps (Leaflet)

The interactive maps on the site are rendered using Leaflet — an open-source software library that runs in your browser. The map images ("tiles") are downloaded in advance and stored on our server. When viewing the maps, no requests are sent to external servers (for example, to OpenSeaMap, OpenStreetMap or another map provider's servers), and no personal data is shared with third parties. Requests for map images are served by our server and fall within the scope of the "Server logs and hosting" section.

The map data is based on the open data of OpenSeaMap and OpenStreetMap (© OpenSeaMap / OpenStreetMap contributors) and is used in accordance with their licenses. This is a matter of copyright and attribution of the source, not of sharing personal data.

Open-Meteo

For the weather and sea forecast, your browser connects directly to the Open-Meteo service of OpenMeteo GmbH (Switzerland) — api.open-meteo.com and marine-api.open-meteo.com — and sends it the coordinates of the place concerned (Burgas, a beach or a resort), never your location. With these requests Open-Meteo receives your IP address and information about your browser; according to its terms, its server logs are deleted after 90 days. We process this data on the basis of legitimate interest (Art. 6(1)(f) GDPR) — to show you the forecast. See the Open-Meteo terms.

Server logs and hosting

The servers of myburgas.com, api.myburgas.com, apibdz.myburgas.com and geo.myburgas.com record, for every request, the IP address, date and time, the requested address, the response code and size, the referring page and the browser or app identifier. The servers of myburgas.com, api.myburgas.com and apibdz.myburgas.com record the requested address with its parameters; geo.myburgas.com records it without them. These records are processed on the basis of legitimate interest in the security and stable operation of the services and are deleted automatically within 15 days. The contents of requests to the apps' servers api.myburgas.com and apibdz.myburgas.com — such as the coordinates for stops near you or for a route — are not stored anywhere: the servers use them only to answer. MyBurgas Go's address search sends the text you type to geo.myburgas.com as a parameter of the requested address; as that server records the address without its parameters, the text is not stored: the server uses it only to answer.

How we use the data

We use the collected data for the following purposes:

• To provide, maintain and improve the operation and content of the site — on the basis of legitimate interest (Art. 6(1)(f) GDPR).
• To ensure security, prevent abuse and resolve technical problems — on the basis of legitimate interest.
• To analyse traffic and visitor behaviour (Google Analytics) — on the basis of your consent (Art. 6(1)(a) GDPR).
• To show ads, including personalised ones (Google AdSense), if the site starts to show them — on the basis of your consent.
• To answer your enquiries and messages — on the basis of our legitimate interest in replying to you.
• To show the booking map and attribute partner bookings (Stay22) — on the basis of legitimate interest.
• To show the Booking.com search form on the hotel pages, and to attribute partner bookings and purchases through CJ on those pages and on the Polish version of the airport page — the pixels and the form on the basis of your consent (the form also when you load it yourself with its button), the LOT banner on the basis of legitimate interest.

Recipients and third parties

We share data with the following categories of recipients, which process data in accordance with their own privacy policies:

• Google AdSense / Google Ads (Google Ireland Limited / Google LLC) — advertising, if the site starts to show ads — Privacy Policy · How Google uses data from partner sites
• Google Analytics (Google Ireland Limited / Google LLC) — traffic analysis — Privacy Policy
• Open-Meteo (OpenMeteo GmbH, Switzerland) — weather and sea data — Terms
• Hosting — the website, the web apps and the apps' servers run on our own server in Bulgaria; there is no external hosting provider.
• Web3Forms (Web3Creative, India) — processing and delivery of contact-form messages. When you write to us via the contact form, the name, email address and message content you enter, and your IP address, are transmitted to Web3Forms, which forwards them to our email. To fight spam, Web3Forms may send your IP address and email address to the CleanTalk and Akismet services. Web3Forms uses infrastructure from Amazon Web Services, Cloudflare and Hetzner, keeps messages for at most three years, and transfers data outside the EU/EEA (including to India and the United States) under standard contractual clauses. Provider contact: support@web3forms.com · Privacy Policy
• Stay22 Inc. (Montreal, Canada) — the booking map on the hotel pages and the hotel lists, loaded only when you press its button — Privacy policy
• Booking.com B.V. (Amsterdam, the Netherlands) — the accommodation search form on the hotel pages — Privacy policy
• CJ (Commission Junction; the controller for the EU and the UK is Epsilon International UK Ltd, London) — affiliate links and counting pixels on the hotel pages and on the Polish version of the airport page, which also shows a banner. According to CJ's policy, its servers are in the United States, and data is transferred outside the EU/EEA (including to the United States and India) under standard contractual clauses. — Privacy policy
• Apple Distribution International Ltd. (Cork, Ireland; data are generally stored by Apple Inc., USA) — the contact@myburgas.com mailbox (iCloud Mail): the messages you send us by e-mail or through the contact form — Privacy Policy

We do not sell personal data. We may disclose data to competent authorities when required by law.

International data transfers

Some of the recipients above are established, or process data, outside the European Economic Area (EEA). These transfers are safeguarded as follows: Google LLC (USA) is self-certified under the EU–US Data Privacy Framework; Apple, CJ (USA and India) and Web3Forms (India and its providers' regions) transfer data under standard contractual clauses approved by the European Commission; for Stay22 (Canada) and Open-Meteo (Switzerland), the European Commission has recognised that the country ensures an adequate level of protection.

Data retention

We store personal data only for as long as is necessary for the purposes for which it was collected:

• Analytics data — for the period configured in Google Analytics (GA4 allows setting up to 14 months for standard properties).
• Advertising data — if the site starts to show ads: in accordance with Google's policies and time periods.
• Server logs — up to 15 days.
• Correspondence and feedback — for as long as necessary to handle the enquiry and a reasonable period thereafter.

After the relevant period expires, the data is deleted or anonymized.

Data security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure — for example, an encrypted connection (HTTPS/TLS) and restricted access to the data. Please note that no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

Automated decision-making and profiling

If the site starts to show ads and you choose "Accept all", Google and its partners may process data, including through profiling, in order to show you personalised ads, as described in their policies. You can decline this via "Cookie settings" or via Google Ads Settings. We carry out no other automated decision-making or profiling.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right:

• to access your data and receive a copy of it;
• to have inaccurate data corrected;
• to have your data erased;
• to have the processing restricted;
• to object to processing based on legitimate interest;
• to data portability for data we process on the basis of consent or a contract;
• to withdraw your consent at any time (see "Managing consent"), without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to us at contact@myburgas.com. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

Links to other websites

The site may contain links to external websites that we do not control. This policy does not apply to them, and we are not responsible for their privacy practices. We recommend that you review their privacy policies.

Children

The website and the web apps are not directed at children, and we do not knowingly collect personal data from children. The MyBurgas GO mobile app is meant for people aged 16 and over.

Changes and notices

We may change this policy. We publish each new version on this page and update the "Last updated" date at its top.

Contact

If you have questions about this policy or the way we process your data, contact us by email at contact@myburgas.com.

Governing law

This policy is governed by Bulgarian law and the General Data Protection Regulation (GDPR).