Privacy policy

This policy covers the website myburgas.com ("the website"), the site's web apps — "MyBurgas Go" for public transport (myburgas.com/transit) and "Trains to and from Burgas" (myburgas.com/bdz) — and the MyBurgas GO mobile app for Android. "We" and "us" mean the data controller named below.

Here we explain what data we process, for what purpose and on what legal basis, how long we keep it, who receives it and what rights you have. The sections on cookies, advertising, Google Analytics, Stay22 and Booking.com/CJ apply only to the website and the web apps; the mobile app has a section of its own. If you believe this policy has not been complied with, write to us at contact@myburgas.com.

Due to the nature and volume of the data processed, we are not required to and have not appointed a data protection officer. For all matters related to the protection of personal data, you can reach us at contact@myburgas.com.

Data controller: MyBurgas.com, Burgas, Bulgaria. E-mail for anything about personal data: contact@myburgas.com.

What data we collect

We collect the following categories of data:

• Technical and usage data — IP address, browser type and version, operating system, language, device type, referring page (the page you came from), the pages you visited, the date and time of access, and approximate location at city/country level, derived from the IP address.
• Device/browser identifiers — stored via cookies and similar technologies (see the cookies section).
• Server log data — records of requests to the site, automatically generated by the hosting infrastructure (see "Server logs and hosting").
• Voluntarily provided information — for example, when you email us, leave a comment or feedback, where such functionality is available. This may include your name, email address and the content of your message.
• Precise location — only when you ask for it — in the web apps and the mobile app, when you tap a location button (stops near you, "My location", the nearest station). How it is used is set out in the app sections below.

We do not knowingly collect special categories of personal data (for example, data on health, ethnic origin or political views), and we ask that you do not send us any such data.

The web apps: MyBurgas Go (/transit) and "Trains to and from Burgas" (/bdz)

Location. MyBurgas Go uses your device's location only after you tap a button. For stops near you and for a route from "My location", the coordinates, rounded to about 11 metres, are sent to our server api.myburgas.com as part of the query. The last position is kept in the browser (sessionStorage, rounded to about 110 metres) until you close the tab.

The train app (/bdz) uses your location only when you ask for it. When the planner looks for the nearest station, the coordinates are sent to our server apibdz.myburgas.com. The Map's "My location" button only shows where you are: the position is kept in the browser (sessionStorage) until you close the tab and is not sent anywhere.

The page address. A route's start and end picked on the map or from the address search become part of the page address, so they appear in myburgas.com's server logs (see "Server logs and hosting"). The text you type into "From" and "To" is also sent to our address server geo.myburgas.com — without your location.

On the device. Favourite stops and lines, recent searches, settings, downloaded timetables and map tiles are kept only in the browser (localStorage, sessionStorage, IndexedDB and the app's cache) and are never sent anywhere. "Clear saved data" in Settings deletes all of it.

The Android app. In Chrome on Android the page checks, on the device only, whether the MyBurgas GO app is installed, so that it does not offer you a second install. The answer is never sent anywhere. Cookies and Google Analytics in the web apps are the same as on the website and follow your choice in the consent banner.

The MyBurgas GO mobile app (Android)

What the app does. MyBurgas GO shows timetables, real-time departures, a live vehicle map and journey planning for public transport in Burgas. It has no accounts or sign-up and never asks for your name, e-mail or phone number. It contains no ads, analytics or tracking.

What the servers receive. The app connects only to our two servers: api.myburgas.com (timetables, real-time data, alerts and journey planning) and geo.myburgas.com (address search). With every request the server receives the phone's IP address, the time of the request, the app version and what the answer needs: stop, line and trip numbers.

Stops near you. The phone itself finds the nearest stops and sends only their numbers. The numbers show roughly where you are, but your position itself is not sent.

Address search. When you type in the "From" and "To" fields (from 3 characters), the text you type and the app's language are sent to geo.myburgas.com to find addresses and places in Burgas. The search always covers the same area around Burgas, and your location is never sent there. Stops are searched on the phone itself, so nothing is sent for text that looks like a stop code.

Journey planning. The start and end points are sent, rounded to about 11 metres, together with each place's name. If you choose "My location" as the start or the end, that point is your position.

App settings. Every time the app starts — including when it starts in the background to check the alerts for your saved stops and lines (about every 30 minutes while those alerts are on) — and after that at most every 6 hours, the app downloads a small settings file from api.myburgas.com; if the server does not answer, it tries again a few minutes later. That request carries only the app version.

Legal basis. We process these data to answer the request you made (a timetable, departures, a route) and to keep the service secure and working — legitimate interest, Art. 6(1)(f) GDPR.

How long they are kept. The servers do not keep the contents of requests (the numbers, points and names in a route, or the text you search for) — they use them only to answer. The web servers' records hold the IP address, the date and time, the requested address, the response code and size, the referring page and the app identifier (its name and version), and are deleted within 15 days; for the address search, the requested address is recorded without the text you typed. The app never stores your location anywhere.

Who receives the data. Both servers are our own, in Bulgaria, and the request data do not leave the European Economic Area. We do not sell them and do not share them with anyone for advertising.

Location on the phone. The app asks for your location only when you use a feature that needs it: stops near you, "My location", the map's location button or the ride assistant. Your location is never saved on the phone, never shown in notifications and is sent only as described above. The ride assistant, which you start yourself for a specific trip, uses your location while the ride lasts; it works on the phone only and stops on its own at your stop.

What stays on your phone. Only the device keeps your settings, saved stops and lines, recent searches (never your location; an address you picked is kept with its name and coordinates), reminders and downloaded timetables. Settings and saved stops and lines may be included in Android's encrypted backup (Android 9 and later) or in a transfer to a new phone.

Deleting. "Delete all local data" in Settings removes all your data from the phone: settings, saved stops and lines, recent searches, reminders and downloaded timetables. Only the app's copy of the built-in map and its temporary files stay; uninstalling the app removes those too. A copy in your Android/Google backup is not deleted that way: it follows your phone's backup settings and is replaced by the next backup. To remove it, delete the backup in your Google account or in Android Settings → Google → Backup.

Notifications. Notifications are created on the phone: the ride assistant, reminders and changes to your saved stops and lines. There is no notification server. For changes, the app downloads the general list of alerts and compares it on the phone, so your saved stops and lines are never sent.

Your rights are set out in "Your rights". The server does not link requests to a person, so give us the date, time and your approximate IP address so that we can find the records.

Data and licence. Source: „Бургасбус“ ЕООД / Община Бургас · Data: Община Бургас / „Бургасбус“ ЕООД · CC BY 4.0. Real-time data: „Бургасбус“ ЕООД. The map is from OpenStreetMap (© OpenStreetMap contributors, ODbL); it is built into the app and is not loaded from the internet. Address search results are also OpenStreetMap data. MyBurgas GO is not an official app of Burgas Municipality or Burgasbus.

Age. The app is meant for people aged 13 and over.

Cookies and similar technologies

We use cookies and similar technologies (including web beacons, tracking pixels and local storage in the browser) for the purposes listed below. We divide them into three categories:

• Necessary (strictly necessary) — required for the core operation of the site, for storing your consent preferences and for security. They do not require consent, as the site cannot function without them.
• Analytics — help us understand how visitors use the site (see Google Analytics). They are loaded only after your consent.
• Advertising — enable the display of advertisements, including personalized ones (see Google AdSense). They are loaded only after your consent.

Sample list of cookies used

The durations are approximate and are determined by the respective provider; they may change. The exact cookies you see depend on which categories you have consented to. Advertising cookies (e.g. from Google) are placed only once ads begin to be displayed on the site. We recommend periodically checking the actual list using a cookie-scanning tool.

Managing consent

You can give, change or withdraw your consent at any time via the "Cookie settings" link at the bottom of every page. You can also manage and delete cookies through your browser settings; please note that blocking certain cookies may affect the functionality of the site.

Advertising by Google AdSense

The site uses Google AdSense to display advertisements. Advertising cookies are placed only when ads are actually displayed on the site and only after your consent — until ad display begins, no advertising cookies are placed. In connection with the use of Google AdSense, we inform you that:

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this site or to other websites.
• Google's use of advertising cookies enables Google and its partners to serve ads to users based on their visits to this site and/or other sites on the internet.
• Web beacons and pixels may also be used to display and measure ads.
• Users can opt out of personalized advertising by visiting Google Ads Settings. Alternatively, they can opt out of the use of cookies by third-party vendors for personalized advertising at www.aboutads.info/choices, and users in the EU can also do so at Your Online Choices.
• Besides Google, other third-party vendors and ad networks may also display ads on the site. They are listed in the "Recipients and third parties" section below, together with links to their policies. You can visit the relevant sites to opt out of the use of cookies for personalized advertising, where the vendor offers this option.

You can read more about how Google uses data from sites and apps that use its services at policies.google.com/technologies/partner-sites.

Google Analytics

To analyze traffic, we use Google Analytics — a service provided by Google. This service is loaded only after your consent to analytics cookies.

• You can prevent the collection of data by Google Analytics by installing the Google Analytics opt-out browser add-on, or by declining analytics cookies via "Cookie settings".
• The processing of data by Google is governed by the Google Privacy Policy.

Stay22 — booking map on the hotel pages and the hotel lists

The hotel pages of the directory, and the directory's lists of hotels in Burgas and the nearby resorts, carry a booking map from Stay22 Inc. (Montreal, Canada), a partner service that shows accommodation and prices around the hotel or in the place concerned. If you choose an offer in the map, you pass through Stay22's site to the booking site, and our site may earn a commission on a booking.

The map does not load automatically — it appears only after you press the “Show the map” button. Until you load it, no request is sent to Stay22.

When you load the map, Stay22 receives your IP address, information about your browser, the address of our site and, on a hotel page, which hotel you are viewing, and sets two cookies on its own domain: __cf_bm, which guards against automated traffic, and session22, a session identifier for the map. We process this data on the basis of legitimate interest (Art. 6(1)(f) GDPR) — running and funding the site. You can choose not to load the map, block the stay22.com domain in your browser, or object at any time through the contact form. Previously, most pages also loaded a Stay22 script, which may have left entries such as sid22 and hip22 in your browser's local storage; the site no longer uses them, and you can delete them by clearing this site's data in your browser.

Booking.com and CJ — affiliate links

On the hotel pages of the directory, the “Book on Booking.com” button and the Booking.com search form below the map lead through affiliate links of CJ (Commission Junction), through which the site may earn a commission on a booking. Loaded together with the page are the form's script from Booking.com B.V. (the booking.com and bstatic.com domains) and two 1×1-pixel images from CJ (so-called pixels) that count how often the links are shown. The form itself appears when you scroll to it, and Booking.com sets the bkng cookie in it. With these requests Booking.com and CJ receive your IP address, information about your browser, the address of our site and which hotel you are viewing (each page has its own pixel); CJ's pixels set no cookies. If you press the button or search in the form, you pass through CJ's site to Booking.com, which process the data under their own policies.

On the Polish version of the airport page there are, in two places, CJ affiliate links to LOT Polish Airlines: the text link “Loty do Burgasu” to LOT's flights to Burgas, and a LOT banner. Loaded together with the page are the banner image (from CJ's domains ftjcfx.com and yceml.net) and a 1×1-pixel image from CJ, which count how often the links are shown. With these requests CJ receives your IP address, information about your browser and the address of our site; these images set no cookies. If you click the link or the banner, you pass through CJ's site to LOT's site; both process the data under their own policies.

These requests do not wait for cookie consent: we process the data on the basis of legitimate interest (Art. 6(1)(f) GDPR) — running and funding the site. You may object at any time through the contact form, or block the booking.com and bstatic.com domains and CJ's domains (tkqlhce.com, anrdoezrs.net, jdoqocy.com, dpbolvw.net, kqzyfj.com, lduhtrp.net, ftjcfx.com, awltovhc.com, tqlkg.com, yceml.net) in your browser.

"Open in Google Maps" and "Open in Apple Maps" buttons

For your convenience, the site offers "Open in Google Maps" and "Open in Apple Maps" buttons for certain locations. These buttons are ordinary links — they do not load Google or Apple content into our site and do not send any data to them until you click on them. If you choose to open a location, the link redirects you to the Google Maps or Apple Maps application or website, where the Google Privacy Policy and the Apple Privacy Policy apply, respectively. The interactive maps on the site itself are rendered using Leaflet, as described below.

Interactive maps (Leaflet)

The interactive maps on the site are rendered using Leaflet — an open-source software library that runs in your browser. The map images ("tiles") are downloaded in advance and stored on our server. When viewing the maps, no requests are sent to external servers (for example, to OpenSeaMap, OpenStreetMap or another map provider's servers), and no personal data is shared with third parties. Requests for map images are served by our server and fall within the scope of the "Server logs and hosting" section.

The map data is based on the open data of OpenSeaMap and OpenStreetMap (© OpenSeaMap / OpenStreetMap contributors) and is used in accordance with their licenses. This is a matter of copyright and attribution of the source, not of sharing personal data.

Open-Meteo

For the weather forecast, we use the Open-Meteo service. An approximate location may be transmitted in order to retrieve the forecast. See the Open-Meteo terms.

Server logs and hosting

The servers of myburgas.com, api.myburgas.com, apibdz.myburgas.com and geo.myburgas.com record, for every request, the IP address, date and time, the requested address, the response code and size, the referring page and the browser or app identifier. The servers of myburgas.com, api.myburgas.com and apibdz.myburgas.com record the requested address with its parameters; geo.myburgas.com records it without them. These records are processed on the basis of legitimate interest in the security and stable operation of the services and are deleted automatically within 15 days. The contents of requests to the apps' servers api.myburgas.com and apibdz.myburgas.com — such as the coordinates for stops near you or for a route — are not stored anywhere: the servers use them only to answer. MyBurgas Go's address search sends the text you type to geo.myburgas.com as a parameter of the requested address; as that server records the address without its parameters, the text is not stored: the server uses it only to answer.

How we use the data

We use the collected data for the following purposes:

• To provide, maintain and improve the operation and content of the site.
• To ensure security, prevent abuse and resolve technical problems.
• To analyze traffic and visitor behavior (Google Analytics) — only with consent given.
• To display advertisements, including personalized ones (Google AdSense) — only with consent given.
• To respond to your enquiries, comments or feedback.
• To show the booking map and attribute partner bookings (Stay22) — on the basis of legitimate interest.
• To show the Booking.com search form on the hotel pages, and to attribute partner bookings and purchases through CJ on those pages and on the Polish version of the airport page — on the basis of legitimate interest.

Recipients and third parties

We share data with the following categories of recipients, which process data in accordance with their own privacy policies:

• Google AdSense / Google Ads (Google Ireland Limited / Google LLC) — advertising — Privacy Policy · How Google uses data from partner sites
• Google Analytics (Google Ireland Limited / Google LLC) — traffic analysis — Privacy Policy
• Open-Meteo — weather data — Terms
• Hosting — the website, the web apps and the apps' servers run on our own server in Bulgaria; there is no external hosting provider.
• Web3Forms (Backless Inc., USA) — processing and delivery of contact-form messages. When you write to us via the contact form, the name, email address and message content you enter are transmitted to Web3Forms, which forwards them to our email. This data is processed outside the EU/EEA — in the United States. Provider contact: info@web3forms.com · Privacy Policy
• Stay22 Inc. (Montreal, Canada) — the booking map on the hotel pages and the hotel lists, loaded only when you press its button — Privacy policy
• Booking.com B.V. (Amsterdam, the Netherlands) — the accommodation search form on the hotel pages — Privacy policy
• CJ (Commission Junction; the controller for the EU and the UK is Epsilon International UK Ltd, London) — affiliate links and counting pixels on the hotel pages and on the Polish version of the airport page, which also shows a banner. According to CJ's policy, its servers are in the United States, and data is transferred outside the EU/EEA (including to the United States and India) under standard contractual clauses. — Privacy policy
• Apple Distribution International Ltd. (Cork, Ireland; data are generally stored by Apple Inc., USA) — the contact@myburgas.com mailbox (iCloud Mail): the messages you send us by e-mail or through the contact form — Privacy Policy

We do not sell personal data. We may disclose data to competent authorities when required by law.

International data transfers

Some of the recipients above (for example, Google and Apple) are established or process data outside the European Economic Area, including in the USA. In such cases, the transfer is protected through recognized safeguards, such as the EU–US Data Privacy Framework and/or standard contractual clauses approved by the European Commission, together with additional technical and organizational measures where applicable. Google LLC is self-certified under the EU–US Data Privacy Framework; Apple transfers data under standard contractual clauses.

Data retention

We store personal data only for as long as is necessary for the purposes for which it was collected:

• Analytics data — for the period configured in Google Analytics (GA4 allows setting up to 14 months for standard properties).
• Advertising data — in accordance with Google's policies and time periods.
• Server logs — up to 15 days.
• Correspondence and feedback — for as long as necessary to handle the enquiry and a reasonable period thereafter.

After the relevant period expires, the data is deleted or anonymized.

Data security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure — for example, an encrypted connection (HTTPS/TLS) and restricted access to the data. Please note that no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

MyBurgas.com strives to have reasonable security measures in place to protect you against the loss, misuse and alteration of the information under our control. Unfortunately, there is no transmission of data over the internet or storage of data in the system for which 100% security can be guaranteed.

Automated decision-making and profiling

When you consent to advertising cookies, Google and its partners may process data, including through profiling, in order to show you personalized advertisements, as described in their policies. You can decline this via "Cookie settings" or via Google Ads Settings.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right:

• to access your data and receive a copy of it;
• to have inaccurate data corrected;
• to have your data erased;
• to have the processing restricted;
• to object to processing based on legitimate interest;
• to data portability for data we process on the basis of consent or a contract;
• to withdraw your consent at any time (see "Managing consent"), without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to us at contact@myburgas.com. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

Links to other websites

The site may contain links to external websites that we do not control. This policy does not apply to them, and we are not responsible for their privacy practices. We recommend that you review their privacy policies.

Children

The website is not directed at children, and we do not knowingly collect personal data from children. The MyBurgas Go web app and the MyBurgas GO mobile app are meant for people aged 13 and over.

Changes and notices

We reserve the right to change our Privacy Policy at any time. If we change the Privacy Policy, the revised policy will be published on the website, and we will update the "Last updated" date at the top of the Privacy Policy page.

Contact

If you have questions about this policy or the way we process your data, contact us by email at contact@myburgas.com.

Please contact us if you have any questions: contact@myburgas.com

Governing law

These terms are governed by the applicable Bulgarian legislation.