Privacy Policy
Last updated: 10 October 2026
Data Controller
The data controller for this site is SMARTIA OOD (Burgas, Bulgaria). The controller is established in Bulgaria (EU) and is subject to the GDPR ((EU) 2016/679) and the Bulgarian Personal Data Protection Act (ЗЗЛД); to the extent services are offered to users located in Türkiye, Turkish Law No. 6698 (KVKK) also applies. For questions, use the Contact page.
What Data Is Processed?
toBulgaria is an informational site: no accounts are created while browsing and the site sets NO COOKIES on your device — including tracking and analytics; only if SocialID sign-in is used are two strictly necessary session cookies set (sid_oauth_state, sid_app_session; details in the Cookie Policy) (visitor measurement is done with a cookieless method — see the paragraph below). Your appearance preferences and the topics you mark as read or favourite stay only on your device (localStorage) and are never sent to our server; the full list is on the Cookie Policy page. The one exception is the waitlist form: the e-mail address you voluntarily provide (plus your name, message and area of interest, if you choose) is processed solely to announce the platform launch, on the basis of your explicit consent (GDPR Art. 6(1)(a)); it is never shared with third parties or used for advertising. To prevent abuse we do NOT store your raw IP address — only a daily-rotating, irreversible digest. The form uses Cloudflare Turnstile for bot/spam protection; only the minimum data required for the service to work is shared with this provider. Data is hosted on servers within the EU (Frankfurt).
Visitor measurement (Vercel Analytics and Speed Insights): We use the built-in measurement tools of our hosting provider, Vercel, to see how often pages are viewed and how quickly they load. These tools use no cookies, write nothing to your browser and do not track you across sites; they create no persistent identifier and no user profile. What is measured: the address of the page you viewed, the referring address, country, device type, operating system, browser, screen size and page-loading speed values. Your IP address is not stored; it is processed only momentarily to derive the country and a daily-rotating, irreversible hash — so visitor counts are approximate and you are not recognised the next day. The data is shown in aggregate, is not used for advertising and is not sold. The measurement sets no cookies, but it is only loaded if you allow it in the banner at the bottom of the page, and you can withdraw at any time via “Cookie preferences”. For this measurement our processor is Vercel Inc. (also our hosting provider); the measurement files are served from the same origin as toBulgaria.
The "Sign in" link in the header of toBulgaria pages starts sign-in with SocialID. Signing in is optional; it is not needed to browse the site. When sign-in starts, your browser is redirected to SocialID (socialid.me) and only two strictly necessary cookies are set (sid_oauth_state, sid_app_session; details in the Cookie Policy). No account record of yours is created on toBulgaria's servers: only your SocialID number and display name are received from SocialID and they are carried only in the signed session cookie, which is deleted when you sign out. SocialID is a separate, independent controller from toBulgaria (SOSYAL TURİZM BİLİŞİM REKLAM TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ; established in Türkiye); data of your account such as e-mail, password and phone number is processed under its responsibility — details: https://www.socialid.me/gizlilik.
Your Rights
For your GDPR rights of access, rectification and erasure, please reach us via the contact page. You may withdraw your consent at any time — a single e-mail is enough and your record is deleted. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP/КЗЛД). Retention: waitlist records are kept until the platform launch announcement and for no longer than 24 months; e-mail correspondence is deleted within a reasonable period after your request is resolved.
Purposes and legal bases
We process your personal data only for the purposes below, each on the legal basis stated:
- Bot/spam protection (Cloudflare Turnstile), rate limiting and service security — legitimate interests (GDPR Art. 6(1)(f))
- Cookie-free, aggregate visitor and speed measurement (web only) — loaded only if you allow it; you can switch it off via "Cookie preferences" at the bottom of the page — your consent (GDPR Art. 6(1)(a)) — you can withdraw it at any time
- Creating your waitlist sign-up and contacting you when the platform launches — your consent (GDPR Art. 6(1)(a)) — you can withdraw it at any time
- Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect processing carried out before it.
Whether providing data is required (GDPR Art. 13(2)(e)): You are under no legal or contractual obligation to provide personal data to use this service. If you fill in a form, only its required fields are necessary to send your request; if you do not provide them, that request cannot be sent. Technical data sent by your browser or device when you view pages (e.g. your IP address) is necessary to deliver the service technically.
International transfers
Our hosting provider, Vercel Inc. (United States), may process technical data such as your IP address when delivering the service. Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)) contained in the provider's data processing addendum: vercel.com/legal/dpa The providers below (all headquartered in the United States) also receive limited data when the relevant feature is used; for each, our basis for transfers outside the EEA is the European Commission's Standard Contractual Clauses in the provider's published data processing addendum (GDPR Art. 46(2)(c)):
- Vercel Web Analytics and Speed Insights (Vercel Inc., United States) — visitor and page-speed measurement, web only: technical data such as the page visited, referring address, browser/device type, country and page load times is collected without setting cookies and turned into aggregate statistics. The legal basis is your consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)): the tool is loaded only if you allow it in the banner at the bottom of the page, and you can withdraw consent at any time via the "Cookie preferences" link in the same place. The data may be transferred to the United States; the transfer mechanism is the European Commission's Standard Contractual Clauses in the provider's data processing addendum (GDPR Art. 46(2)(c)). vercel.com/legal/dpa
Children's data (GDPR Art. 8)
toBulgaria is not offered to anyone under 16; this is our own minimum age of use (a product decision). On the age of digital consent, GDPR Art. 8 sets the EU-level default at 16; Member States may set a lower age in their own law, and Bulgaria, where the controller is established, has set it below 16 (ЗЗЛД Art. 25в). Because this service is not offered to anyone under 16, there is no parental-consent route and we do not knowingly collect personal data from anyone under 16.
toBulgaria has no accounts. A parent or guardian who believes a child has sent us data can write to us through our contact page; we delete the data without undue delay.
Your rights and how to complain
Under the GDPR you have the following rights over your data:
- Access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17) and data portability (Art. 20).
- Restriction of processing (Art. 18): while you contest the accuracy of your data, if processing is unlawful, or while your objection is being assessed, your data is only stored and not otherwise used.
- Objection (Art. 21): you can object, on grounds relating to your particular situation, to processing based on legitimate interests (e.g. security, moderation); we then stop unless we demonstrate compelling legitimate grounds.
- You can send your requests via www.tobulgaria.org/iletisim; we reply within one month at the latest (GDPR Art. 12(3)).
Complaint to a supervisory authority (GDPR Art. 77): as the controller is established in Bulgaria, the lead authority is the Bulgarian Commission for Personal Data Protection — Комисия за защита на личните данни (КЗЛД), cpdp.bg. You may also complain to the data protection authority of the EU country where you live or work.
Users in Türkiye may also complain to the Turkish Personal Data Protection Board under Art. 14 of Law No. 6698 (KVKK) (www.kvkk.gov.tr).