Privacy

1. Who is responsible

This site is operated by: SMARTIA OOD (СМАРТИЯ ООД) · Burgas, Bulgaristan (AB). The data controller for personal data (GDPR "controller"): SMARTIA OOD (СМАРТИЯ ООД) · Burgas, Bulgaristan (AB). Contact channels are on the Contact page.

The data controller is established in the European Union (Bulgaria); processing is therefore subject to the EU General Data Protection Regulation (GDPR). To the extent that the service is provided to visitors located in Türkiye, Turkish Law No. 6698 (KVKK) also applies; the KVKK-specific notice is on the KVKK Information Notice page.

2. While browsing the site — without signing in

To view listings, filter them and open a listing's details you do not need to sign in, and these pages do not ask you for personal data. As long as you do not sign in and do not press the language button, no cookie is placed on your device (§8).

If you only want to read the site, none of the account data described here is processed. Section §2b below applies only if you sign in of your own accord.

2b. If you sign in with Social-ID (account)

When you want to publish a listing, open your profile page or report a piece of content, you sign in with your Social-ID account. Signing in is not mandatory: it is required only if you want to perform these actions. Burgaz.bg does not store passwords and does not see them — authentication takes place at Social-ID, and we only receive its result.

The fields Social-ID sends us (authorisation scope profile social_number) are only the following: your account identifier, your Social-ID number and, if present, your display name. Your e-mail address, password, phone number, date of birth and profile photo are not transferred to us.

What Burgaz.bg keeps in its own database after you sign in:

Your Social-ID number and display name (at most 80 characters) together with your language preference — to match your account with your listings.
The moment you accepted the terms of use (date and time). To create content you must accept the terms once; this stamp is kept as an audit trail.
Whether your account is active (if it has been suspended for a rule violation) and, if present, an administrator privilege flag.
The account's creation and last update time.

Your session is carried by two cookies — a signed session cookie lasting 30 days and a security cookie that lives for 10 minutes during sign-in. Both are HttpOnly, Secure, SameSite=Lax; the session cookie contains only your account identifier, your Social-ID number and your display name, in signed form — it carries no password or e-mail. The full list and durations are in the Cookie Policy and in §8.

Legal basis: opening your account and providing the service you requested (publishing listings, profile) — GDPR Art. 6(1)(b); as regards suspension, administrator privileges and the terms-acceptance stamp, our legitimate interest in preventing abuse and meeting our legal obligations — GDPR Art. 6(1)(f).

2c. If you publish a listing (user-generated content)

When you submit a listing, what you write is what gets stored: the listing title and description, the transaction type (for sale/for rent), property type, price and currency, area, number of rooms, city and district, together with the photos you upload. This content is linked to your account and becomes publicly visible once published — do not write your own phone number, address or identity details into the listing text; there is no need to.

Your photos are stored after processing: the file's EXIF data is removed entirely — meaning the GPS coordinates, device model and capture date inside the photo do not leak into the listing. The long edge is scaled down to 1600 pixels and the file is kept as JPEG/PNG in a cloud file store. The raw file you upload is not stored as-is.

Your location is not requested. The site does not access your device's location; it only records the city and district of the property as you write them.

Your listing does not go live directly: it first enters an approval queue and is seen by an administrator. The text you write passes through an automatic profanity/inappropriate-language filter. To limit abuse, upload and submission requests are counted per account. Legal basis: GDPR Art. 6(1)(b) (provision of the service) and Art. 6(1)(f) (platform safety).

2d. Reporting and blocking

When you report a listing or a user, the report's target, reason, your note if any, the time and your account identifier are written to the moderation record; administrators review it within 24 hours at the latest. When you block a user, the block pair (who blocked whom) is recorded; its visible effect is that that user's listings are no longer shown to you. Legal basis: GDPR Art. 6(1)(f) (platform safety) and Art. 6(1)(c) (obligations arising from store/platform rules).

3. Enquiry form — a data collection point that does not require sign-in

When you yourself submit the Leave an enquiry form — which you can use without signing in — the following fields are processed. This form is not linked to your account: even if you are signed in, your Social-ID number is not stored in the enquiry record.

Full name (required), e-mail and phone (both optional — you may leave them empty, but if you provide neither, we cannot get back to you).
Your message and the site language you were using when filling in the form. If you started the enquiry from a listing page, the relevant listing number is prepended to the message.
Your IP address. Let us be clear: the IP address is recorded in raw form, it is not hashed and not pseudonymised. Its purpose is to allow fake/bulk enquiry submissions to be investigated afterwards.
The enquiry's originating surface (web), its status (such as new / seen / answered) and the submission time.

Legal basis: answering your enquiry and contacting you about the property you are interested in — GDPR Art. 6(1)(b) (pre-contractual steps taken at your request). As regards the IP record and the enquiry's status: GDPR Art. 6(1)(f) (legitimate interest in preventing abuse).

The form does not ask for sensitive data. Please do not write identity numbers, health information or similar sensitive details into the message — they are not needed.

4. Automatic request limit

To prevent the form from being abused by automated tools, requests coming from your IP address are counted within a 60-second window. This counter is not written to the site's database: it is kept in a temporary cache and resets by itself when the window ends (GDPR Art. 6(1)(f)).

5. Who receives the data

Data is not sold and is not transferred to third parties for marketing. For the site to function, the following technical services are used in the capacity of processor within the meaning of GDPR Art. 28:

Hosting provider — the site is configured to be served in the EU region (Frankfurt).
Managed database provider — the database is hosted within the EU (Frankfurt).
File (image) store — only for listing photos; it is our hosting provider's own storage service, not a separate company.
E-mail delivery service — only to deliver a notification when a new enquiry arrives. This notification is sent only if configured; when delivery is disabled, the enquiry is written to the database only.
Temporary cache service — only for the request counter in §4; it keeps no permanent records.

Social-ID (the identity provider) stands apart: when you sign in, your browser goes to Social-ID, you verify your identity there, and Social-ID returns to us the three fields listed in §2b. With respect to the data of your own Social-ID account, Social-ID is an independent controller subject to its own privacy policy; Burgaz.bg only tells it which site is requesting the sign-in. If you want to close your Social-ID account entirely, you do so through Social-ID; deleting your Burgaz account does not delete your Social-ID account (§6).

These providers process data only on our instructions and to deliver the service; they may not use it for their own purposes. The visitor measurement described in §5b below is also run by the same hosting provider (Vercel), and the store for listing photos is with the same provider — in other words, the five items above are not five separate companies. You can request the current provider list through the channel on the Contact page.

The site uses no advertising network or third-party tracking pixel. No third-party measurement or advertising tool such as Google Analytics or the Meta pixel is installed on the site; the only measurement we use is our hosting provider's cookie-free visitor measurement (§5b). No payments are taken; no payment/invoice data is processed. Your data is not sent to artificial-intelligence models and is not used for model training.

5b. Visitor measurement (Vercel Analytics and Speed Insights)

To measure how many times the site is viewed and how fast pages open, we use the measurement tools of our hosting provider, Vercel. These tools use no cookies, write nothing to your browser and do not track you across sites; they create no persistent identifier or user profile. The measurement scripts come from the site's own domain, not from an external server.

Data measured: the address of the page viewed, the address you arrived from (referrer), country, device type, operating system, browser, screen size and page-load speed values. Your IP address is not stored; it is processed only momentarily to derive the country and to produce an irreversible digest that changes daily — which is why visitor counts are approximate and the system does not recognise you the next day.

The data is shown in aggregate (statistical) form, is not used for advertising and is not sold. Legal basis: our legitimate interest in operating and improving the service (GDPR Art. 6(1)(f)). Because no cookies are used, this measurement does not require showing you a cookie consent banner.

6. How long data is kept

Your enquiry record is kept until your enquiry is concluded and afterwards only for as long as necessary for abuse review and for tracing a possible dispute. The criteria determining this period: whether the enquiry is still open, suspicion of repeated/automated submission, and any statutory retention obligation.

No automatic deletion job is running — deletion is done manually upon request. When you ask for your enquiry to be deleted, the record is deleted within 30 days. Rather than hiding this, we state it openly so you know what to expect.

Account and listing data: your account remains until you delete it. Your listings remain until you delete or archive them; listings removed from publication stay in your record as an audit trail.

You can delete your account yourself — no need to wait: when you press the delete button in the My account section of your account page, the following are deleted immediately: your listings and their translations, photo records and feature links; enquiries received on your listings; enquiries you left; your seller verification record, if any; blocks you gave and received; all reports about you (with no distinction between open, closed or resolved); and your account row itself. For reports you filed, the moderation record remains but the link to your identity is severed — who reported is no longer visible.

Rather than hiding it, we state it openly: after deletion, the photo files you uploaded are not deleted from the cloud store immediately. Because their addresses are removed from the database, they become unreachable from the site; if you want the files themselves deleted, request it through the channel in §7 and it will be done within 30 days.

Deleting your Burgaz account does not delete your Social-ID account — Social-ID is a central identity and is also used on other sites; if you want to close it, you do so through Social-ID.

Your session cookie expires by itself after at most 30 days, and your language preference cookie after at most 1 year; when you sign out, the session cookie is deleted immediately, and you can clear all of them from your browser settings at any time.

7. Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing (GDPR Arts. 15–22). Your requests are resolved within 30 days. Request channel:

If you have a signed-in account, you can exercise your right to erasure yourself, without waiting: the delete button on the My account page immediately deletes your account and the data listed in §6. For your other rights, write via the channel below:

Complaint authority: the Bulgarian Commission for Personal Data Protection (КЗЛД) or the data protection authority of the EU country where you reside. If you reside in Türkiye, you may also apply to the Turkish Personal Data Protection Board.

8. Cookies

No advertising cookies, tracking cookies or third-party cookies are used. That is why no cookie consent banner is shown to you. All cookies used — all three are either strictly necessary (technical) or a preference cookie set by your own action — are listed below; the detailed table is on the Cookie Policy page:

Session (sid_app_session) — set only when you sign in, and keeps your session open. It carries only your account identifier, your Social-ID number and your display name, in signed form; it carries no password or e-mail. Duration: 30 days, HttpOnly, Secure, SameSite=Lax. Deleted immediately when you sign out.
Sign-in security (sid_oauth_state) — a single-use value set when the sign-in flow starts; it protects against cross-site request forgery (CSRF) and is deleted as soon as sign-in completes. Duration: 10 minutes, HttpOnly.
Language preference (locale) — set only when you press the language button in the top bar, and carries the language you chose (tr / bg / en). Duration: 1 year, SameSite=Lax. It does not reveal your identity and does not track you across sites.

If you block the strictly necessary cookies, you can continue to read the site, but you cannot sign in (you cannot publish listings or open your profile).

Your appearance (light/dark theme), text size and colour preferences are kept not in a cookie but in your browser's local storage (localStorage) and are never sent to the server. You can clear them from your browser settings; the only effect is that your preferences return to the defaults.

The visitor measurement in §5b also works cookie-free: it adds no new cookie to the list above and does not use your browser's local storage.