Privacy and cookie policy
Last updated: 30 September 2026
Who processes your data
The controller of your personal data is [to be confirmed], company ID (ЕИК) [to be confirmed], with its registered office at 56 Solun St, Borovo, Sofia, Bulgaria. The practice is at 56 Solun St, Borovo, Sofia, Bulgaria.
- Email for data protection questions
- drlyubova@gmail.com
- Phone
- +359 885 811 892
We have not appointed a data protection officer, as Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) does not require one for us. For any question about your personal data, write to us or call us using the details above.
What this policy covers
This policy describes how we process the data of visitors to this website and of people who send an appointment request through it.
It does not cover the medical records we keep during examination and treatment (outpatient records, X-rays, informed consent forms and so on). Those are processed under the Bulgarian Health Act and Medical Establishments Act, and you will receive separate information about them at the practice. Requests from the website are stored separately from medical records.
What data we process, why, and on what legal basis
Appointment requests
When you send a request, we receive your name, phone number, email address (optional), the service you are interested in (optional), your preferred time, a message (optional), the language of the page and the time of sending. We use them to contact you and arrange an appointment.
Legal basis: Article 6(1)(b) GDPR, taking steps at your request before providing dental care. We need your name and phone number to contact you. If you prefer not to give them online, you can call us instead.
Please do not describe health problems in detail in the message. If you do share information about your health, we use it only to prepare for your visit, under Article 9(2)(h) and 9(3) GDPR, by a dentist bound by professional secrecy.
Emails about your request
If you give an email address, we send a confirmation that we received your request, messages when your appointment changes, and a reminder the day before it. The legal basis is the same as for the request.
Protecting the form from abuse
To limit spam, we count submission attempts by IP address and phone number. We keep them only as irreversible cryptographic fingerprints (HMAC), from which the address and number cannot be recovered, and delete them after 24 hours. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in protecting the form and the service.
Technical data when you visit
Our hosting provider processes your IP address, the time of the request, the page opened and browser details to deliver the website and protect it from attacks. These records are kept briefly, according to the provider's settings, and we do not use them to identify you. Legal basis: Article 6(1)(f) GDPR.
Calls and emails
When you call or write to us, we use your details to reply. Legal basis: Article 6(1)(b) and (f) GDPR.
Visit statistics
Only if you agree, we use Google Analytics 4 to understand which pages are read and how the site is used. It processes a pseudonymous identifier, the pages visited, the time of the visit, the type of device and browser, and your approximate location (country, city). Google Analytics 4 does not store IP addresses, and advertising features are turned off. Legal basis: your consent under Article 6(1)(a) GDPR and Article 4a of the Bulgarian Electronic Communications Act. You can withdraw your consent at any time under “Cookie settings”; this does not affect the lawfulness of processing before the withdrawal.
Map and links to other websites
The Google map loads only when you select “Show the map”. Google then receives your IP address and data about the visit and may set its own cookies. Google processes this data as an independent controller, under its privacy policy (opens in a new tab). Links to Facebook, Instagram and Google open other websites, which apply their own rules.
Who receives your data
Only practice staff who handle requests can see them, through personal accounts. We use the following providers, who process data on our behalf, on our instructions and under a contract in line with Article 28 GDPR:
| Provider | Service | Where the data is processed |
|---|---|---|
| Vercel Inc. | Website hosting | United States and a global server network |
| Supabase Inc. | Database holding the requests | European Union (Frankfurt, Germany) |
| Resend | Sending emails about your request | United States |
| Google Ireland Limited | Visit statistics, only with consent | EU and United States |
We give data to public authorities (such as a court, the Regional Health Inspectorate or the Commission for Personal Data Protection) only when the law requires it. We do not sell data or use it for advertising.
Transfers outside the European Union
Vercel and Resend, and companies in the Supabase and Google groups, are based in the United States. Transfers to them rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (for companies certified under it) or on standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). You can ask us for information about these safeguards.
How long we keep data
| Data | Period |
|---|---|
| Appointment requests and the emails about them | 12 months after the request was last updated, or after the appointment if that is later. They are then deleted automatically. |
| Fingerprints of IP addresses and phone numbers (abuse protection) | 24 hours |
| Phone and email correspondence | Up to 12 months, unless it becomes part of the medical records |
| Statistics in Google Analytics | 14 months |
| Your cookie choice | 6 months |
Your rights
Under the GDPR you have the right to:
- be informed about and access your data (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- have processing restricted (Article 18);
- receive your data in a structured, machine-readable format (Article 20);
- object to processing based on legitimate interest (Article 21);
- withdraw your consent at any time where processing is based on consent (Article 7(3)).
We do not make decisions based solely on automated processing, including profiling.
To exercise your rights, write to drlyubova@gmail.com or call +359 885 811 892. We reply free of charge within one month, which may be extended by two further months for complex requests. We may ask you to confirm your identity so that we do not give your data to someone else.
Right to complain
If you believe we process your data unlawfully, you can complain to the Bulgarian Commission for Personal Data Protection:
- Address
- 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria
- kzld@cpdp.bg
You can also go to court under Article 39 of the Bulgarian Personal Data Protection Act. We would appreciate the chance to resolve the matter with you first.
Children
The appointment form is meant for adults. For a patient under 18, a parent or guardian sends the request.
Security
The website is served only over an encrypted connection (HTTPS). Access to requests is limited to the staff who handle them, through personal accounts with permissions based on their role. Requests are stored separately from medical records and deleted automatically when the retention period ends.
Changes to this policy
We will update this policy when we change how we process data. The date of the last change is shown at the top of the page.