Personal data protection

Personal Data Protection Policy Bulgaria Air AD

Protecting your personal data is important to us. We would like to assure you that we process your personal data responsibly and in accordance with applicable law. This policy explains in which cases and why do we collect your personal information, how it will be used, the conditions under which it will be provided to third parties and how it will be stored.

What information do we collect about you?

When using this page, the following information may be requested, collected and processed:

1. Personal information which you need to provide or which you provide voluntarily. This is information about you that you provide by registering it through this page or by contacting us via telephone or e-mail, which includes:

• The information you provide in order to book a direct flight with Bulgaria Air aviation company, or for a direct shared flight of the aviation company operated by another carrier (code-share), or for a transfer flight which includes a combination of a direct flight of Bulgaria Air / another carrier and another / third carrier operating after the transfer point. This information (PNR) is as follows:
  Name, family name, date of birth (where applicable), e-mail address, passenger's telephone number, telephone number of a close friend or a relative;
• Advance Passenger Information (API). This is information about you that you provide by registering it through this page, or by contacting us via phone or e-mail, which includes: name, surname, family name (written in the ID you are traveling with), date of birth, gender, nationality, number of the ID that you are traveling with, ID validity, ID issuing country. Collecting pre-departure passenger information is required for a flight to / from certain countries. If you are traveling to the United States, you must also provide a residence address for the first night of your stay in the United States. In case you do not provide the above information, you will be denied transportation from / to certain destinations. Pursuant to Art. 42b(2) of the State Agency for National Security Act, promulgated in State Gazette, No. 15 of 23.02.2016, air carriers are obliged to transmit passengers’ booking data for all flights to, in or from the Republic of Bulgaria, that is, API and PNR data for all inbound, outbound and domestic flights;
• Information you provide in case your physical or medical condition requires additional services or specific in-flight assistance. This information includes details about health status such as information on chronic illnesses, surgical interventions, mobility restrictions or service without assistance. By providing us with information about your health, you agree that we process this information in order to determine whether your condition allows transport with our flights, as well as to provide additional services or specialized in-flight assistance. (See section: Passengers with Special Needs);
• Information you provide for marketing purposes. This information may include a name, an e-mail address;
• Information you provide during transactions to book and purchase services through this page. This information may include credit card details, an e-mail address.

2. Information we collect about you

When you use this page, we automatically collect the following information, which includes:
Details of your access to this page (including, but not limited to, traffic data and location data) and the resources that you access, the Internet Protocol (IP) address used to connect your device to the Internet, your login information, device type, browser type and version, time zone setting, browser plug-ins types and versions and also the operating system and the platform, that is collected and used for our internal research and statistical purposes as well as for improving user service and user experience on pages. We recognize that your privacy is important and we will protect the confidentiality of your personal information in accordance with our internal procedures and the legal requirements.

How do we use your data?

The legal bases applicable to data processing are as follows:

A. Necessary for performance of a contract

For the performance of the contract between you and Bulgaria Air, steps must be taken in order to enter into this contract. These will include:
To provide you with transport on the flights of Bulgaria Air or other services you have purchased through this site;
Let you know of changes to your booking or flight changes or to other services / products provided through this site;
Advance Passenger Information is required before departure for flights to and from certain destinations. It is possible that we refuse transport to a specific destination if we cannot provide your Advance Passenger Information to the authorities in advance.

B. Legitimate interests

In order to ensure that the content of this site is presented in the most effective way;
For our internal purposes, such as quality control, site performance, system administration and evaluation of the use of our site.
In order to improve the quality of service.
For the purpose of providing Advance Passenger Information to the appropriate authorities in countries, where it is necessary.
In order to avoid imposing fines on the relevant authorities.
In order to increase the security of Bulgaria Air flights.

C. Consent

We may use and process your personal data after you have agreed to provide it to us. This includes providing information and offers that may be of interest to you. Your data will only be used for marketing purposes by sending an e-mail, web / online, mail or SMS, about services / goods similar to those you have purchased. Bulgaria Air will not provide your personal data for marketing purposes to third parties.

D. Legal obligations

Advance Passenger Information is required before departure to and from certain destinations. The processing and sharing of your personal data with the border authorities of the relevant country is necessary in order to ensure that we meet the legal requirements in that country.

IP addresses and use of cookies and other analysis tools

We may collect data about your computer, including, where available, your IP address, operating system and browser type, to administer the system, and to report aggregate information to our advertisers.

Like many other pages, our page uses cookies. Cookies are a small part of the information sent to your device and stored on your hard disk so our site can recognize you when you visit it.

We use tools like Google Analytics (which includes Google Campaign Manager and Google AdWords) to measure traffic and improve the quality of our site.

Marketing

We may use your data, to provide you with marketing information that you request or that we believe may be of interest to you, targeted advertising through social media and platforms which are managed by other companies.

If you are a registered user, we may contact you by e-mail with products and services information similar to those we have previously provided to you, unless you have indicated that you do not want to receive any information from us.

You may withdraw your consent to us using your data at any time by following the unsubscribe link at the bottom of the e-mails sent or by sending a request in a free format to dpo@air.bg

Objections to the use of your personal data and automated solutions made for you

You have the right to request that your personal data is not used for marketing purposes. As stated above, you will be informed (before submitting your data) if your data is to be used for such purposes.

Withdraw your consent

Even if you initially agreed to us using your data for marketing purposes, you may exercise your right to terminate the subscription for such use at any time by writing to: Data Protection Division, Bulgaria Air AD, 1, Brussels Blvd., 1540 Sofia, or by e-mail: dpo@air.bg

Please note also that it is not possible to opt out of the receipt of the necessary operational / booking emails or messages from mobile phones, which provide you with important information concerning the booking of a seat or important information about your flight.

How do we keep your personal data secure?

Bulgaria Air is committed to ensuring the security and privacy of the personal data which customers provide. We take all possible safeguards for the provided personal data and against the risks involved in processing it in order to secure personal data and, in particular, to prevent damage or use by unauthorized third parties. In this way, your data remains protected when you buy tickets online.

We provide a secure online payment system using the latest technology.

With whom do we share your data?

When you book using this website, your personal data will be collected by Bulgaria Air AD.
When you book a direct shared flight of Bulgaria Air aviation company, operated by another carrier (code-share), or a transfer flight, which involves a combination of a direct flight of Bulgaria Air / other carrier operating after the transfer point, your personal data will also be transmitted to the other aviation companies involved in your transport.

Bulgaria Air sometimes needs to subcontract its services to other aviation companies. In such case, it will be necessary to pass on your personal data to the airline concerned to carry out your transport. Regardless of which partner airline will carry your transport in case of need, we would like to assure you that our internal security and privacy policy will be implemented.

When traveling to certain destinations abroad, it may be mandatory (according to local authorities requirements) to expose and process your personal data for the purposes of border control, security and the fight against terrorism or for any other purposes that are determined appropriate by the authorities. Some countries only allow a trip to their territory if the airline has previously provided information about the passengers to be transported.

We may disclose your personal data to our service providers, agents, subcontractors and other organizations for the purpose of providing services on our behalf. These third parties may include ground agents, hotels, or other third parties that provide us with services.

When we use third-party service providers, we only provide them with personal data necessary for the provision of their service and we have a contract requiring them to keep your data protected and not to use it except in accordance with our specific instructions.

Third parties handling payments with credit / debit cards

When you buy online products or services, credit / debit card payment is processed by a third party that specializes in the secure processing of credit / debit card transactions. If you have any questions about secure transactions, please contact us via the address provided at the end of this Privacy Policy.

Your rights

You have several personal data rights under the Data Protection Law. For certain rights, we may ask you to provide certain data to verify your identity. Except in rare cases, we will respond to your request within 30 days of receipt of the necessary data or, where possible, upon receipt of your request.

A. Access to your personal data

You may request a copy of your personal data which we store by sending us an e-mail or writing to us to the address at the end of this policy. It is possible that we refuse to provide you with a copy of your personal data, if it affects the interests of other persons or due to another legitimate reason to refuse access to this information. In some cases, we may impose a fee for providing access (example: every week you request a copy of your personal data that we store) and we will notify you if necessary.

Any request for access to personal data must be sent in writing to e-mail: dpo@air.bg 

In order to establish any personal data which we can store, we may need to request additional data from you, such as your booking reference number, date of departure, or the names of other passengers in your booking.

B. Complaint to the Commission for Personal Data Protection

You have the right to file a complaint with the Commission for Personal Data Protection if you are concerned about the way we processed your personal data. Please visit the CPDP website for more details https://www.cpdp.bg/

Contact us

If you have any questions regarding the processing of your personal data, please contact the data protection officer of Bulgaria Air AD. This person is also your contact point for requests for information, suggestions or complaints:

Data Protection Officer: Zdravka Dimitrova
Bulgaria Air JSC
E-mail: dpo@air.bg