Customer support

Personal Data Protection Policy of Bulgaria Air JSC

This Privacy Policy (“Policy”) is intended to inform you about how and why we collect, process, disclose to third parties, and store your personal data.

“Bulgaria Air”JSC(“the Airline”), as data controller, collects and processes your personal data for the purpose of providing air carriage services, and in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679), the Personal Data Protection Act of the Republic of Bulgaria and applicable law.

What personal data do we collect ?

The Airlinemay collect and process the following categories of personal data:

Personal data provided when you make a booking (regardless of the method chosen to do so, e.g. our website or mobile app), or by corresponding with us by phone or email, which includes:

The information you provide to book a seat on a direct Airline flight, or on a direct Airline codeshare flight operated by another air carrier (codeshare), or on a transfer flight that includes a combination of a direct Airline flight/another carrier and another/third carrier operating after the transfer point (PNR data). This information is as follows: given name, middle name (if any), surname(s), date of birth, e-mail address, telephone number of passenger, telephone number of relative (where applicable);

When adding other passengers to your booking account or when booking a flight for others, we also collect their personal data. In these cases, you ensure that these individuals are notified and consent to us collecting and processing their personal data, that they are aware of how we use it and how they can exercise their rights.

In the case of unaccompanied minors, we collect the personal data of the parent(s) and/or legal guardian, as well as those responsible for sending the child to the airport on departure and for meeting them at the airport on arrival.

Advance Passenger Information (API data). This is information that includes: given name, middle name (if any), surname(s) (as they appear on the identity document you are travelling with), date of birth, gender, nationality, number of the identity document you are travelling with, expiry date of the identity document, country, issuer of the identity document. The collection of passenger information prior to departure is a requirement for flights to/from certain countries. For example: If you do not provide the above information, you will be refused carriage to/from certain destinations.
The information you provide under the frequent flyer programFLY MORE. When you fill in the registration form to join the FLY MORE loyalty program, we require the following information: given name, middle name (if any), surname(s); date of birth; gender; type and number of ID; nationality; address; telephone number, email address; place of work, job title, professional field; Other information, such as preferred mode and language of communication. You may read FLY MORE’s Privacy Policy for more information about the personal information we collect in connection with your membership in the program.
The information you provide in the event that your physical or medical condition requires additional services to be performed or certain specialised assistance to be provided during the flight. This information includes details regarding your health status such as information about chronic illnesses, surgical interventions, mobility restrictions or unassisted handling. By providing us with information about your health, you consent to us processing this information for the purpose of determining how the transport service is provided and for the purpose of providing additional services or specialist assistance. Detailed information can be found in the section Passengers with special needs;
Information you provide for marketing purposes. This information may include name, email address;
Information you provide during transactions for the purpose of booking and purchasing services through this page. This information may include credit card details, e-mail address.

When you use our website or mobile app we automatically collect the following information, which includes:

Details about your access to our website or mobile application (including, but not limited to, traffic data and location data) and the resources you access, the Internet Protocol (IP) address used to connect your device to the Internet, your login information, device type, browser type and version, time zone settings, browser plug-in types and versions, and operating system and platform, which is collected and used for our internal research and statistical purposes, as well as to improve user.

Why do we process your data?

The processing is necessary to take steps at your request before entering into a contract

In certain cases, the provision of personal data may also be based on your prior consent. For example, when you consult or book tickets through our website, we may ask your permission to send you specific information electronically about your visit to the site and your interest, even if you did not ultimately make any purchases during that visit.

The processing is necessary for the performance of a contract between you and the Airline

This includes, for example:

Making a reservation, purchasing an Airline ticket, checking in for a flight, providing you with air transportation or other services you have purchased;
To notify you of changes to your booking or changes to flights or other services/products;
Provide advance and additional information for flights to and from certain destinations.

Processing is necessary for the purposes of the legitimate interests of the controller or of a third party

In order to provide the services we offer in the most efficient manner;
For quality control, administration, improvement and evaluation of the services provided, including through our website and mobile app;
In order to improve the quality of service;
In order to enhance the safety of the Airline's flights.

The processing is based on your consent

We may use and process your personal data based on your consent.

For example, providing you with information and offers that may be of interest to you. Your data may be used for marketing purposes by sending you an email, web/online, post or SMS, regarding services/goods similar to those you have purchased. The Airline will not provide your personal data to third parties for marketing purposes.

The processing is necessary to comply with a legal obligation

To manage immigration procedures and/or entry into or exit from a country, to ensure your safety and to comply with any other legal requirements applicable to the Airline as an air carrier. In certain cases, we will be required or obliged to communicate your details in advance to local or international authorities.
For other management and administrative purposes;
For the proper management of emergencies, disasters and force majeure in general, we may need to share your data with various individuals or entities, authorities or organizations whose cooperation is essential to the Airline in these circumstances.

IP addresses and use of cookies and other analytics tools

We may collect information about your devices, including, where available, your IP address, operating system and browser type, for system administration and to communicate aggregated information to our advertisers.

When you use our website or our mobile app, we collect information through cookies and similar technologies. For more information, please see our Cookie Policy.

We use tools such as Google Analytics (which includes "Google Campaign Manager" and "Google Adwords") to measure traffic and improve the quality of our site.

Marketing

We may use your data to provide you with marketing information that you request or that we think may be of interest to you, targeted advertising through social media and platforms operated by other companies.

If you are a registered user, we may contact you by email with information about products and services that are similar to those we have previously provided to you, unless you have indicated that you do not want to receive information from us.

Objections to the use of your personal information and automated decisions made about you

You have the right to request that your personal data is not used for marketing purposes. As stated above, you will be informed (before you provide your data) if your data is going to be used for such purposes.

Withdraw your consent

Even if you have initially consented to your data being used for marketing purposes, you may subsequently exercise your right to cancel your subscription to such use at any time, in writing to: dpo@air.bg

Please also note that it is not possible for you to opt-out of receiving necessary operational/booking emails or mobile phone messages that provide you with important information about booking a seat or important information about your flight.

How do we keep your personal data secure?

The Airlineensures the security and confidentiality of your personal data by implementing all appropriate technical and organisational precautions to prevent risks associated with its processing, in order to protect its security and in particular to prevent any accidental or unlawful destruction, any type of loss, alteration, disclosure, intrusion or unauthorised access to it. We provide a secure payment system, including online, using the latest technology and complying with international card payment standards.

Who do we share your data with?

Depending on your booking and the flights that make up your journey, your data may also be passed to other Airlines operating some of those flights, as well as rail or ground transport providers. Sharing may be necessary to make your journey possible, especially in the event of unexpected difficulties and to ensure the safety and security of all flights.

When travelling to certain destinations abroad, we may be required (as requested by local authorities) to disclose and process your personal data for border control, security and counter-terrorism purposes or for any other purposes they determine to be appropriate. Some countries only allow travel to their territory if the Airline has previously provided information about the passengers to be carried.

We may disclose your personal data to our service providers, agents, contractors and other organisations for the purpose of providing services on our behalf. These third parties may include ground handling agents, hotels, or other third parties who provide services to us. When we use the services of third parties, we only provide them with personal information necessary to provide their service, and we have a contract that requires them to keep your information secure and not to use it except in accordance with our specific instructions.

Public authorities

In accordance with applicable Bulgarian and international laws and regulations, we may be required to collect and share with Bulgarian public authorities (customs, immigration, police, etc.) data to establish your identity (e.g. passport information), as well as information about your booking and travel, also information about the countries from or to which you are travelling, for the purposes of border control, entry into the country or combating terrorism or other serious crime.

Pursuant to Article 42b(2) of the State Agency for National Security Act promulgated in State Gazette No. 15 of 23 February 2016, air carriers are required to transmit passenger reservation data for all flights to, in or from the Republic of Bulgaria, namely this means API and PNR data for all inbound, outbound and domestic flights.

Third parties processing credit/debit card payments

In processing your payments and refunds for your purchases and bookings, we may pass certain data to third parties such as banks, financial institutions or payment service providers. In many cases, these payment service providers also perform fraud checks. These third parties have their own privacy policies that apply to how they use your personal data.

Your rights

Under applicable regulations, you have rights that we should inform you about regarding your data.

Right of access

You have the right to request confirmation that we are processing personal data relating to you and, if so, to obtain a copy of that data.

We may refuse to provide you with a copy of your personal information if it affects the interests of others or if we have any other lawful reason to refuse you access to that information. In some cases, we may charge a fee for providing access (example: you request a copy of your personal information we hold on a weekly basis) and we will notify you properly if this is necessary.

Right to rectification

You have the right to ask for your personal data to be corrected if you find that it is inaccurate. In light of the purposes of the relevant data processing, you may also request that it be supplemented, which may include providing additional data.

Right to erasure(‘right to be forgotten’)

You have the right to request the erasure of your personal data. This right can only be exercised in certain cases where one of the grounds set out in Article 17 of Regulation (EU) 2016/679 applies.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data. This means that if we do store this data, we will mark it for the purpose of temporarily suspending its processing. This right can be exercised on the grounds set out in Article 18 of Regulation (EU) 2016/679, in particular when challenging the accuracy of your personal data. Said right does not lead to the deletion of the data, and we are obliged to notify you before we lift the respective processing restriction.

Right to data portability

You have the right to request the provision of your personal data obtained in direct communication with us in a structured and readable format if the processing is automated and based on data collected as a result of your consent or the performance of your contract with the Airline. Where appropriate and technically feasible, you may also request the transfer of the relevant data directly to another data controller.

Right to object

You have the right to object to the processing of your personal data. This means that you can ask us to stop processing your personal data. For example, you can object to the processing of your personal data for direct marketing purposes. If you choose to exercise this right, we will stop processing your personal data for these purposes.

You may exercise the above rights by submitting an application in writing to the following e-mail address: dpo@air.bg

In order to establish any personal data we may hold, we may need to request additional information from you, such as the booking reference number, departure date or the names of other passengers on your booking.

Withdrawal of your consent

You may withdraw your consent at any time by following the specific instructions regarding the processing for which you have provided your consent.

For how long is your data stored?

We undertake to keep your personal data for no longer than is necessary for the purposes for which it is processed.

The length of retention is determined by the purposes for which we process the data, taking into account any applicable legal provisions requiring a specific retention period for certain categories of data. Thereafter, the relevant data is routinely deleted.

International data transfers

For the purposes set out in this Policy, we may transfer your personal data (name, surname, ID number, travel details, etc.) to recipients located in countries other than your country of residence, and in particular outside the European Union and the European Economic Area.

The Airline shall take necessary and appropriate measures, in accordance with applicable law, to ensure the protection of any personal data that is the subject of an international transfer.

Questions, comments or complaints

Please do not hesitate to contact us with any questions or comments regarding this Privacy Policy. You may also file a complaint with the Privacy Commission. For more information, visit the CPPD website at https://www.cpdp.bg/

Contact us

If you have any further questions about this Policy or the processing of your personal data, please contact the Airline's Privacy Officer at the following email address:dpo@air.bg

Amendments

This Policy shall come into force and apply from 8 July 2025. It supersedes any previous policy. The Airline reserves the right to change this Policy from time to time. Any changes shall be posted on our website. We encourage you to visit it regularly.

Personal data protection