Privacy Policy

Purposes and legal bases

We process your personal data only for the purposes below, each on the legal basis stated:

• Creating your account and signing you in with SocialID — performance of a contract (GDPR Art. 6(1)(b))
• Storing and displaying the content you post — performance of a contract (GDPR Art. 6(1)(b))
• Delivering chat and direct messages — performance of a contract (GDPR Art. 6(1)(b))
• Reviewing reports, blocking and content moderation — legitimate interests (GDPR Art. 6(1)(f))
• Answering support requests sent through the contact form — legitimate interests (GDPR Art. 6(1)(f))
• Cookie-free, aggregate visitor and speed measurement (web only) — loaded only if you allow it; you can switch it off via "Cookie preferences" at the bottom of the page — your consent (GDPR Art. 6(1)(a)) — you can withdraw it at any time
• Location for the nearby feed and venue distance (with device permission; raw GPS is not stored) — your consent (GDPR Art. 6(1)(a)) — you can withdraw it at any time
• Rate limiting, abuse prevention and service security — legitimate interests (GDPR Art. 6(1)(f))
• Tracking paid membership status (tier, validity) — performance of a contract (GDPR Art. 6(1)(b))
• Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect processing carried out before it.

How long we keep your data

Your account and content are kept for as long as your account is open; they are not deleted automatically after a fixed number of days. If you delete your SocialID account, your data here is deleted when SocialID sends its deletion signal. When you delete your account in the app, the following are deleted immediately and permanently: your posts, group and direct messages (including the conversations you are part of), event attendance and the events you host, check-ins, venue promotions, block records in both directions, your membership record, support requests linked to your account and your user record (SocialID number, display name, terms-acceptance time).

• Venues you added to the directory: not deleted with your account because they are part of the community directory; the ownership link is cleared. You can ask for their deletion via the contact page.
• Reports: not deleted with your account; kept unlinked from the reporter (anonymous) as a moderation record. There is no automatic deletion period.
• Support requests sent while signed out are not linked to an account, so they are not deleted with it and have no automatic deletion period; you can ask for their deletion via the contact page.

Technical logs and automatic backups kept by our hosting and database providers are retained for a limited period set by each provider's own retention cycle and are then deleted automatically. These copies are not used to provide the service.

International transfers

Our hosting provider, Vercel Inc. (United States), may process technical data such as your IP address when delivering the service. Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)) contained in the provider's data processing addendum: vercel.com/legal/dpa The providers below (all headquartered in the United States) also receive limited data when the relevant feature is used; for each, our basis for transfers outside the EEA is the European Commission's Standard Contractual Clauses in the provider's published data processing addendum (GDPR Art. 46(2)(c)):

• Vercel Web Analytics and Speed Insights (Vercel Inc., United States) — visitor and page-speed measurement, web only: technical data such as the page visited, referring address, browser/device type, country and page load times is collected without setting cookies and turned into aggregate statistics. The legal basis is your consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)): the tool is loaded only if you allow it in the banner at the bottom of the page, and you can withdraw consent at any time via the "Cookie preferences" link in the same place. The data may be transferred to the United States; the transfer mechanism is the European Commission's Standard Contractual Clauses in the provider's data processing addendum (GDPR Art. 46(2)(c)). vercel.com/legal/dpa
• Resend — report/notification e-mail: target type and ID, reason and note (without the reporter's identity) when forwarded to the operator by e-mail. The data is transferred to the United States; the transfer mechanism is the European Commission's Standard Contractual Clauses in the provider's data processing addendum (GDPR Art. 46(2)(c)). resend.com/legal/dpa
• Upstash — request rate limiting (abuse prevention): your IP address is held briefly as a counter key and expires automatically. upstash.com/static/trust/dpa.pdf
• Neon — database hosting (data is kept in an EU region; the provider is headquartered in the United States). Where access from outside the EEA may occur, the provider's data processing addendum (DPA) and Standard Contractual Clauses apply.

SocialID — a separate controller

Sign-in is provided by SocialID. SocialID's controller is SOSYAL TURİZM BİLİŞİM REKLAM TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ, a separate, independent controller from Burgasian, established in Türkiye. Your SocialID account data such as e-mail, password and phone number is processed under SocialID's responsibility; for its infrastructure providers and the database region, see SocialID's privacy policy: www.socialid.me/gizlilik. Burgasian receives only your SocialID number and display name from SocialID.

If you choose "Sign in with Apple" or "Sign in with Google" in the mobile app, Apple or Google verifies your identity under their own privacy policies; they are separate controllers. Your device passes the verification code or identity token it receives from Apple or Google to SocialID solely to sign you in; we never see the password of those accounts.

SocialID keeps a record of which platforms you have signed in to (including Burgasian) until you delete your SocialID account; deleting your account inside Burgasian does not remove this record — you can delete it from SocialID's account deletion page: www.socialid.me/hesap/sil.

Even if you delete your SocialID account, SocialID keeps your identity and sign-in records (name, e-mail, phone, platform memberships, sign-in dates and IP addresses) in an encrypted, offline archive for 5 years for legal claims in case of fraud or crime (GDPR Art. 17(3)(e), Art. 6(1)(f)); this archive is accessed only upon a legal request or an order from an authority. Recent sign-ins are shown in the SocialID panel for 90 days.

Children's data (GDPR Art. 8)

Burgasian is not offered to anyone under 18; this is our own minimum age of use (a product decision). On the age of digital consent, GDPR Art. 8 sets the EU-level default at 16; Member States may set a lower age in their own law, and Bulgaria, where the controller is established, has set it below 16 (ЗЗЛД Art. 25в). Because this service is not offered to anyone under 18, there is no parental-consent route and we do not knowingly collect personal data from anyone under 18.

If we learn that someone under 18 has opened an account, we delete the account and its data and do not collect extra data for that purpose. A parent or guardian who notices a child's account can write to us through our contact page; the request is handled without undue delay.

Whether providing data is required

You can view the event calendar, the venue directory and the nearby-venue list without an account. Member features such as posting to the feed, group and direct messages, check-ins, and adding venues or events require you to sign in with SocialID and accept the terms of use; processing your SocialID identity link and display name is a contractual requirement for providing that service — if you do not provide it, you cannot use those features. Sharing your location is not required: if you do not allow it you can pick a neighbourhood instead (except for check-ins). We do not ask you for data because of a statutory retention duty. In the contact form a reply e-mail is optional; without it your request is received but we cannot reply to you.

Automated decision-making and profiling

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, and we do not profile you; feed and venue ordering is not personalised. The only automated checks are technical: a banned-word filter (rejects publishing an inappropriate text) and request rate limiting. Report decisions are made by a person (the operator); you can contest a decision via the contact page.

Your rights and how to complain

Under the GDPR you have the following rights over your data:

• Access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17) and data portability (Art. 20).
• Restriction of processing (Art. 18): while you contest the accuracy of your data, if processing is unlawful, or while your objection is being assessed, your data is only stored and not otherwise used.
• Objection (Art. 21): you can object, on grounds relating to your particular situation, to processing based on legitimate interests (e.g. security, moderation); we then stop unless we demonstrate compelling legitimate grounds.
• Once signed in, you can download a copy of your data yourself with the download link on www.burgasian.com/me; the data linked to your account is delivered as a machine-readable JSON file (access, Art. 15; portability, Art. 20).
• You can send your requests via www.burgasian.com/iletisim; we reply within one month at the latest (GDPR Art. 12(3)).

Complaint to a supervisory authority (GDPR Art. 77): as the controller is established in Bulgaria, the lead authority is the Bulgarian Commission for Personal Data Protection — Комисия за защита на личните данни (КЗЛД), cpdp.bg. You may also complain to the data protection authority of the EU country where you live or work.

Users in Türkiye may also complain to the Turkish Personal Data Protection Board under Art. 14 of Law No. 6698 (KVKK) (www.kvkk.gov.tr).