Privacy policy

Effective from 11 October 2026.

This policy explains what personal data we process, what we use it for, on what legal basis, who we share it with and how long we keep it. It applies to visitors to the bluecrossbg.com website, to clients of Blue Cross Veterinary Clinic in Sofia and Blagoevgrad, and to veterinarians who refer patients to us.

Controller and contact details

The controller of your personal data is SIN KRUST OOD (СИН КРЪСТ ООД), UIC 175072858, VAT number BG175072858, entered in the Commercial Register and the Register of Non-Profit Legal Entities (Търговски регистър и регистър на ЮЛНЦ) kept by the Registry Agency (Агенция по вписванията). The veterinary activities of the clinics are supervised by the Bulgarian Food Safety Agency, BFSA (Българска агенция по безопасност на храните, БАБХ).

• Registered office, management address and correspondence address: 1 Chereshova Gradina St., Detski Grad housing estate, Pancharevo district, 1137 Sofia.
• Sofia clinic: at the same address; tel. 0898 361 903; info@bluecrossbg.com.
• Blagoevgrad clinic: 2 Peyo K. Yavorov Blvd., 2704 Blagoevgrad; tel. 0899 711 722; blagoevgrad@bluecrossbg.com.

We have not appointed a data protection officer, as we are not required to do so. Please send questions and requests concerning your personal data to info@bluecrossbg.com or by post to the address of the Sofia clinic, or hand them in at either of our clinics.

Visiting the website

The website is for information only. You cannot register, submit forms, make payments or book appointments on it. Appointments are booked by phone only, and the “Book appointment” button shows the clinics’ phone numbers. When you browse the website, only the following data is processed:

• Server logs – each time a page is loaded, the server records the IP address, the date and time, the page requested and the browser type. The website is hosted on a server of SuperHosting.BG OOD (СуперХостинг.БГ ООД) in Sofia. The hosting provider keeps the logs in order to protect the website and fix technical problems.
• Statistics – Google Analytics 4 is loaded only if you click “Accept” in the cookie bar (see the section “Statistics and cookies”).
• Maps – the embedded Google Maps on the “Contact” page and on the pages of the two clinics load only after you click “Open the map”. Your browser then connects to Google’s servers and sends them your IP address and the address of the page. Google may also set cookies under its own policies (policies.google.com/privacy).
• External links – our profiles on Facebook, Instagram, YouTube and TikTok, the Google reviews of the clinic and the diagnostic imaging results portal pacs.bluecrossbg.com open through ordinary links. The article share buttons open the service you choose or your device’s share menu. The website does not load any content from these services, and they receive no data about you until you open them. From then on, the rules of the service concerned apply.

Statistics and cookies

The website itself does not set any cookies. Cookies on the bluecrossbg.com domain are set only by Google Analytics 4 (Google Ireland Ltd.), and only after you click “Accept” in the cookie bar. Until you accept, no analytics tool is loaded and no data is sent to Google Analytics. The website uses Google Consent Mode v2. Until you accept, all consent types are treated as denied, and “Accept” enables statistics only.

If you accept, Google Analytics sets the _ga and _ga_* cookies, which last up to 2 years. They contain a random identifier that Google uses to tell devices apart. This gives us aggregated statistics on which pages are opened, which websites visitors come from, what devices and browsers they use and their approximate location (country and city, determined from the IP address). We also see which buttons are clicked – for example the call, email, map or share buttons. Google Analytics does not store IP addresses. Advertising features remain switched off even after you accept. We do not link the statistics to your data as a client of the clinic.

Your choice is stored in your browser (localStorage, key “sk-consent”) and kept for 12 months, after which the bar is shown again. This record is not sent to us or to anyone else. You can change your choice at any time using the “Cookies” button at the bottom of every page. To withdraw your consent, click “Cookies” and then “Decline”. Google Analytics stops at once and the _ga and _ga_* cookies are deleted from your browser. The full list of cookies and browser storage entries is on the “Cookie policy” page.

Reviews on the website

On the website we show verbatim quotes from Google reviews of the clinic, together with the name under which the author published them and a copy of their profile picture. The copy is stored with the website and is not loaded from Google. Before we show a review, we check whether its author has been a client of the clinic. If you are the author of such a review and do not want us to show it, write to us at info@bluecrossbg.com and we will remove the text, the name and the picture from the website.

Clients of our clinics

• Calls and appointment booking – when you call us, we see the number you are calling from. We do not record calls. From what you tell us, we note down only what we need to book your appointment and prepare for the examination or treatment – usually your name, phone number, the species of the animal and the reason for the visit.
• Owner details – name, phone number, email address and, where necessary, address, for example for a home visit or where the law requires it for the treatment records.
• Animal details – species, breed, name, age, microchip number and passport number.
• Veterinary medical records – the outpatient register, treatment orders, prescriptions and test results, including diagnostic imaging results. We keep them in accordance with the Veterinary Activities Act (Закон за ветеринарномедицинската дейност, ЗВМД) and Ordinance No. 42 of 12 December 2008 (Наредба № 42 от 12 декември 2008 г.). We enter some of the data, for example on the microchip, the passport and rabies vaccination of dogs, in the BFSA Integrated Information System (Интегрирана информационна система на БАБХ), as required by law.
• Informed consent to surgery – before an operation, the owner signs a document stating their name, the diagnosis, the prognosis and the name of the surgeon. This is required by Ordinance No. 42 of 2008.
• Payments – when you pay, we issue a till receipt and, on request, an invoice containing the details required by law. If you pay by card, the card details are processed by the bank that services the terminal, and the clinic does not receive the full card number.
• Complaints and disputes – if you make a complaint or a dispute arises, we process the data needed to deal with it and to protect our rights. We reply to complaints within 14 days of receiving them.

We do not send marketing emails.

Referring veterinarians

When a veterinarian refers a patient to us with a referral form (the form can be downloaded as a PDF from the “For colleagues” page) or writes to us at office@bluecrossbg.com, we process their name, the veterinary practice they work at, their phone number and email address, as well as the owner and animal details given in the referral. We may provide the referring veterinarian with the results of the tests ordered, including through the pacs.bluecrossbg.com portal. The portal is a separate system with a user login, which we maintain together with an external company. We are responsible for the results we upload to it, and use of the portal is also subject to the terms published on it.

Where we get the data from

We receive most of the data directly from you. Some of it comes from other sources:

• from the person who brings the animal in, if they are not the owner – for example a family member;
• from the veterinarian who referred you to us – the data in the referral;
• from laboratories and clinics to which we have sent a sample or a patient – the results;
• from the clinic’s public Google profile – the reviews we show on the website.

Legal bases

We process data on the grounds set out in Article 6(1) of Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR):

• Consent (point (a)) – statistics with Google Analytics 4, in conjunction with Article 4a(1) of the Electronic Commerce Act (Закон за електронната търговия).
• Contract, or steps taken at your request before entering into a contract (point (b)) – booking appointments, examinations, treatment and the clinics’ other services, and replies to enquiries.
• Legal obligation (point (c)) – keeping veterinary medical records, reporting to the BFSA and entering data in the BFSA Integrated Information System under the Veterinary Activities Act and Ordinance No. 42 of 2008; issuing and keeping accounting documents under the Accountancy Act (Закон за счетоводството), the Value Added Tax Act (Закон за данъка върху добавената стойност) and the Tax and Social Insurance Procedure Code (Данъчно-осигурителен процесуален кодекс); replying to requests from public authorities.
• Legitimate interest (point (f)) – website security (server logs), displaying a Google Maps map when you click “Open the map”, communicating with referring veterinarians about the patients they have referred, checking and displaying Google reviews, and defending ourselves in complaints, disputes and claims. You can object to processing on this basis.

Storing your choice in your browser is strictly necessary for us to respect that choice. Under Article 4a(4), point 2 of the Electronic Commerce Act, no consent is required for it.

The data that the law requires us to enter in the veterinary medical records is mandatory – without it we cannot carry out the examination or treatment. Without your name and phone number we cannot book you an appointment. Consent to statistics is voluntary, and refusing it does not limit your use of the website.

Recipients

We share data only where this is necessary for the purposes described. Recipients of the data may include:

• SuperHosting.BG OOD – hosting of the website (server in Sofia) and of our email (servers in Bulgaria);
• Google Ireland Ltd. – statistics with Google Analytics 4, only if you have given consent;
• software providers, including the provider of the diagnostic imaging system, and the company with which we maintain the pacs.bluecrossbg.com portal – where they process data on our behalf and on our instructions;
• laboratories and other veterinary clinics – when we send a sample or refer a patient for tests or treatment;
• the referring veterinarian – the results relating to the referral;
• the BFSA and its regional directorates, the National Revenue Agency (Национална агенция за приходите), the courts and other public authorities – where required by law.

Transfers of data outside the European Economic Area

If you have consented to statistics, Google Ireland Ltd. may transfer Google Analytics 4 data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision under Article 45 GDPR (Implementing Decision (EU) 2023/1795). As an additional safeguard, Google’s data processing terms include the European Commission’s standard contractual clauses. The decision is in force but has been challenged before the Court of Justice of the EU. If it is annulled or suspended, we will update this policy.

If you click “Open the map”, your browser sends Google your IP address and the address of the page. Google processes them as an independent controller under its own policies (policies.google.com/privacy), including in the USA.

Retention periods

• Data from phone calls – up to 12 months.
• Veterinary medical records – the outpatient register is kept for 5 years from the date of the last entry (Article 9(2) of Ordinance No. 42 of 2008). The signed informed consent to surgery is kept for at least 1 year (Article 13(8) of the same Ordinance). Records of treatment with veterinary medicinal products outside the terms of their marketing authorisation are kept for 5 years from the administration of the products (Article 39c of the Veterinary Activities Act). We keep the rest of the animal’s veterinary medical records for as long as they are needed for its treatment, but for no less than these periods.
• Accounting documents – we keep the accounting registers and the documents used for tax inspections (for example invoices) for 10 years, and all other media containing accounting information for 3 years. These periods run from 1 January of the year following the year to which they relate (Article 12(1) of the Accountancy Act).
• Data relating to a complaint, dispute or claim – until it is finally resolved and the limitation periods have expired.
• Email correspondence – for as long as it is needed to reply to the enquiry. If it relates to treatment, we keep it with the animal’s veterinary medical records.
• Data of referring veterinarians – for as long as we work together. We keep the data in the referral with the animal’s veterinary medical records.
• Server logs – for as long as the hosting provider keeps them.
• Statistics – the _ga and _ga_* cookies last up to 2 years. Google Analytics automatically deletes user-level and event-level data after 14 months at the latest. Your cookie choice is kept for 12 months.
• Google reviews – for as long as we show them on the website or until you ask us to remove them.

Your rights

Under the GDPR you have the following rights:

• Access – to find out whether we process data about you and to receive a copy of it.
• Rectification – to ask us to correct inaccurate or incomplete data.
• Erasure – to ask us to delete your data when it is no longer needed, when you withdraw your consent or when the processing is unlawful. Data that the law requires us to keep, such as the outpatient register and accounting documents, is deleted only after the statutory period has ended.
• Restriction – to ask us to suspend processing temporarily, for example while we check the accuracy of the data or whether your objection is justified.
• Portability – to receive the data you have provided to us in a machine-readable format, or to ask us to transfer it to another controller, where the processing is based on a contract or on consent and is carried out by automated means.
• Objection – to object to processing based on legitimate interest.
• Withdrawal of consent – to withdraw your consent at any time. For statistics, you can do this using the “Cookies” button at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it.
• Complaint – to lodge a complaint with the Commission for Personal Data Protection (see the next section).

Send your requests to info@bluecrossbg.com or by post to the address of the Sofia clinic, or hand them in at either of our clinics. We may ask you to confirm your identity so that we do not disclose your data to someone else. We reply free of charge within 1 month of receiving the request. For complex or numerous requests, this period may be extended by a further 2 months, and we will let you know of this within the first month. For manifestly unfounded or excessive requests, in particular repetitive ones, we may charge a reasonable fee or refuse to respond, and we will explain why. We notify every rectification, erasure or restriction to the recipients to whom we have disclosed the data, unless this proves impossible or involves disproportionate effort.

Complaints to the Commission for Personal Data Protection

If you believe that we are processing your data unlawfully, you can lodge a complaint with the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, kzld@cpdp.bg, www.cpdp.bg. The complaint must be lodged within 6 months of becoming aware of the infringement, and no later than 2 years after it was committed. You can also seek redress in the courts.

Automated decision-making and profiling

We do not make decisions based solely on automated processing, and we do not profile our visitors or clients.

Children

The website is not intended for children, and we do not knowingly collect data about them. For a child under 14, consent to statistics cookies is given by the child’s parent or guardian.

Security

The website works only over a secure connection (HTTPS). Veterinary medical records and client data can be accessed only by staff who need them for their work.

Changes to this policy

When we change this policy, we publish the new text on this page and state the date from which it applies.