Privacy policy

Who is responsible for your data

The controller of your personal data is the dental practice of Dr. Iva Yordanova. You can contact us about anything relating to your personal data:

Address

73 Angel Kanchev St, Varna, Bulgaria

Phone

+359 87 740 0667

Email

dr.ivayordanova@gmail.com

What data we collect and why

• Contact form – your name and phone number (required), email, the service you choose and your message (optional). We use them to answer your enquiry and arrange an appointment. Legal basis: your consent, given with the checkbox on the form, and taking steps at your request before treatment (Art. 6(1)(a) and (b) GDPR).
• Health information – if you mention symptoms or a health condition in your message, we process it only to answer your enquiry and on the basis of your explicit consent (Art. 9(2)(a) GDPR). Please do not send more health information through the form than necessary.
• Spam protection – the form is protected by Google reCAPTCHA, which loads when you start filling it in and analyses technical data about your browser and device. Legal basis: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).
• Advertising measurement – only if you accept cookies, the site loads an OpenAI pixel that counts page visits, submitted enquiries and taps on the phone number, so we can judge how well our ads work. Your name, phone number, email and message are never sent to the pixel. Legal basis: your consent.
• Visit analytics – only if you accept cookies, the site loads PostHog, which records how the site is used: which pages you open, where you click and how far you scroll, plus a replay of the visit (a recording of your actions on screen). Each visitor gets an anonymous identifier; we do not link this data to your name. The contact form is excluded entirely – neither clicks in it nor anything you type are recorded – and the values of all other fields are hidden. We use this data to improve the site and to understand whether visitors find what they are looking for. The data is stored in the European Union. Legal basis: your consent.
• Google Ads – every page loads the Google tag. Until you accept cookies it runs in a restricted mode: it sets no advertising cookies and sends Google only cookieless signals – for example that a page was viewed or an enquiry was sent, with technical data about your browser – which Google uses to estimate how well our ads work. If you accept, Google may set advertising cookies to measure visits from our ads and to show our ads to people who have visited the site. Legal basis: your consent for the cookies, and our legitimate interest in measuring our advertising for the cookieless signals. The contents of the contact form are never sent to Google Ads.
• Map – the Contact page shows an embedded Google Maps map. When it loads, Google receives your IP address and may use its own cookies.
• Technical data – on every visit, the site’s hosting provider processes your IP address and technical information about the request (date, time, browser) to deliver and protect the site. Legal basis: legitimate interest.

Cookies and local storage

• NEXT_LOCALE – remembers the language you chose. Necessary; kept for 1 year.
• oai_consent – remembers whether you accepted or declined measurement cookies. Necessary; kept for 180 days.
• Google Ads cookies (e.g. _gcl_au) – set only after your consent, to link visits to our ads; kept for up to 90 days.
• PostHog cookie and local storage (ph_…_posthog) – set only after your consent; they hold the anonymous identifier and data about the current visit; kept for 180 days.
• oai_phone_tap (in sessionStorage) – notes that a tap on the phone number has already been counted during this visit, so it is not counted twice. Deleted when you close the tab.
• Third-party cookies – OpenAI (only after your consent), Google reCAPTCHA and Google Maps may set their own cookies under their own privacy policies.

You can change your choice about measurement cookies at any time:

Who we share data with

We use the following providers, who process data on our behalf:

• Vercel Inc. – website hosting
• Resend – delivery of the email containing your enquiry
• Google – the mailbox where we receive enquiries, reCAPTCHA, Google Maps and Google Ads
• OpenAI – advertising measurement, only with your consent
• PostHog – visit analytics, only with your consent; data stored in the EU

We do not sell personal data or share it with third parties for marketing. Some providers process data outside the European Union, mainly in the United States. In those cases the transfer is based on a European Commission adequacy decision (the EU–US Data Privacy Framework) or on standard contractual clauses.

How long we keep data

We keep enquiries from the form for as long as we need to answer you and arrange a visit, and no longer than that purpose requires. If you become our patient, your medical records are kept separately, for the periods required by Bulgarian law. Cookie lifetimes are listed above.

Your rights

Under the GDPR you have the right to:

• access the data we process about you;
• have inaccurate data corrected;
• have your data erased (the “right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, email us at the address above. We will reply within one month.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, www.cpdp.bg.

Changes to this policy

We may update this policy when we change how the site works. The date of the latest change is shown at the top of this page.