Privacy Policy

Last updated: July 21, 2026

This Privacy Policy explains how Biletko ("Biletko", "we", "us", "our") collects, uses, shares and protects personal data when you use this website to search for and book bus tickets. It applies to all visitors, customers and users of the site.

1. Who we are

The data controller responsible for your personal data is:

Biletko
Tsarigradsko Shose 42
Sofia, Bulgaria

For any question about this policy or your personal data, contact us at dev.merhat@gmail.com.

2. What data we collect

When you search for or book a bus ticket, we collect:

• Contact details — full name, email address and phone number.
• Booking details — departure and destination city, travel dates and times, number of tickets, and the booking/confirmation code for your trip.
• Payment information — your payment is processed directly by our payment provider, Stripe (see Section 5). We do not receive or store your full card number. We do store the payment amount, currency, payment status, and an internal Stripe payment reference for your order.
• Technical data — your language preference, and standard web request data such as IP address and browser type, collected automatically as part of operating the site.

3. How we use your data

We use your personal data to:

• Process and confirm your bus ticket booking and payment;
• Issue your ticket with the operating bus carrier and send it to you;
• Communicate with you about your booking (confirmations, schedule changes, support requests);
• Detect and prevent fraud, and keep the site secure;
• Comply with our legal and accounting obligations; and
• If you have given consent, measure advertising performance and show you relevant ads (see Section 6).

4. Legal basis for processing

We process your personal data on the following legal bases under the GDPR:

• Performance of a contract — to process your booking and payment, and deliver your ticket.
• Legal obligation — to keep accounting and tax records as required by Bulgarian law.
• Legitimate interest — to keep our systems secure and prevent fraud.
• Consent — for optional advertising and analytics cookies, which you can accept or decline (see Section 6). You may withdraw consent at any time.

5. Payment processing

All payments are processed by Stripe, Inc., a PCI-DSS-compliant payment processor. When you enter your card details, they are sent directly and securely to Stripe and never pass through or get stored on our servers. Stripe's own use of your data is governed by the Stripe Privacy Policy. Stripe may process data outside the European Economic Area under appropriate safeguards, such as Standard Contractual Clauses.

6. Cookies

We use the following cookies:

• Language preference cookie — remembers whether you're browsing the site in Bulgarian or English. Strictly necessary for the site to function as intended.
• Admin session cookie — used only by our staff to sign in to the internal booking-management area; it is never set for regular customers.
• Advertising and analytics cookies — we use Google Analytics and Google Ads to measure how visitors find and use the site and to measure the performance of our advertising campaigns. When you first visit the site, a cookie banner lets you accept or decline these cookies; by default, no advertising or analytics cookie is set until you accept. You can withdraw your consent at any time by clearing the biletko_consent cookie in your browser and revisiting the site. Google's use of this data is described in the Google Privacy Policy, and data may be processed outside the European Economic Area.

7. Who we share your data with

We share personal data only where necessary, with:

• The bus/coach operator carrying out your trip, so your ticket can be issued in your name;
• Stripe, to process your payment;
• Google, only if you consent to advertising/analytics cookies;
• Our hosting and infrastructure providers, who process data on our behalf under contract; and
• Authorities, where required by law.

We do not sell your personal data.

8. How long we keep your data

We keep booking and payment records for as long as required by Bulgarian tax and accounting law (currently up to 10 years for financial documents), and for as long as needed to resolve any disputes. Data collected only with your consent (such as advertising cookies) is kept until you withdraw consent or as set out in the relevant cookie's own retention period.

9. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data, where we are not required to keep it;
• Restrict or object to certain processing;
• Receive your data in a portable format; and
• Withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at dev.merhat@gmail.com. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни) at www.cpdp.bg, or with your local data protection authority if you live outside Bulgaria.

10. Children's privacy

This site is not directed at children, and we do not knowingly collect personal data from children under 16.

11. Security

We use appropriate technical and organizational measures, including encrypted (HTTPS) connections, to protect your personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, contact us at dev.merhat@gmail.com.