Privacy Policy

Last updated: October 6, 2026. This is a translation of the Bulgarian original; if the two versions differ, the Bulgarian version prevails.

This Privacy Policy explains how SmartVet OOD processes the personal data of visitors to vetswise.com, of people who contact us, and of the customers and users of the VetsWise software. It is based on Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Bulgarian Personal Data Protection Act and the Bulgarian Electronic Communications Act.

1. Data controller

The controller of your personal data is SmartVet OOD, a limited liability company registered in Bulgaria under Unified Identification Code (UIC) 208259494, with its registered office and management address at 23 Moryashka St., floor 7, apt. 55, Asparuhovo district, Varna 9000, Bulgaria.

For any question about your personal data, you can contact us by email at [email protected], by phone at +359 895 003 162, or by letter to our management address.

SmartVet OOD has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR.

Before SmartVet OOD, VetsWise was provided by the civil-law partnership DZZD Bratya Penchevi, UIC 177240354. SmartVet OOD has taken over the VetsWise business and the related data, and processes them under this Privacy Policy.

2. Who this policy applies to

This policy applies to:

  • visitors to vetswise.com;
  • people who write to us, call us, or request a demo or a free trial;
  • employees and representatives of veterinary clinics, grooming salons and our other customers who have a VetsWise account;
  • contact persons at our customers and suppliers.

This policy does not cover the data that clinics enter into VetsWise about their clients (the owners of their patients) and their staff. For that data, the clinic is the controller, and SmartVet OOD processes it only on the clinic’s behalf and instructions (see section 9). If you are the owner of a patient at a clinic that uses VetsWise, please contact the clinic with any questions about your data.

3. What data we process, why, and on what legal basis

3.1. Visiting the website

  • Data: IP address, browser and device type, pages visited, date and time of the visit, and the referring address.
  • Purpose: displaying the website, keeping it secure and detecting abuse.
  • Legal basis: our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR).
  • Retention: server logs are kept for up to 12 months, unless they are needed to investigate a specific incident.

Cookies and similar technologies are described in section 10.

3.2. Inquiries, demos and free trials

  • Data: name, phone number, email address, clinic name, the subject and text of your message, and any information you share with us in conversation. If you come through a referral or an advertising campaign, the form also records the corresponding referral code.
  • Purpose: to answer your inquiry, schedule a demo, open a trial account and, if you ask us to, transfer your data from your current software.
  • Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, when you write on behalf of a clinic, our legitimate interest in answering a business inquiry (Art. 6(1)(f) GDPR).
  • Retention: up to 2 years after our last contact, if no contract is concluded.

The forms on the website are protected from spam by Google reCAPTCHA, which analyzes device data and visitor behavior. The legal basis is our legitimate interest in protecting the website from automated abuse.

3.3. VetsWise accounts and use

  • Data: name, email address, phone number, job title and role at the clinic, login credentials (passwords are stored only in hashed form), account settings, IP address, login dates and times, and the log of actions in the system.
  • Purpose: providing the service under the contract with the clinic, access management, security, traceability of changes, technical support and training.
  • Legal basis: performance of the contract with the customer (Art. 6(1)(b) GDPR) and, for the customer’s employees, the customer’s and our legitimate interest in a secure and traceable service (Art. 6(1)(f) GDPR).
  • Retention: for as long as the contract is in force and up to 90 days after it ends, unless the law requires longer retention. Security logs are kept for up to 12 months.

3.4. Contracts, invoicing and accounting

  • Data: the customer’s name, UIC and address, the names of its representative and contact person, email address, phone number, the selected plan, invoices and payments.
  • Purpose: entering into and performing the contract, issuing invoices, recording payments and keeping accounts.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under the Bulgarian Accountancy Act and tax legislation (Art. 6(1)(c) GDPR).
  • Retention: for the periods set out in Article 12 of the Bulgarian Accountancy Act, as a rule 10 years.

We do not collect or store payment card data.

3.5. Service messages and news

  • Service messages about changes to the service, scheduled maintenance, expiring subscriptions, security and changes to the Terms of Use. The legal basis is performance of the contract (Art. 6(1)(b) GDPR), so you cannot opt out of them while you use the service.
  • VetsWise news: new features, training, events and offers related to the service. We send them to our customers based on our legitimate interest (Art. 6(1)(f) GDPR), and to anyone else only with their consent (Art. 6(1)(a) GDPR). Every email includes an unsubscribe link, and you can also unsubscribe by emailing us. We keep the data for this purpose until you unsubscribe.

3.6. Social media

When you visit the VetsWise page on Facebook or our YouTube channel, your data is processed by Meta Platforms Ireland Ltd. or Google Ireland Ltd., respectively, under their own policies. For the statistics of our Facebook page, SmartVet OOD and Meta Platforms Ireland Ltd. are joint controllers, with Meta bearing primary responsibility under its joint controller agreement (Page Insights Controller Addendum).

3.7. Protecting our rights

Where necessary, we use the relevant data to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR) and keep it until the applicable limitation period expires, as a rule 5 years.

3.8. Do you have to give us your data?

Providing data is voluntary. However, without contact details we cannot answer your inquiry, and without the data needed for the contract and invoicing we cannot provide the service.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. For the purposes in this section, we do not collect special categories of data under Article 9 GDPR, such as health data.

4. Who we share data with

We do not sell personal data. We share it only to the extent necessary with:

  • Amazon Web Services EMEA SARL (Luxembourg): hosting of the VetsWise platform in data centers in the European Union;
  • SuperHosting.BG EOOD (Sofia, Bulgaria): hosting of the vetswise.com website and our business email;
  • Google Ireland Ltd.: Google Analytics, Google Ads, reCAPTCHA, YouTube and Google Fonts (see section 10);
  • Meta Platforms Ireland Ltd.: Meta Pixel, if you have allowed marketing cookies;
  • external accountants, lawyers and auditors bound by a duty of confidentiality;
  • government authorities, courts and other parties where we are required to by law, such as the Bulgarian National Revenue Agency.

Providers that process data on our behalf act on our instructions and under a contract that meets the requirements of Article 28 GDPR.

5. Transfers outside the European Union

The VetsWise platform and the data in it are hosted in the European Union. Some of the providers in section 4 (Google, Meta and Amazon) belong to groups headquartered in the United States and may transfer data there. Such transfers rely on the European Commission’s adequacy decision of July 10, 2023, on the EU-U.S. Data Privacy Framework for companies certified under it and, where needed, on standard contractual clauses approved by the European Commission (Art. 46 GDPR).

6. How long we keep data

We keep data only for as long as it is needed for the purposes in section 3 or required by law, for the periods stated there. After that, we delete or anonymize it. Data drops out of backups as they are routinely overwritten.

7. How we protect data

We apply appropriate technical and organizational measures under Article 32 GDPR, including an encrypted connection (HTTPS), a separate database for each clinic, automatic daily backups, access rights based on each user’s role, an action log, access by our team only as far as support requires, and a duty of confidentiality for everyone with access to data.

If a personal data breach is likely to result in a high risk to your rights, we will notify you without undue delay. Where the law requires it, we also notify the Bulgarian Commission for Personal Data Protection within 72 hours.

8. Your rights

Under the GDPR, you have the right:

  • of access: to find out whether we process your data and to get a copy of it (Art. 15);
  • to rectification of inaccurate or incomplete data (Art. 16);
  • to erasure (the “right to be forgotten”) when there is no ground for us to continue processing (Art. 17);
  • to restriction of processing (Art. 18);
  • to data portability: to receive the data you provided to us in a structured, machine-readable format, or to ask us to transfer it to another controller (Art. 20);
  • to object to processing based on legitimate interest, and to direct marketing at any time and without giving reasons (Art. 21);
  • to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise your rights, email us at [email protected] or write to our management address. We may ask for information to confirm your identity. We respond within one month, which may be extended by two further months for complex or numerous requests, in which case we will let you know. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests (Art. 12(5) GDPR).

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg) or with the supervisory authority in the country where you live or work, and to seek a judicial remedy.

9. Data that clinics enter into VetsWise

In VetsWise, clinics keep data about their clients, the owners of their patients (names, phone numbers, email addresses, postal addresses, visits and payments), and about their staff (schedules, vacation, sick leave and actions in the system). For this data, the clinic is the controller, and SmartVet OOD is a processor under Article 28 GDPR. As a processor, we:

  • process the data only to provide the service and on the clinic’s documented instructions, given through the Terms of Use and the system settings;
  • do not use the data for our own purposes and do not share it with third parties, except with the sub-processors approved under the Terms of Use or where the law requires it;
  • send SMS reminders through SMSAPI only if the clinic has connected its own account with that service, in which case SMSAPI processes the data under its contract with the clinic;
  • assist the clinic with requests from the owners of patients and with security breaches.

If you contact us as the owner of a patient, we will forward your request to the clinic concerned without undue delay.

10. Cookies

Cookies are small text files that a website stores on your device. We also use similar technologies, such as pixels. Under Article 4a of the Bulgarian Electronic Communications Act, we set only strictly necessary cookies without your consent. All others are activated only after you allow them in the cookie banner. You can change or withdraw your choice at any time through the “Cookie settings” link at the bottom of the website, or by deleting cookies in your browser.

Strictly necessary

These provide the website’s core functions: they remember your language (pll_language, 1 year), protect the forms from spam (Google reCAPTCHA) and store your cookie choices (vw_consent, 6 months). The website cannot work properly without them.

Analytics

Google Analytics (_ga and _ga_*, up to 2 years) shows us how many visitors the website has, which pages they view and on what devices, so we can improve it. Data in Google Analytics is kept for up to 14 months.

Marketing

Google Ads (_gcl_au, 90 days) and Meta Pixel (_fbp, 90 days) measure whether our ads led to a visit or a request, and let us show ads to people who have visited the website. Embedded YouTube videos may also set Google cookies.

More about these providers’ cookies: Google and Meta.

11. Changes to this policy

We may update this policy when the service or the law changes. The current version is published on this page with the date of its last update. We notify our customers of material changes by email.