Policy changed — see what exactly · 2026-07-11 →
Bulgartransgaz — the operator of Bulgaria's gas transmission system — 33 requests, a single domain. All resources, including fonts, are hosted locally; there are no external calls, trackers, or cookies. For an operator of critical energy infrastructure, this is the correct approach. No violations have been recorded.
Timeline of the leak
Declared versus actual
Context
bulgartransgaz.bg is the website of Bulgartransgaz EAD, the state operator of Bulgaria’s gas transmission system and underground gas storage facilities, a critical energy infrastructure asset. The data controller is Bulgartransgaz EAD. The document provided — “Известие за поверителност и защита на личните данни до контрагенти” (Notice on Privacy and Personal Data Protection for Counterparties) — is a notice concerning the processing of counterparties’ data, not the site’s cookie policy. Capture: 33 requests, a single domain, recorded in a clean browser.
Declared versus Actual
The capture reveals a fully self-sufficient page. All resources — markup, stylesheets, scripts, fonts, and images — load from the first-party domain bulgartransgaz.bg; fonts (in woff2 format) are hosted locally. There are no external domains present in the capture whatsoever: no analytics, no Google, no third-party CDNs, no advertising pixels, no session recording. Inspection of the first-party domain’s paths revealed no hidden analytics or build endpoints. No cookies are set (Set-Cookie is zero).
The document provided is addressed to counterparties and describes the processing of their personal data within the framework of contractual relationships; it does not substitute for a separate cookie policy for the site. Since there is no third-party processing on the page, no discrepancy between “declared” and “actual” substantively arises.
Timing Relative to Consent
All calls go to the site’s own domain. There are no third-party resources on the page requiring consent; no cookies are set. For an operator of critical infrastructure, minimizing external dependencies is the correct approach.
What Cannot Be Asserted from This Capture
The capture covers the home page. Internal and secured sections of the platform (capacity data, auctions) may involve additional server-side processing that a browser-based capture does not cover. A separate cookie policy for the site was not provided as part of this package; since there are no third-party trackers, this does not affect the assessment of the capture. Server-side processing is not visible in a browser-based capture.
Conclusion
The website of Bulgaria’s gas transmission system operator is implemented cleanly: all resources, including fonts, are hosted locally on the site’s own domain, there are no external calls whatsoever, and trackers and cookies are absent. For a critical energy infrastructure asset, the absence of external dependencies is particularly fitting. No violations have been recorded in the capture.
e58c09eb16f20fe99641e6653403ff9f9fc8213ec1dabc8520042788ffde4089