Privacy Policy

1. Data Controller

Itrade d.o.o.
Zmaja od Bosne 7
71000 Sarajevo
Bosnia and Herzegovina

Contact for data protection matters: info@dpl.ba

Data Privacy Lab is the name under which Itrade d.o.o. provides specialised consulting and training services in the field of personal data protection and compliance.

2. Principles of Personal Data Processing

We process personal data lawfully, fairly and transparently, for specified and legitimate purposes and only to the extent that the data are adequate, relevant and necessary for those purposes.

We apply the principles of data minimisation, accuracy, storage limitation, integrity and confidentiality and implement appropriate measures to protect personal data.

3. Personal Data We Process

3.1. Technical data when visiting the website

When you access the website, certain technical data may be processed automatically in order to enable access to and the proper functioning of the website, maintain system security, and detect and prevent misuse.

Depending on the technical configuration and services used, such data may include your IP address, the date and time of access, information about your device, browser and operating system, and basic technical information relating to requests made to the website.

3.2. Data provided through email communications

If you contact us by email, we may process the information you provide in the course of that communication, including your name and surname, organisation, position or job title, contact details, the content of your enquiry, and other information contained in your message or attachments.

Please do not provide personal data that are not necessary for the purpose of your enquiry, in particular special categories of personal data, unless their disclosure is necessary and there is an appropriate legal basis for the processing.

4. Purposes and Legal Bases for Processing

Website operation and security - we may process technical data to ensure the availability and secure operation of the website, maintain our systems, identify technical issues, and prevent and detect misuse. The processing is based on our legitimate interest in ensuring the secure, reliable and proper operation of the website.

Communications and responding to enquiries - we may process the data you provide in order to receive and handle your enquiry, communicate with you and provide the information requested. Depending on the nature of the communication, the legal basis may be our legitimate interest in conducting business communications or taking steps at your request prior to entering into a contract.

Preparing and establishing a business relationship - where the communication concerns a potential engagement, we may process personal data in order to understand your requirements, prepare an engagement proposal or offer, conduct negotiations, and take other steps prior to entering into a contract.

Compliance with legal obligations and protection of legal interests - certain personal data may be processed where necessary to comply with a legal obligation to which we are subject or for the establishment, exercise or defence of legal claims.

5. Cookies

The website is designed in accordance with the principle of data minimisation.

We currently do not use analytics or marketing cookies, or cookies for profiling or tracking visitors' behaviour for marketing purposes.

For ordinary public visitors, the website currently uses the functional cookie “pll_language”, set by Polylang to remember the language selected by the user and display the corresponding language version of the website.

Further information about our use of cookies is available in our Cookie Policy.

6. Contact Form and Other Website Features

The website currently does not use an online contact form, user accounts, newsletter sign-up or other features through which public visitors directly submit personal data on the website.

Communications take place through the contact details published on the website.

7. Are You Required to Provide Personal Data?

Providing personal data through email communications is voluntary.

However, if you do not provide the information necessary to understand and handle your enquiry, we may be unable to respond, prepare an offer or take the requested steps prior to entering into a contract.

8. Recipients of Personal Data

Personal data may be made available to third parties only where necessary for the relevant purpose of processing, the performance of contractual obligations, compliance with legal obligations, or where another appropriate legal basis applies.

• hosting and technical service providers;
• IT and security support providers;
• email and communications service providers;
• accounting, legal and other professional advisers, where necessary;
• competent authorities, courts and other bodies where disclosure is necessary to comply with a legal obligation to which the data controller is subject or in other cases provided for by law.

Where a service provider processes personal data on our behalf, the relationship with that processor is appropriately governed in accordance with applicable personal data protection legislation.

9. Transfers of Personal Data to Another Country or an International Organisation

Depending on their technical infrastructure and the location of processing, certain providers of technical, hosting, email, communications or other services may process personal data outside Bosnia and Herzegovina.

Where processing involves a transfer of personal data to another country or an international organisation, the transfer will take place only under the conditions prescribed by applicable personal data protection legislation, including, where applicable, on the basis of an adequacy decision or subject to appropriate safeguards.

10. Retention Periods

We retain personal data only for as long as necessary to fulfil the purpose for which they were collected, or for the period required to comply with legal obligations, protect legitimate interests, or establish, exercise or defend legal claims.

As a general rule, we apply the following retention periods or criteria:

• Technical and security logs relating to the website - up to 90 days, unless longer retention is necessary to investigate a security incident, prevent misuse, or establish, exercise or defend legal claims.
• Email enquiries and communications that do not result in a business relationship - up to 12 months from the last relevant communication.
• Business communications and documentation relating to an established business relationship - for the duration of the business relationship and up to 5 years after its termination, unless a longer retention period is required by law or is necessary to establish, exercise or defend legal claims.
• Documentation subject to a mandatory retention period under specific legislation - for the period prescribed by the relevant legislation.
• The “pll_language” cookie - up to one year.

Upon expiry of the applicable retention period, personal data are deleted, anonymised or, where applicable, archived in accordance with applicable legislation and document retention rules.

11. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss, destruction or damage.

Security measures are determined taking into account the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of individuals.

Although we implement appropriate safeguards, no electronic communications system or transmission of data over the internet can guarantee absolute security.

12. Your Rights

Subject to applicable personal data protection legislation and the circumstances of the particular processing, you may have the right to:

• access your personal data;
• rectify inaccurate personal data and complete incomplete personal data;
• request erasure of personal data where the statutory conditions are met;
• request restriction of processing where the statutory conditions are met;
• data portability, where applicable;
• object to processing, where applicable;
• not be subject, under the conditions prescribed by law, to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;
• lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina and seek judicial protection.

To exercise your rights, you may contact us at info@dpl.ba.

We will act on your request without undue delay and within the time limits prescribed by law. The 30-day period may, where necessary due to the complexity or number of requests received, be extended by a further 60 days. We will inform you of any such extension within the initial 30-day period and explain the reasons for it.

Where we have reasonable doubts concerning the identity of the person making a request, we may request additional information necessary to confirm that person's identity.

13. Automated Decision-Making and Profiling

In connection with the use of the website and the communications covered by this Policy, we currently do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

14. Changes to this Privacy Policy

We may amend this Policy from time to time to reflect changes in our processing activities, technical solutions, services or applicable legislation.

The current version of this Privacy Policy will be made available on the website.

15. Contact

Itrade d.o.o.
Zmaja od Bosne 7
71000 Sarajevo, Bosnia and Herzegovina
Email: info@dpl.ba