Privacy Policy

1. Introduction

"VELA CONSULTING" d.o.o. Banja Luka, Save Mrkalja no. 19, 78000 Banja Luka, Bosnia and Herzegovina, registration number 11070302, tax ID (JIB) 4403226550005 (the Company), is the controller of the personal data processed through the website vela.ba (the Website).

With this Privacy Policy (the Policy), the Company, in accordance with the Law on Personal Data Protection ("Official Gazette of BiH", No. 12/25; the Law), informs visitors of the Website which personal data it processes, for what purposes, on which legal basis, to whom it discloses them, how long it keeps them and how visitors can exercise their rights.

This Policy applies only to processing carried out through the Website and to communication visitors have with the Company through the contacts published on the Website. The use of cookies is governed in more detail by the Cookie Policy published on the Website.

2. Processing principles

The Company processes personal data lawfully, fairly and transparently; only for specified, explicit and legitimate purposes; to the extent adequate and limited to what is necessary for the purpose (data minimisation); accurately and kept up to date; for no longer than necessary for the purpose; applying appropriate technical and organisational security measures, and is able to demonstrate that processing complies with the Law.

3. Data we process

3.1. Contact form data. When you fill in the contact form, we process the data you enter yourself: name, e-mail address, subject and content of the message.

3.2. Contact by e-mail and phone. If you contact us directly at the e-mail addresses or phone numbers published on the Website, we process the data contained in your message or call (name, address, phone number and content of the communication).

3.3. Job applications. If, following the invitation on the "Careers" page, you send us an application or curriculum vitae (CV), we process the data you provide yourself: full name, contact details, data on education, work experience and skills, and other data in the application.

3.4. Technical data. When you visit the Website and submit the form, technical data necessary to display the Website and to protect it against abuse are processed automatically: IP address, browser type and version, operating system, time of access and similar device data.

3.5. Website usage data. Only if you agree through the cookie notice, we process data on how you use the Website (pages visited, duration of the visit, source of the visit, interactions with advertisements and approximate location derived from the IP address), using the tools described in the Cookie Policy.

Please do not submit special categories of personal data (e.g. data on health, religious or political beliefs) or data of third persons not needed for your inquiry or application through the form or in a job application.

4. Purposes and legal bases of processing

‍

You may withdraw your consent at any time, as easily as you gave it – for the contact form and job applications by a message to the address in Section 11, and for cookies through the "Cookie settings" link in the Website footer. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal, nor processing based on another legal basis under this Section.

Providing data through the form and in a job application is voluntary and is neither a statutory nor a contractual requirement. Without the data marked as mandatory we cannot receive and handle your inquiry or consider your application.

We do not use form data to send marketing messages unless you give separate consent for that.

5. Recipients

Personal data may be processed by:

• authorised employees of the Company, to the extent necessary to handle the inquiry or application;
• the hosting service provider on whose servers the Website is hosted;
• the provider of Website development and maintenance services and of management of the Company's analytics and advertising accounts, to the extent necessary for those tasks;
• Cloudflare, Inc. (United States of America) – provider of the Turnstile service, which distinguishes humans from automated programs by checking technical data about the device and browser;
• Google LLC (United States of America) and its affiliates – provider of Google Tag Manager, Google Analytics and Google Ads (only with your consent), and of Google Maps and Google Fonts;
• the Font Awesome service provider, through whose network the Website icons are loaded and which processes the IP address in doing so;
• competent public authorities, where required by law.

Messages sent through the contact form and by e-mail are received and stored on the Company's own e-mail server.

The Company has concluded data processing agreements with its processors, or the processing is carried out under their standard data processing terms.

6. Transfers outside Bosnia and Herzegovina

Certain recipients listed in Section 5 (Cloudflare, Google and the Font Awesome service provider) also process data outside Bosnia and Herzegovina, including in the United States of America. Transfers are carried out solely under the conditions of Articles 47 to 49 of the Law: on the basis of an adequate level of protection – including the recipient's certification under the EU-U.S. Data Privacy Framework, for which the European Union has found that it ensures an adequate level of protection (Article 47(2) of the Law) – or subject to appropriate safeguards or in specific situations provided for by the Law.

7. Retention periods

We keep form and e-mail data for as long as necessary to handle the inquiry and for any further business communication with you. If the inquiry leads to a contract, the data are further kept for the periods prescribed for contractual and business records.

We keep job applications until the end of the recruitment procedure for which they were submitted, and, if you have consented to us considering your application for future positions, until you withdraw that consent and no longer than necessary for that purpose. The application of a candidate with whom an employment contract is concluded is kept in accordance with the regulations on employment relations and records.

Website usage data are kept for the periods stated in the Cookie Policy. Technical data are kept only as long as necessary to display the Website and protect it against abuse.

After these periods expire, the data are deleted or anonymised.

8. Security measures

The Company applies appropriate technical and organisational data protection measures, including access control and restriction, secure data transmission (HTTPS), employee training and procedures for handling security incidents.

9. Automated decision-making

The Company does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. The check performed by the Turnstile service serves solely to protect the form against automated programs.

10. Your rights

In accordance with the Law, you have the right to:

• request access to personal data concerning you;
• request rectification of inaccurate or completion of incomplete data;
• request erasure of data;
• request restriction of processing;
• request data portability;
• object to processing based on the Company's legitimate interest;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before its withdrawal;
• not be subject to a decision based solely on automated processing.

11. How to exercise your rights

You may submit a request to exercise your rights:

• by e-mail to: info@vela.ba;
• by post to: "VELA CONSULTING" d.o.o. Banja Luka, Save Mrkalja no. 19, 78000 Banja Luka, Bosnia and Herzegovina.

We respond to requests without undue delay and in any event within 30 days of receipt of the request. Taking into account the complexity and number of requests, that period may be extended by a further 60 days, of which we will inform you, together with the reasons, within 30 days of receipt of the request. To protect your data, we may request additional information necessary to confirm your identity.

12. Right to lodge a complaint with the Agency and to judicial protection

If you believe that your personal data are processed in breach of the Law, you have the right to lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina, Dubrovačka 6, 71000 Sarajevo (www.azlp.ba), or to bring an action before the competent court.

13. Changes to this Policy

The Company may amend this Policy to align it with regulations or changes to the Website. The current version, with its date of application, is always published on this page.