Privacy policy

1. Data controller and contact

Digital X is a business brand for digital, web, marketing and AI services based in Sarajevo, Bosnia and Herzegovina. The full identity of the contracting party is stated in the quote, contract and/or invoice before any payment obligation arises.

Contact for privacy questions: digital.x.agency.ba@gmail.com · +387 64 438 35 66.

2. Legal framework

We process personal data in line with the Law on the Protection of Personal Data of Bosnia and Herzegovina (Official Gazette of BiH, No. 12/25) and, where applicable, the EU General Data Protection Regulation (GDPR) and other mandatory regulations.

3. Data we may collect

• Contact details: name, company name, email, phone, message and the selected service.
• Audit data: the URL of the page you want analysed, an email for delivering the results, and the technical result of the analysis.
• Quote and project data: requirements, budget, deadline, project communication, documentation, access details and feedback needed for delivery.
• Transaction and administrative data: quote, contract, invoice, payment status and data needed for bookkeeping.
• Technical data: IP address, access time, device and browser type, approximate location, pages visited, traffic source and security logs.
• Consent settings: your choice of essential, analytics and advertising categories.

Don't send passwords, card numbers, health data, identity documents or other sensitive information that isn't needed for your enquiry through public forms.

4. Purposes and legal basis

• responding to enquiries, preparing quotes and taking steps before a contract is concluded;
• delivering the service, communication, support, invoicing and project management;
• meeting legal, tax and accounting obligations;
• website security, preventing misuse and protecting legal claims;
• measuring visits and improving the website after appropriate consent;
• marketing and remarketing only where there is valid consent or another legal basis.

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

5. Recipients and service providers

We do not sell personal data. To the extent needed to run the website and deliver the service, data may be available to hosting and infrastructure providers, email and communication services, analytics, automation and accounting providers, and professional advisers bound by an appropriate duty of confidentiality.

The website uses Vercel for hosting and technical delivery, Google Tag Manager and Google Analytics 4 for measurement once the appropriate consent is given, and external communication services when the user chooses them.

6. International transfers

Some providers may process data in the European Economic Area or other countries. Where an international transfer is needed, the available legal, contractual and organisational safeguards apply, including appropriate standard contractual clauses or other recognised mechanisms.

7. Retention periods

We keep data only as long as needed for the purpose it was collected for. Enquiries that don't lead to a contract are periodically deleted or anonymised. Project, contractual, tax and accounting data are kept for the duration of the engagement and the statutory periods. Marketing data are kept until consent is withdrawn or the legitimate purpose ends. Security logs are kept for the limited time needed to protect the system.

8. Your rights

Depending on the applicable regulations and circumstances, you can request access, a copy, correction, erasure, restriction of processing and data portability, and you can object. You can also withdraw your consent.

To exercise your rights, write to digital.x.agency.ba@gmail.com. To protect your data, we may ask for reasonable proof of identity. You also have the right to contact the Personal Data Protection Agency of Bosnia and Herzegovina.

9. AI tools and automated processing

On the public website we don't make decisions with legal or similarly significant effects based solely on automated processing. Where AI is used in a project, its scope, sources, roles, approvals and human oversight are defined for the specific solution.

10. Security

We apply reasonable technical and organisational measures, including HTTPS, access restriction, data minimisation, secrets management and backups where applicable. No system is entirely without risk.

11. Children

Our services and forms are not aimed at children. We don't knowingly collect children's data without appropriate parental or guardian consent where it is required.

12. Changes

We may update this policy when features, providers or regulations change. The current version and date are always published on this page.

Details on measurement technologies are in the Cookie policy. See also Legal information and Terms of use.

This document is a general framework and should be aligned with the final registration details, contracts and the integrations that are actually active.