1.Introduction

"VSD Advisory" d.o.o. Banja Luka (hereinafter: "VSD Advisory", "we", or "our company") is committed to protecting the personal data of visitors to our website vsdadvisory.com (hereinafter: the "Site").

This Privacy Policy describes what personal data we collect, how we use it, how long we keep it, how we protect it, and what rights you have as a data subject, all in accordance with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of B&H, no. 12/2025, hereinafter: "DPL") and, where applicable, the EU General Data Protection Regulation (Regulation 2016/679, hereinafter: "GDPR").

2.Data Controller

The controller of your personal data within the meaning of the DPL and GDPR is:

For any questions regarding the processing of your personal data, please contact us at the email above.

3.What data we collect

We collect only the data that you voluntarily provide to us via the contact form on our Site:

• Full name
• Email address
• The content of the message you send us

We do not automatically collect any data about your behavior on the Site. We do not use Google Analytics, Facebook Pixel, or any other visitor-tracking tools.

4.Technical data and local storage

Our Site does not use marketing or analytics cookies.

We only use your browser's localStorage to remember your language preference between visits. This functionality is considered essential and does not require separate consent, in line with AZLP's practice and Article 8 of the DPL.

5.Purpose and legal basis of processing

We process your data from the contact form solely for the purpose of responding to your inquiry and, where you have indicated so, further business communication.

The legal basis for processing your data is:

• Your consent (Art. 8, para. 1, point (a) of the DPL), which you give explicitly by checking the box on the contact form before sending your message;
• Taking steps at your request prior to entering into a contract (Art. 8, para. 1, point (b) of the DPL), where your inquiry is of such nature.

6.With whom we share your data

To technically enable the sending of messages from the contact form, we use the EmailJS service (EmailJS, Inc., USA), which acts as a data processor on our behalf. EmailJS does not permanently store the content of your message — it forwards it directly to our official email address.

More information is available in EmailJS's privacy policy: emailjs.com/legal/privacy-policy.

We do not sell, rent, or forward your data to third parties for marketing or commercial purposes.

7.International transfer of data

Email processing takes place via EmailJS infrastructure that may be physically located outside of Bosnia and Herzegovina (in the EU, the United States, or other jurisdictions). EmailJS operates in accordance with the EU-US Data Privacy Framework and other international mechanisms that ensure an adequate level of data protection.

8.Data retention

We retain the content of your message and contact details:

• for a maximum of 24 months from the last communication with you;
• or until you withdraw your consent or request deletion (see Section 9 of this Policy).

After this period, your data is permanently deleted from our systems.

9.Your rights

As a data subject, you have the following rights under the DPL and GDPR:

• Right of access — you may request confirmation of whether we process your data and a copy of that data;
• Right to rectification — you may request correction of inaccurate data or completion of incomplete data;
• Right to erasure ("right to be forgotten") — you may request deletion of your data under the conditions prescribed by law;
• Right to restriction of processing — you may request that we temporarily suspend processing;
• Right to data portability — you may request that we provide you with your data in a structured, machine-readable format;
• Right to object — you may object to processing based on legitimate interest;
• Right to withdraw consent — you may withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, send a written request to: info@vsdadvisory.com.

We will respond within 30 days of receiving your request, as required by law.

10.Right to lodge a complaint

If you believe that our processing of your personal data violates the DPL or GDPR, you have the right to lodge a complaint with the competent supervisory authority:

11.Data security

We have implemented reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These include, among others:

• HTTPS encryption of all traffic between your browser and the Site;
• Restricting access to data only to authorized persons with a legitimate business need;
• Regular security reviews and updates of the technologies we use.

12.Minors

Our services are not intended for persons under the age of 16. We do not knowingly collect personal data from minors. If we learn that we have inadvertently collected data of a minor without parental or guardian consent, such data will be promptly deleted.

13.Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy as needed. We will inform you of any material changes by publishing an updated version on this Site with a clearly indicated update date. We recommend that you check this page periodically to stay informed of any changes.

14.Authoritative version

In case of any discrepancy between the Serbian and English versions of this Privacy Policy, the Serbian version shall prevail.