Privacy Policy

1. Data controller

The controller of your personal data is COMMIT d.o.o., Kralja Petra Karađorđevića 103, 78000 Banja Luka, Bosna i Hercegovina. For any question or request concerning your personal data, write to info@neksus.ba or call +387 65 302 988. We currently have no appointed data protection officer; the e-mail address above is the single point of contact for all data protection matters.

2. What we process, why, and on what legal basis

a) Contact form and presentation requests

• Data: first and last name, e-mail address (required), and optionally company name, phone number, type of user, area of interest and the text of your message. Without a name and an e-mail address we cannot reply, so the form cannot be sent without them.
• Purpose: to answer your enquiry, schedule a presentation or prepare an offer, and to continue the conversation about that enquiry. We do not use the data for marketing you did not ask for.
• Legal basis: when you write on behalf of a company or organisation, Article 6(1)(f) GDPR, our legitimate interest in answering a business enquiry addressed to us; when you write as a sole trader or in your own name, Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract.
• Your message is delivered to our mailbox through the Resend service (see section 3). Sending the form is not consent to anything beyond this purpose.

b) Direct contact by phone or e-mail

We process the data you give us yourself, for the purpose of replying to you, on the basis of Article 6(1)(f) GDPR.

c) Technical data when you visit the website (hosting server logs)

• Data: IP address, date and time of the request, page requested, browser and device type.
• Purpose: delivering the website, security and abuse detection.
• Legal basis: Article 6(1)(f) GDPR, our legitimate interest in running a secure and stable website.
• Retention: our hosting provider Vercel keeps request logs for a short period, from one hour up to a few days depending on the hosting plan; we do not export them to other systems. Details in the Vercel privacy policy.

d) Audience measurement (Vercel Web Analytics)

• Works without cookies, does not read data stored on your device and does not store your IP address. To tell visits apart within a single day it uses a temporary hash derived from the IP address and browser, which is automatically deleted within 24 hours and does not allow a person to be identified.
• Data: pages visited (address without query parameters), referrer, country, device type, browser and operating system, and three events: contact form submitted, click on the phone number, and click on the button to schedule a presentation. The events never carry the contents of form fields or any personal data. We only ever see aggregate figures.
• Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing how many people visit the website and which pages are useful, so we can improve the content. Because the measurement is aggregate, cookieless and free of profiling, we rely on this basis rather than on consent, which is also why the website shows no cookie banner. You can object at any time with one click in section 6, and the measurement is then switched off on your device immediately.
• We do not use Google Analytics, Facebook Pixel or any other tracking or advertising tool.

e) Cookies and local settings

This website itself does not set any cookies. The language is part of the page address (/en/), so nothing needs to be remembered. The one exception is the embedded Google map on the Contact page (section f), where Google may set its own cookies. The only thing the website may store on your device is your own choice to switch audience measurement off (section 6), saved as a local browser setting at your explicit request; you can remove it by switching the measurement back on or by clearing your browser data.

f) Google map on the Contact page

The Contact page contains an embedded Google Maps map showing our location. When that page opens, your browser connects to Google's servers (Google Ireland Limited / Google LLC, USA), which receive your IP address and technical data about your browser and may set their own cookies, under the Google privacy policy. Google processes that data as an independent controller for its own purposes, not on our instructions. We show the map on the basis of our legitimate interest in helping you find our office (Article 6(1)(f) GDPR). If you would rather avoid that connection, do not open the Contact page; our address, phone number and e-mail are also in the footer of every page.

3. Who we entrust data to (processors)

• Vercel Inc., USA: website hosting and audience measurement.
• Resend Inc., USA: technical delivery of contact form messages to our mailbox. Resend keeps a delivery record and the message content for a short period set in our account.
• Our e-mail provider, on whose servers we receive and store messages.

These providers process data only on our instructions, under data processing agreements (Article 28 GDPR). Because some of them are based in the USA, transfers outside Bosnia and Herzegovina and the European Economic Area rely on the European Commission's Standard Contractual Clauses included in those agreements. We do not sell personal data and do not share it for marketing purposes. We disclose data to public authorities only where the law requires it.

4. How long we keep data

• Contact form enquiries and correspondence: for as long as the enquiry is being handled and at most 12 months after the last contact, after which they are deleted. If the enquiry leads to a contract, only the documents needed for that contract are kept, for the periods required by accounting and tax regulations.
• Server logs: short-term, as described in section 2c.
• Analytics: aggregate statistics only, with no personal data; the temporary hash for up to 24 hours.
• Your measurement opt-out: on your device, until you change it or clear your browser data.

5. Automated decision-making

On this website we do not make decisions based solely on automated processing and we do not profile visitors.

7. Data security

The connection to the website is encrypted (HTTPS/TLS). Access to data is limited to the people who need it for their work, our providers are bound by data processing agreements, and the contact form is protected against automated spam submissions.

8. Children

The website is intended for business users. We do not knowingly collect data from persons under 16; if we learn that we have received such data, we delete it.

9. Changes to this policy

A new version is published on this page with the date of the update. For material changes we will notify the users we are in contact with.

10. Contact

COMMIT d.o.o., Kralja Petra Karađorđevića 103, 78000 Banja Luka, Bosna i Hercegovina. E-mail: info@neksus.ba. Phone: +387 65 302 988.