Privacy Policy

1. Data Controller

The controller of your personal data is "Qafana" Društvo sa ograničenom odgovornošću Sarajevo ("Qafana", "we"), with its registered seat at Igmanskih bataljona 27, 71210 Ilidža, Kanton Sarajevo, Bosnia and Herzegovina. Tax number (JIB): 4203601600008 · Court registration (MBS): 65-01-0070-26.

For any privacy or data-related questions or requests, you can reach us at info@qafana.com or by phone at +387 62 876 923.

This policy applies only to the qafana.com website, which is an informational portfolio site for our studio with a contact form. Our own products — find.ba, Avdokat, Vjeverica, and Configurence — operate on their own domains and have their own privacy policies.

2. What Data We Collect and Why

Contact form. When you reach out through the contact form, we collect your name, email address, inquiry type, and the message text. We use this data solely to respond to your inquiry and to manage the related correspondence.

Technical and security data. To protect the form against abuse and spam, it uses the Cloudflare Turnstile service, which for this purpose processes your IP address and basic technical information about your browser. Because the site is hosted on Cloudflare's network, standard request data (including your IP address) is temporarily recorded in server logs for security and reliability.

We do not collect data you do not provide to us through the form, and we do not build marketing profiles of visitors.

3. Legal Bases for Processing

We process your data on one or more of the following legal bases: your consent (when you voluntarily send us a message through the contact form); our legitimate interests (site security, protection against abuse, and keeping a record of inquiries); and taking steps at your request prior to entering into a contract (when your inquiry concerns possible cooperation or a quote).

For visitors from the European Union, these bases correspond to Article 6 of the GDPR (consent, legitimate interest, and pre-contractual steps).

4. Cookies

The public qafana.com website uses only essential (technical) cookies necessary for the basic operation and security of the site. We do not use cookies for analytics, advertising, or marketing tracking.

The only session cookie present in the system relates to a private administration area used exclusively by our staff and is not set for visitors of the public website.

5. Processors and Data Transfers

To operate the site we rely on a trusted service provider, Cloudflare, Inc., which handles hosting (on its global edge network), abuse protection via the Turnstile service, and delivery of email communication on our behalf. Cloudflare acts as our data processor.

Because Cloudflare uses a global network of servers, the processing of technical data may take place outside Bosnia and Herzegovina, including in countries outside the European Economic Area. In such cases we rely on the appropriate safeguards provided by Cloudflare.

We do not sell your data or share it with third parties for marketing purposes. We may disclose data to competent authorities only where required by law.

6. How Long We Keep Data

We keep contact-form data for as long as necessary to handle your inquiry and to maintain a reasonable record of the correspondence, after which we delete or anonymize it. Technical logs are kept only briefly, in line with standard security practices.

7. Your Rights

Under applicable law you have the right to access your data, rectify inaccurate data, request erasure, restrict processing, object to processing, and data portability. Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing before the withdrawal.

You can exercise your rights by sending a request to info@qafana.com. We will respond within a reasonable time and in accordance with the law.

8. Right to Lodge a Complaint

If you believe that our processing of your data infringes data-protection law, you have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (AZLP). We would, however, be glad to try to resolve any concern with you directly first.

9. Children's Privacy

Our website is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

10. Changes to This Policy

We may update this policy from time to time to reflect changes in our operations or in the law. Any change will be published on this page with an updated date. The date at the top of the page indicates when the policy was last updated.