1. Controller
The controller of the personal data described in this policy is VONITO d.o.o. Bihać, Muhsina Rizvića 25, 77000 Bihać, Bosnia and Herzegovina, email info@vonito.ba, telephone +387 61 964 513. We process data in accordance with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH, No. 12/25) and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Who this policy applies to
- Users: persons who have access to a company account on the VONCON platform.
- Persons who contact us or visit the voncon.app website.
We process end customers' data that companies enter or receive through the configurator (enquiries, quotes, orders) on behalf of the company. For that data, the company is the controller, and our obligations are governed by the Data Processing Agreement. End customers should address requests concerning their rights to the company to which they submitted the enquiry.
3. What data we process and why
- Account data: first and last name, email, telephone (if provided), language, password (only as a protected hash), the secret key for two-factor authentication (encrypted), roles and permissions. Purpose: providing the Platform under the contract.
- Company data: name, address, country, currency, tax status, settings. Purpose: contract and billing.
- Security and technical logs: IP address, browser type, login time, change log (who changed what and when). Purpose: security, detection of misuse and evidence of actions, on the basis of our legitimate interest.
- Acceptance of terms: version and time of acceptance. Purpose: evidence of the contract.
- Communication and support: content of messages. Purpose: responding to enquiries and performance of the contract.
- Billing data: invoicing and payment data. Purpose: contract and legal obligations (accounting).
We do not sell personal data and do not use it for advertising. We do not make decisions about individuals based solely on automated processing.
4. Cookies
We use only cookies that are strictly necessary for operation: the login cookie (voncon_session), form protection (voncon_csrf) and the remembered language (voncon_lang). We do not use cookies for analytics or advertising, and therefore do not request consent for them.
5. How long we keep data
- Account and company data: for the duration of the contract, and for 30 days after termination to allow export; thereafter it is deleted.
- Security logs and change log: up to 12 months, unless needed for longer for the establishment or defence of a legal claim.
- Invoices and accounting records: for as long as required by accounting regulations.
- Backups: 30 days, after which they are deleted automatically.
6. Recipients of data
Data is processed only by authorised VONITO personnel and by processors who provide services to us, under a data processing agreement and with appropriate safeguards:
- Hostinger International Ltd. (Cyprus), data centre in Germany: the server on which the Platform runs.
- Backblaze, Inc., EU Central data centre (Amsterdam, Netherlands): encrypted backups.
- Sendinblue SAS (Brevo), Paris, France: sending Platform emails.
We disclose data to public authorities only where we are required to do so by law.
7. Transfers outside BiH and the EU
Data is stored in the European Union. Where a service provider is established outside the EU, the transfer is based on an adequacy decision or standard contractual clauses.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Send your request to info@vonito.ba; we respond within 30 days at the latest.
You have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina and, if you live in the EU, also with the supervisory authority in your country.
9. Security
Data is transmitted in encrypted form (HTTPS), each company's data is separated at database level, access is restricted by roles and two-factor authentication, and backups are encrypted. Details are set out in Annex 2 to the Data Processing Agreement.
10. Changes
We notify Users of material changes to this policy by email or in the application.