Privacy Policy
Last updated: July 2026
1. Who we are
The data controller within the meaning of the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of B&H, no. 12/2025) is:
EFANNO
PG Skenderija, 71000 Sarajevo, Bosnia and Herzegovina
ID number: 4202644110008
Email: [email protected]
Phone: +387 62 545 070
Web: efanno.com
EFANNO is an accounting, tax, and business advisory agency. This website (efanno.com) is an informational/corporate site - no services are sold and no online transactions take place through it. The site is used to present our services, book free consultations, and establish contact with prospective and existing clients.
2. What data we collect and why
2.1 Contact form and service quote form data
When you fill in the contact form or the quick quote form on an individual service page, we process: your full name, company name (if provided), email address, phone number (if provided), the content of your message, and the date and time the inquiry was sent. We use this data solely to respond to your inquiry and to continue business communication at your request. It is not shared with third parties without your consent and is not used for marketing purposes.
2.2 Personalized offer tool (questionnaire)
On the homepage we offer a short 3-question quiz that helps you find a suitable service package. Your answers are processed entirely locally, in your browser, to display an indicative result - they are not transmitted to or stored on our servers. Your data is only transmitted if you choose to book a free consultation or contact us.
2.3 Data when booking a consultation
Free consultations are booked using Google Calendar. When you book a time slot, Google collects the data you enter (name, email address, and any other information you provide) on our behalf, in order to confirm the appointment and send reminders. This data is processed in accordance with Google's Privacy Policy and our instructions as controller.
2.4 Automatically collected data (analytics)
This site does not currently use any web analytics or marketing tracking tools. If we enable such a tool in the future (e.g. Google Analytics), technical visit data (anonymized IP address, browser type, device, pages visited) will only be collected with your prior consent via the cookie banner, and you will be notified through an update to this policy.
2.5 Server technical logs
Our hosting provider automatically logs technical data for every request made to the web server (access logs): the visitor's IP address, requested URL, HTTP response status code, browser type and version (User-Agent), and the date and exact time of the request. These logs are collected on the basis of legitimate interest in ensuring the security, stability, and proper functioning of the site, and are automatically deleted after 30 days.
2.6 Cookies
We use necessary cookies, and, if enabled in the future, analytics and marketing cookies. A detailed overview is available in our Cookie Policy.
3. Legal basis for processing
Every instance of personal data processing must be based on one of the legally prescribed grounds. Below is the basis for each processing purpose:
| Processing purpose | Legal basis | Art. of Law (12/2025) |
|---|---|---|
| Responding to inquiries via the contact form / quote form | Legitimate interest / pre-contractual communication | Art. 6(1)(b) and (f) |
| Booking consultations via Google Calendar | Performance of steps taken at the data subject's request prior to entering into a contract | Art. 6(1)(b) |
| Site analytics (if enabled) | Consent | Art. 6(1)(a) |
| Marketing cookies (if enabled) | Consent | Art. 6(1)(a) |
| Necessary cookies (site functionality) | Controller's legitimate interest | Art. 6(1)(f) |
| Server technical logs (security and stability) | Controller's legitimate interest | Art. 6(1)(f) |
Consent within the meaning of the Law is voluntary, specific, informed, and unambiguous. You may withdraw it at any time via the cookie settings in the footer of the page - without any negative consequences. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
4. Sharing data with third parties
We may forward your data to the following recipients:
- Google LLC - provider of Google Calendar for booking consultations, and, if enabled, Google Analytics for web analytics. Google processes data on our behalf as a data processor, in accordance with Google's data processing terms. More information: policies.google.com/privacy
- Hosting provider - [hosting provider name and location - to be filled in before publishing]. The hosting provider acts as a data processor and has no right to use your data for its own purposes.
We do not sell, rent, or share your personal data with third parties for commercial purposes.
5. Where data is stored
Data processed within the site (server logs, cookies, contact inquiries) is stored with our hosting provider, [name and location - to be filled in before publishing].
Data processed via Google Calendar (booking) and, if enabled, Google Analytics, is processed on Google LLC's servers, located outside B&H (mainly in the EU and the US). In these cases, data transfer relies on appropriate safeguards (standard contractual clauses or certification schemes) in accordance with Art. 44 et seq. of the Law.
6. Retention periods and how data is kept
In line with the storage minimization principle under the Law on Personal Data Protection (Official Gazette of B&H, no. 12/2025), we keep data only for as long as necessary for the purpose it was collected for, or as required by law.
| Type of data | Retention period | Basis for the period |
|---|---|---|
| Server technical logs (access logs) | 30 days | Legitimate interest - system security and diagnostics |
Consent cookie (efanno_consent) | 365 days | Legitimate interest - remembering your consent/refusal choice |
| Contact and quote inquiries (name, email, message) | Up to 2 years from the last communication | Legitimate interest - record of business communication |
| Booked appointment data (Google Calendar) | In line with Google's retention periods / until the business need lapses | Performance at the data subject's request |
| Analytics data (if enabled) | 14 months (aggregated reports) | Consent |
For requests to delete data held on our servers, please send a request to [email protected]. We will process the request within 15 business days and notify you in writing of the measures taken.
7. Security and data protection
We take appropriate technical and organizational security measures in accordance with Art. 32 of the Law on Personal Data Protection of B&H to ensure a level of security appropriate to the risk, including:
- HTTPS/TLS encryption - all communication between your browser and our server is encrypted using TLS 1.2 or newer.
- Regular security updates - the software powering the site is updated in line with vendor recommendations.
- Restricted access to data - only staff and collaborators who need it for their work have access.
- Regular backups - maintained by our hosting provider.
In the event of a personal data breach that could jeopardize your rights, we will notify the competent supervisory authority (the Personal Data Protection Agency of B&H) and, where applicable, you personally - within the timeframes prescribed by law.
8. Your rights under the Law on Personal Data Protection of B&H
In accordance with the Law on Personal Data Protection (Official Gazette of B&H, no. 12/2025), you have the following rights regarding your personal data:
- Right of access (Art. 15) - you may request confirmation of whether we process your data and, if so, a copy of that data.
- Right to rectification (Art. 16) - you may request correction of inaccurate or completion of incomplete data.
- Right to erasure - the "right to be forgotten" (Art. 17) - you may request deletion of your data once it is no longer necessary for the purpose it was collected for, you withdraw consent, or it is processed unlawfully.
- Right to restriction of processing (Art. 18) - you may request a temporary suspension of processing while a dispute over accuracy or lawfulness is resolved.
- Right to object (Art. 21) - you may object at any time to processing based on the controller's legitimate interest.
- Right to data portability (Art. 20) - for data processed automatically on the basis of consent, you may request transfer in a structured, machine-readable format.
- Right to withdraw consent - you may withdraw it at any time by clicking "Manage cookie settings" in the page footer, or by sending a request to [email protected].
Send requests to exercise any of the above rights to [email protected]. We will respond within 30 calendar days of receiving the request. In exceptionally complex cases the deadline may be extended by a further 60 days, of which we will inform you in a timely manner. The service is free of charge, except in the case of manifestly unfounded or excessive requests.
9. Data protection contact
For any questions regarding this policy, the processing of your data, or exercising your rights, please contact us:
EFANNO
PG Skenderija, 71000 Sarajevo, B&H
Email: [email protected]
Phone: +387 62 545 070
10. Supervisory authority
You have the right to lodge a complaint with the competent supervisory authority for personal data protection in Bosnia and Herzegovina, without first contacting us, if you believe our processing of your data violates the Law:
Personal Data Protection Agency of B&H
Dubrovačka 6, 71000 Sarajevo, Bosnia and Herzegovina
Tel: +387 33 726 600
Web: www.azlp.ba
Email: [email protected]
However, we recommend contacting us first so we can resolve the issue quickly and directly.
11. Changes to this policy
We reserve the right to amend this policy in line with changes in legislation or in how we process data. The date of the last update is shown at the top of the document. We will notify you of significant changes via a notice on the site.