Draft — legal review required before publishing.

This policy explains what personal data we collect through the shpp.ba website, why we collect it, how long we keep it and what rights you have. We process personal data in accordance with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH No. 12/25), which has applied since 4 October 2025 and is aligned with the EU General Data Protection Regulation (GDPR).

1. Who is the controller

SHPP d.o.o. Sarajevo Kasima ef. Dobrače 17, 71000 Sarajevo, Bosnia and Herzegovina Email: shpp@shpp.ba · Phone: +387 61 214 113

For any data protection questions, email shpp@shpp.ba with the subject “Data protection”.

2. What data we collect and why

Contact form

Data: name, email, phone (optional), company (optional), subject and message. Purpose: replying to your enquiry. Legal basis: steps taken at your request prior to a possible contract, and our legitimate interest in responding to enquiries.

Quote form

Data: name, email, phone, company, client type, location (municipality/city), services requested, consumption and electricity bill data, roof type and area, connection capacity, timeline, financing preference and message. Purpose: preparing a quote and technical assessment. Legal basis: steps taken at your request prior to entering into a contract.

Support form

Data: name, email, phone, company, project reference, problem category and urgency, description. Purpose: handling a fault report or support request. Legal basis: performance of a contract and our legitimate interest in supporting the systems we have installed.

We receive form submissions by email and, for reliable record-keeping, also store a log of each submission in a protected area of the server that is not accessible from the internet.

AI assistant (chat)

Data: the content of messages you type into the chat, the language and the page where you opened the chat. Purpose: answering your questions about our services. Legal basis: our legitimate interest in giving visitors quick information; using the chat is voluntary.

To generate replies, messages are sent to the AI service provider OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C., USA), which processes them as a processor on our behalf (see section 4). Please do not enter sensitive personal data in the chat (e.g. health information, ID or bank account numbers). If you would like us to contact you, please use the contact form.

If you accept it in the cookie settings, we use Google Analytics 4 to understand how visitors use the site (pages visited, traffic source, device type, approximate city/country location, events such as form submissions or phone clicks). We use Google Consent Mode v2: until you give consent, no analytics or advertising cookies are set. Legal basis: your consent, which you can withdraw at any time.

If you accept it, Google Ads may measure whether a visit from an ad led to an enquiry (conversion) and show you relevant ads. Legal basis: your consent.

Technical data

When you visit, the server automatically logs technical data (IP address, access time, requested page, browser) for security and troubleshooting. Forms also include spam protection that does not use cookies. Legal basis: our legitimate interest in website security.

3. How long we keep data

Data	Retention period
Contact enquiries with no further cooperation	up to 24 months from the last communication
Quote requests	up to 36 months, or for the duration of the contract plus statutory periods
Support requests	for the warranty/maintenance period of the system plus statutory periods
Chat messages on our side	we do not permanently store conversation content beyond technical logs; see section 4 for OpenAI
Analytics data (GA4)	14 months (Google Analytics setting)
Server logs	up to 90 days

We do not sell personal data. We share it only with service providers who process it on our behalf and on our instructions:

the website and email hosting provider,
OpenAI (OpenAI Ireland Ltd, Dublin / OpenAI, L.L.C., San Francisco, USA) — processing of AI assistant messages. Under OpenAI’s terms for API customers, data sent through the API is not used to train models by default and is retained for up to 30 days for abuse monitoring, then deleted, unless the law requires otherwise.
Google Ireland Limited / Google LLC — Google Analytics and Google Ads, only with your consent,
GitHub, Inc. — the website content repository (contains no form data).

Transfers outside BiH

OpenAI and Google may process data in the United States and other countries outside Bosnia and Herzegovina. We make such transfers only with appropriate safeguards provided for by law, such as standard contractual clauses or other legally recognised mechanisms.

5. Your rights

Under the law you have the right to:

access your personal data and receive a copy,
request rectification of inaccurate data,
request erasure (“right to be forgotten”) where there is no longer a basis for processing,
request restriction of processing,
object to processing based on legitimate interest,
request portability of data you have provided to us,
withdraw consent at any time (e.g. for analytics), without affecting the lawfulness of earlier processing.

Send requests to shpp@shpp.ba. We will respond without undue delay, within the time limits set by law. To protect your data, we may ask you to verify your identity.

If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina.

6. Security

The site uses an encrypted connection (HTTPS). Form data is accessible only to authorised staff who need it to handle enquiries. Keys for external services are stored only on the server and are never sent to the browser.

7. Minors

The site and services are intended for business users and adults. We do not knowingly collect data from children.

8. Cookies

For details on cookies and how to change your consent, see our Cookie Policy.

9. Changes to this policy

We may update this policy from time to time. The date of the last change is shown at the top of the page.

Privacy Policy