Privacy Policy
1. Introduction
This Privacy Policy explains how SSC d.o.o. ("we", "us", "our") collects, uses, stores and protects your personal data when you use the Balkanposao platform, available at balkanposao.com and through the Balkan Posao mobile application for iOS and Android (the "Platform").
We are committed to protecting your personal data in accordance with the Law on Personal Data Protection of Bosnia and Herzegovina and the EU General Data Protection Regulation (GDPR, EU 2016/679).
Please read this policy carefully before using the Platform. By registering an account, you confirm that you have read and understood this policy.
2. Data Controller
The data controller responsible for your personal data is:
SSC d.o.o. Rosulje 38 74264 Jelah Bosnia and Herzegovina ID number: 4218791850002
Privacy contact: privatnost@balkanposao.com
For all data protection enquiries, including requests to exercise your rights, please contact us at the address above.
3. Data We Collect
3.1 Account registration
When you create an account, we collect:
- Email address
3.2 Profile information
After registration, you may complete your profile with the following information:
- First name and last name
- Phone number
- Address and country of residence
- Driving licence categories
- Education (completed programmes and institutions)
- Foreign language skills
- Work experience (employer name, position, period of employment)
- Profile photo
The profile photo is optional. All other profile information (name, surname, contact details, education, work experience) is required in order to apply for job listings.
3.3 Usage data
When you use the Platform, we automatically collect:
- IP address
- Browser type and version, or mobile application version
- Device operating system
- Pages visited and features used
- Date and time of access
- Session duration
3.4 Chat communications
The Platform enables message exchange between users. Text messages are stored for the duration of your account. Files you send via chat (e.g. a CV in PDF format) are transmitted directly to the recipient — we do not permanently store those files on our servers and do not have access to their content.
3.5 Communications with us
If you contact us by email or through the Platform, we retain records of that correspondence.
4. Legal Basis for Processing
| Purpose | Legal basis |
| Account registration and Platform access | Performance of a contract (GDPR Art. 6(1)(b)) |
| Displaying your profile to relevant employers | Performance of a contract (GDPR Art. 6(1)(b)) |
| Sending transactional emails | Performance of a contract (GDPR Art. 6(1)(b)) |
| Improving the Platform and analysing usage | Legitimate interests (GDPR Art. 6(1)(f)) |
| Sending job alerts and news notifications | Consent (GDPR Art. 6(1)(a)) |
| Compliance with legal obligations | Legal obligation (GDPR Art. 6(1)(c)) |
| AI-assisted features (translation of listings and messages) | Legitimate interests (GDPR Art. 6(1)(f)) |
5. How We Use Your Data
We use your personal data to:
- Create and manage your account
- Display your profile to registered employers and agencies on the Platform
- Match your profile with relevant job listings
- Send transactional emails (registration confirmation, password reset)
- Send job alerts and news notifications, where you have given consent
- Enable communication between users via chat
- Improve the Platform through usage analysis
- Comply with applicable legal obligations
- Respond to your enquiries and support requests
- Detect and prevent fraud or misuse
6. Profile Visibility
Your profile is not publicly accessible and cannot be viewed by search engines (such as Google) or unregistered visitors. Your profile is visible exclusively to:
- Registered users, employers and agencies on the Platform
- SSC d.o.o. staff for the purpose of matching candidates with job opportunities
7. AI-Assisted Features
The Platform uses artificial intelligence services to enhance your experience:
Job listing translation: Job listings may be translated into multiple languages using DeepL or Anthropic to make them accessible to users who speak different languages.
Message translation: Messages exchanged via chat may be translated using the above services to facilitate communication between users who speak different languages. Message content is processed solely for the purpose of translation and is not used to train AI models.
These services are governed by data processing agreements that prohibit the use of your data for training or any purpose beyond the translation service provided.
8. Data Processors and Third Parties
We work with the following third-party service providers who process data on our behalf:
| Processor | Purpose | Location |
| Amazon Web Services EMEA SARL | Cloud hosting and file storage (profile photos) | EU (Frankfurt, Germany) |
| Google Firebase (Google Ireland Ltd) | User authentication | EU |
| Brevo (Sendinblue SAS) | Transactional and marketing emails | EU (France) |
| Anthropic PBC | Content and message translation | USA (EU SCC in place) |
| DeepL SE | Content and message translation | EU (Germany) |
All processors are bound by data processing agreements and are contractually required to protect your data in accordance with GDPR.
9. Tracking and Analytics (Website Only)
The following tracking technologies are used on our website (balkanposao.com) only, not within the mobile application:
- Google Analytics — website traffic analysis
- Meta Pixel — advertising performance measurement
- LinkedIn Insight Tag — conversion tracking for LinkedIn advertising campaigns
- Microsoft Advertising (UET Tag) — conversion tracking for Microsoft advertising campaigns
Your consent is obtained via our cookie banner before any non-essential tracking is activated. You may withdraw consent at any time through our cookie preference centre.
10. International Data Transfers
Your data is stored on servers located in the European Union (Frankfurt, Germany). SSC d.o.o. is located in Bosnia and Herzegovina. Transfers of data to service providers in the USA (Anthropic) are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission.
11. Data Retention
| Data type | Retention period |
| Account and profile data | For the duration of your account, plus 30 days after deletion |
| Inactive accounts | 3 years of inactivity → email notification → 30 days → deletion |
| Chat messages | For the duration of your account, deleted upon account deletion |
| Usage and technical logs | 12 months |
| Marketing consent records | Until consent is withdrawn, plus 3 years |
After the applicable retention period, your data is permanently deleted or anonymised.
12. Your Rights
Under the Law on Personal Data Protection of BiH and GDPR, you have the following rights:
- Right of access — request a copy of the data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data
- Right to restriction — request that we limit how we process your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — withdraw consent at any time for consent-based processing
To exercise any of these rights, contact us at privacy@balkanposao.com. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Agency for Personal Data Protection of Bosnia and Herzegovina.
13. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit (TLS/HTTPS)
- Encryption at rest on AWS S3
- Access controls and authentication via Firebase
- Regular security reviews
- Restricted access to personal data on a need-to-know basis
14. Children
The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data from persons under 18. If we become aware that a user is under 18, we will delete their account and associated data without delay.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or via a notification on the Platform. Your continued use of the Platform after notification constitutes acceptance of the updated policy.
16. Governing Law
This Privacy Policy is governed by the laws of the Federation of Bosnia and Herzegovina. Any disputes arising under this policy shall be subject to the jurisdiction of the courts in Zenica.