Notice on the processing of personal data through the website
Dear Sir/Madam,
Pursuant to Article 15 of the Personal Data Protection Act (“Official Gazette of Bosnia and Herzegovina”, No. 12/2025 – the “Act”), the Limited Liability Company for Production “Mlijekoprodukt” Kozarska Dubica, with its registered seat at Vrioci bb, Kozarska Dubica (hereinafter: the “Controller”) hereby provides you with information on the conditions under which it processes your personal data (hereinafter: “you” or the “Data Subject”).
1. Data Controller
Limited Liability Company for Production “Mlijekoprodukt” Kozarska Dubica
Address: Vrioci bb, Kozarska Dubica
ID No. (JIB): 4400737790005
Phone No.: 052/448-244
e-mail: zastita.licnih.podataka@mlijekoprodukt.com
2. Contact for communication with data subjects
You may contact the person responsible for communication with data subjects for any questions regarding the processing of your personal data, as well as to exercise your rights related to the processing of personal data, in one of the following ways:
- electronically, at the e-mail address: zastita.licnih.podataka@mlijekoprodukt.com
- in writing, to the address of the Company’s registered seat (see item 1 above);
- by telephone, at: 052/448-244
3. Categories of personal data we process
The Controller processes the following categories of your personal data:
- technical identification data: IP address
- security and administrative data: technical log records necessary for the functioning and security of the website
- data you voluntarily provide through the website: e-mail address
4. Purpose of processing
We process your personal data for the following purposes:
- ensuring the technical functioning of the website
- administration and maintenance of the website
- enabling communication with website users.
5. Legal grounds for processing
The collection of personal data through the website is based on the Company’s legitimate interest as controller, which includes:
- Ensuring the functioning of the website.
- Security of the website.
- Administration of the website.
The collection of data is also based on your consent, where given when accessing the website, with respect to analytical and promotional cookies. We also collect data on the basis of Article 8, paragraph 1, item b) of the Act, where the processing is necessary in order to take action at your request prior to entering into a contract, by submitting an inquiry through the contact form or by e-mail.
6. Sources of data collection
The source of data collection is the information you provide to us, as well as information collected through cookies.
7. Recipients of personal data
To the extent necessary and in compliance with all relevant regulations, the data we process about you may be forwarded to:
- third parties (processors) with whom we have concluded a personal data processing agreement, namely providers of website maintenance services, under which it is envisaged that: (i) the processor is obliged to process personal data only on the basis of the Controller’s prior written instructions, and (ii) the processor is obliged to apply appropriate personal data protection measures. Upon request, we will provide you with a list of processors of your personal data.
8. Transfer of personal data to other countries
If it becomes necessary for us to process your personal data through hosting and cloud services whose servers are located outside Bosnia and Herzegovina, or in the event of the transfer of your data out of Bosnia and Herzegovina, the Controller will transfer such data outside Bosnia and Herzegovina if:
- it has been determined by a decision of the Council of Ministers of Bosnia and Herzegovina that the country, part of its territory, one or more sectors within that country, or the international organization to which we transfer the data, ensures an adequate level of protection of personal data;
- it has been determined by the European Union that the other country, part of its territory, one or more sectors within that country, or the international organization ensures an adequate level of protection of personal data; the list of countries is available here;
- we apply appropriate safeguard measures in accordance with the Act;
- you have given us your consent to the transfer of data to countries for which an adequate level of protection does not exist.
9. Personal data retention periods
We will retain your personal data in accordance with the Act for the minimum period necessary to achieve the purposes of processing set out in this Notice. Below are the periods and criteria used to determine the periods for which we retain your personal data.
As a rule, we retain your personal data as follows:
- For standard inquiries (e.g., terms of cooperation, prices), data you provide to us via inquiries by e-mail or contact form is retained for a maximum of 6 months from the date the inquiry was resolved. Exceptionally, where the nature of the inquiry gives rise to an obligation to retain data for a longer period (e.g., a consumer complaint), we retain the data for the periods prescribed by the applicable legal regulations governing the specific situation;
- Data collected through cookies is retained for the periods specified in the Cookie Policy, which can be found at the following link: https://mlijekoprodukt.com/en/cookie-policy/.
Data we process on the basis of your consent is retained and processed until you withdraw your consent, or for the minimum period necessary to achieve the purposes of processing set out in this Notice, whichever is longer.
Upon expiry of the data retention period, determined in accordance with the criteria set out above, the Controller will permanently and securely delete/destroy your personal data.
10. Rights of the Data Subject
We inform you of the following rights regarding the processing of your personal data:
- the right to withdraw your consent at any time, where the processing of personal data is based on your consent, provided that the withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal;
- the right to request information on the processing of your data carried out by the Company;
- the right of access, including the right to a copy of your personal data processed by the Company, under the conditions set out in the Act;
- the right to rectification of inaccurate personal data and/or completion of incomplete personal data;
- the right to erasure of your personal data, under the conditions set out in the Act (e.g., where the purpose for which the data was collected or processed has been fulfilled; where consent to processing has been withdrawn and no other legal basis for processing exists; and other cases);
- the right to restriction of processing, under the conditions set out in the Act (e.g., in the case of unlawful processing; where the Data Subject contests the accuracy of the data; and other cases);
- the right to receive the personal data you have previously provided to us in a structured, commonly used and machine-readable format, and to transmit such data to another controller, under the conditions set out in the Act;
- the right to lodge a complaint with the Controller and with the Personal Data Protection Agency of Bosnia and Herzegovina.
Communication with you and the handling of requests for the exercise of your rights are free of charge. However, in the case of manifestly unfounded or excessive requests, particularly where they are repeated frequently, we may charge a fee in the amount of the administrative costs incurred in handling such requests.
11. Legal remedies
You have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina if you consider that, through the processing of your personal data, we are in breach of the Act, without prejudice to other administrative or judicial remedies.
Contact details of the Agency:
- Address: Dubrovačka no. 6, Sarajevo
- Telephone: 00 387 33 726 250
- e-mail: azlpinfo@azlp.ba
- Fax: 00 387 33 726 251
Note: please verify the contact details of the Personal Data Protection Agency of Bosnia and Herzegovina on its official website.
You have the right to initiate administrative proceedings against a decision of the Agency before the Court of Bosnia and Herzegovina within the time limits prescribed by the Act, without prejudice to other administrative or extrajudicial remedies.
You have the right to judicial protection if you consider that your rights under the Act have been violated as a result of the processing of your personal data, without prejudice to other administrative or extrajudicial remedies, including the right to lodge a complaint with the Agency.
12. Consequences of (not) providing personal data
The provision of personal data when accessing and using the website is, with respect to technical and security data, necessary in order to enable the functioning, security and administration of the website.
With respect to personal data voluntarily provided by the user through the website (e.g., through contact forms), the provision of such data is voluntary. Failure to provide such data may prevent the Company from responding to the user’s inquiry or from communicating through the website.
Failure to give consent to the processing of personal data that is processed on the basis of consent (e.g., non-essential cookies) does not affect the ability to use the basic functionalities of the website.
13. Automated decision-making and profiling
The Controller does not process personal data relating to you exclusively by automated means, does not carry out profiling in relation to your personal data, and does not make individual decisions based solely on automated processing or profiling.