Legal information

Privacy policy

This website is deliberately simple: no contact form, no user accounts, no basket. Correspondingly little personal data arises at all. Everything that is nevertheless processed is set out here in full.

1. Controller

DRVO DIZAJN d.o.o.
Žabljak b.b., 74230 Usora, Bosnia and Herzegovina
Represented by: Fahro Ćostović, owner and managing director
E-mail: drvo.dizajn.usora@gmail.com
Telephone: +387 63 587 265
VAT number: 218644800008 · Company ID: 4218644800008

We have not appointed a data protection officer. Article 37 GDPR does not require one here: our core activity is solid wood manufacturing, not the large-scale regular and systematic monitoring of individuals, and we do not process special categories of personal data on a large scale.

2. Applicable law

We are established in Bosnia and Herzegovina and are subject there to the Law on the Protection of Personal Data ("Zakon o zaštiti ličnih podataka", Official Gazette of BiH 49/06, 76/11, 89/11). The supervisory authority is the Personal Data Protection Agency in BiH (AZLP).

Because this website expressly addresses companies in Germany, Austria, Switzerland, Sweden, Croatia and other European markets, we additionally apply the General Data Protection Regulation (GDPR / Regulation (EU) 2016/679) to the extent that it applies to us under Article 3(2) GDPR. Where the two frameworks differ in strictness, we follow the stricter one.

3. Server log files

When you visit this website our hosting provider automatically records the data your browser transmits: the page requested and the time of access, browser type and version, operating system, referrer URL, the volume of data transferred and the IP address.

Purpose: technical delivery of the page, operational security and error analysis. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in secure and trouble-free operation. This data is not combined with other data sources and is deleted after the retention period configured at the host.

4. Contact by e-mail and telephone

This site contains no contact form. When you click an enquiry button, your own e-mail program opens with a prepared subject and text. No data is transmitted to our website in the process — the message leaves your device only when you send it yourself.

The data you send us (company, name, contact details, project details, technical documents) is processed exclusively to handle your enquiry and to initiate or perform a contract. Legal basis: Article 6(1)(b) GDPR (pre-contractual measures and performance of a contract); for purely informational enquiries, Article 6(1)(f) GDPR.

On request we sign a non-disclosure agreement before you transmit technical documents.

5. Cookies and local storage

This website sets no cookies for marketing, cross-site tracking or profiling.

If traffic measurement is activated, we store your decision from the consent dialogue in your browser's localStorage under the key dd-consent. Only "granted / declined", a version marker and a timestamp are stored. This entry never leaves your device and serves only to avoid asking you again on every page view. You can delete it at any time through your browser settings.

6. Traffic measurement with Google Analytics 4

We reserve the right to use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in order to understand which content is in demand. The service is loaded only after your prior, explicit consent — as long as you do not consent, no Google script is executed and no connection is made to Google servers for this purpose.

Legal basis: Article 6(1)(a) GDPR in conjunction with the national implementation of the ePrivacy Directive. Consent is voluntary; the website works unchanged without it.

The data processed includes: pages viewed, time on page, language, country at national level, device type and enquiry actions triggered (for example a click on "Request a quotation"). IP anonymisation is enabled. There is no combination with other data sources and no profiling.

Withdrawal: you can withdraw your consent at any time with effect for the future — using the button below, by clearing your browser's local storage, or via the Google Analytics opt-out browser add-on.

Withdraw consent / ask me again

7. Google Search Console and Bing Webmaster Tools

We use Google Search Console (Google Ireland Limited) and Bing Webmaster Tools (Microsoft Ireland Operations Limited) to see how our pages appear in search results and whether there are technical errors.

An important distinction: these services place no scripts and no cookies on this website. They evaluate data that arises in the respective search engine anyway and make it available to us only in aggregated form — such as search queries, impressions, clicks and average positions. Individual visitors are not identifiable to us from this. Ownership verification is done through a file or meta tag with no personal reference. Legal basis: Article 6(1)(f) GDPR — legitimate interest in discoverability and technical correctness.

8. Fonts (Google Fonts)

To display the typeface we currently embed Google Fonts from servers of Google Ireland Limited. This establishes a connection to those servers when the page loads and transmits your IP address. Legal basis: Article 6(1)(f) GDPR — legitimate interest in a consistent presentation.

We state openly that embedding external fonts is contested under data protection law. A switch to locally hosted font files, which creates no connection to Google at all, is planned; this section will be removed once it is implemented.

9. Hosting

This website runs with an external hosting provider that processes the server log files on our behalf, on the basis of a data processing agreement under Article 28 GDPR. The provider processes the data solely to provide the website and not for its own purposes.

10. Transfers to third countries

From the perspective of the GDPR, Bosnia and Herzegovina is a third country. Data you send us by e-mail is processed in Bosnia and Herzegovina.

When Google services are used, processing may take place on servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the European Commission's standard contractual clauses apply. Even so, a level of protection fully equivalent to the European one cannot be guaranteed in every case for third-country transfers. Traffic measurement takes place exclusively with your consent (Article 49(1)(a) GDPR).

11. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

12. Your rights

Under the GDPR and the Law on the Protection of Personal Data in BiH you have the right to:

• access to the data held about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing (Art. 21)
• withdraw consent given (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77)

An informal message to drvo.dizajn.usora@gmail.com is enough to exercise these rights. We respond within one month.

13. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. Competent authorities are:

• Personal Data Protection Agency in Bosnia and Herzegovina (AZLP), Sarajevo — for us as the controller
• The data protection authority of your EU member state of residence or work — for you as the data subject

14. Data security

The website is delivered exclusively over an encrypted HTTPS connection. We take appropriate technical and organisational measures under Article 32 GDPR to protect your data against loss, manipulation and unauthorised access.

15. Changes to this policy

We adapt this privacy policy when the legal situation or the actual data processing changes — for example when traffic measurement is actually activated or the typeface is hosted locally. The version published here at the time applies.

Retention at a glance

How long which data stays with us:

Version of this text: 12 August 2026.