1. Who we are
LOVEBOSNIA is a professional networking platform for Bosnia and Herzegovina and its diaspora, operated by [COMPANY LEGAL NAME d.o.o.], [STREET, POSTCODE SARAJEVO, BOSNIA AND HERZEGOVINA] (registration number [REGISTRATION / MBS NUMBER], tax number [JIB / PDV NUMBER]). We are the data controller for the personal data described in this policy.
For any question about this policy, or to exercise the rights in section 9, contact privacy@lovebosnia.com.
Because we serve users in the European Economic Area as well as in Bosnia and Herzegovina, we apply the EU General Data Protection Regulation (GDPR) and the BiH Zakon o zaštiti ličnih podataka to all of our processing.
2. What we collect
We only collect what the platform actually needs. In practice that is:
Data you give us when you register
- Name and email address — required to create an account.
- Password — stored only as a salted one-way hash. We never store or can read your password.
- A six-digit verification code — sent to your email and deleted as soon as you verify, or after it expires (15 minutes).
- A public profile URL derived from your name.
If you sign in with Google
- We receive your email address, name and profile picture from Google. We do not receive your Google password.
- Because Google has already verified the address, we skip our own email verification step.
- If the email matches an existing account, we link to it rather than creating a duplicate.
Profile information you choose to add
- Profile photo, cover image, headline, biography and location.
- Work experience, education, publications and testimonials.
All of this is optional. Anything you put on your profile is visible to other signed-in members.
Content and activity
- Posts you publish, including up to two images and one video per post.
- Direct messages and the conversations they belong to.
- Connection requests you send, accept or decline.
- Notifications generated by that activity.
Data collected automatically
- Session data — an IP address, browser user-agent string and session timestamp, stored so we can keep you signed in and detect abuse.
- Essential cookies, described in our Cookie Policy.
We do not run analytics, advertising or tracking scripts, and we do not build behavioural profiles of you or sell your data to anyone. The one third-party script we load is Google reCAPTCHA, on the contact and migration inquiry pages only, purely to keep spam out — see section 5.
If you use our contact or migration forms
- Contact form: your first name, email address, subject and message.
- Migration inquiry form: your first name, last name, email address and message.
These reach us by email. You do not need an account to use them.
3. Why we process it, and on what legal basis
GDPR requires us to name a lawful basis for each purpose. Ours are:
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account; show your profile to other members | Registration and profile data | Performance of a contract — Art. 6(1)(b) |
| Verify your email address | Email, verification code | Performance of a contract — Art. 6(1)(b) |
| Deliver posts, messages and connections | Content and activity data | Performance of a contract — Art. 6(1)(b) |
| Keep you signed in; protect against abuse and fraud | Session data, IP address, user-agent | Legitimate interests — Art. 6(1)(f) |
| Suggest people you may want to connect with | Profile fields and existing connections | Legitimate interests — Art. 6(1)(f) |
| Answer contact and migration inquiries | The details you submit in the form | Legitimate interests / steps prior to a contract — Art. 6(1)(f), 6(1)(b) |
| Tell real form submissions apart from automated spam | IP address, browser and interaction signals (via Google reCAPTCHA) | Legitimate interests — Art. 6(1)(f) |
| Meet legal, accounting and regulatory duties | As required | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You may object to that processing at any time — see section 9.
4. Automated decision-making
Our "Recommended for you" suggestions are generated automatically by comparing profile fields and existing connections. This is not automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Art. 22 — it only changes the order in which people appear in your feed, and it has no bearing on your access to the platform.
5. Who we share it with
We do not sell personal data. We share it only with the following categories of recipient:
- Other members. Your name, profile URL, photo, headline, location, biography and posts are visible to signed-in members. Direct messages are visible only to participants in that conversation.
- Brevo (Sendinblue SAS, France) — our transactional email provider. It processes your email address and name in order to deliver verification codes and service messages. Data stays within the EU.
- Google Ireland Ltd. — only if you choose to sign in with Google, and only for authentication.
- Our hosting provider, which stores the database and uploaded files on our behalf.
- Google (reCAPTCHA) — our contact and migration inquiry pages are protected by reCAPTCHA v3, which distinguishes real people from automated spam. Google receives your IP address, information about your browser and how you interacted with the page, and returns a score to us. We never receive the underlying data. This runs on those two pages only. See Google's privacy policy.
- Authorities, where we are legally compelled to disclose, and only to the extent required.
Job listings shown on the platform are retrieved by our servers from the external board pronadjiposao.ba. That request is made by us, not by your browser: no personal data about you is sent to that board, and it sets no cookies on your device. If you click through to an individual listing, you leave our site and that board's own policies apply.
Each processor acts on our documented instructions under a written data processing agreement.
6. International transfers
Our processing takes place in Bosnia and Herzegovina and the European Union. Bosnia and Herzegovina is not the subject of a European Commission adequacy decision, so where personal data of EEA residents is transferred here we rely on the European Commission's Standard Contractual Clauses together with supplementary technical measures (encryption in transit, access control). You can request a copy of the safeguards by writing to privacy@lovebosnia.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | Until you delete your account, then removed within 30 days |
| Posts and uploaded media | Until you delete them, or until account deletion |
| Direct messages | Until account deletion; a copy may remain visible to the other participant |
| Email verification codes | 15 minutes, or immediately on successful verification |
| Session records (IP, user-agent) | Cleared when the session expires — 120 minutes of inactivity |
| Contact and migration inquiries | Up to 24 months from last correspondence |
| Records kept for accounting or legal reasons | As long as the applicable law requires |
Backups are overwritten on a rolling cycle, so deleted data may persist in backup media for a short period after removal from the live system.
8. How we protect it
- Passwords are hashed with a modern, salted, one-way algorithm — never stored in readable form.
- Traffic is served over HTTPS.
- Session cookies are HTTP-only and use the
SameSite=Laxattribute, and every state-changing form is CSRF-protected. - Access to production data is limited to personnel who need it.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform you without undue delay where the risk is high.
9. Your rights
You have the right to:
- Access the personal data we hold about you, and receive a copy.
- Rectify anything inaccurate — most of it you can edit yourself under Edit Profile.
- Erase your data ("right to be forgotten").
- Restrict or object to processing based on legitimate interests.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time, where processing is based on consent. This does not affect processing already carried out.
- Complain to a supervisory authority.
Write to privacy@lovebosnia.com to exercise any of these. We respond within 30 days, extendable by two further months for complex requests, in which case we will tell you why. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You can complain to the BiH Agencija za zaštitu ličnih podataka (Personal Data Protection Agency) in Sarajevo, or — if you are in the EEA — to the supervisory authority where you live or work.
10. Children
The platform is intended for working professionals. You must be at least 16 years old to hold an account. We do not knowingly collect data from children below that age; if we learn that we have, we delete the account and its data. If you believe a child has registered, write to privacy@lovebosnia.com.
11. Changes to this policy
We may update this policy as the platform changes. The "last updated" date at the top always reflects the current version. Where a change materially affects your rights we will notify you by email or through a prominent notice on the platform before it takes effect.