Privacy policy

Ajdin Podrinja, Grow — Webentwicklung & Digitalmarketing, 71000 Sarajevo, Bosnia and Herzegovina
Email: info@grow.ba

The controller is established in Bosnia and Herzegovina, i.e. outside the EU. As our services are aimed at people and businesses in Germany and the EU, we process your data in accordance with the GDPR (Art. 3(2) GDPR).

No representative in the Union under Art. 27 GDPR has been appointed at present. We rely on the exemption in Art. 27(2)(a) GDPR (occasional processing only, no special categories of personal data, low risk). You can reach us directly at the address above for any data protection matter.

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Server functions run in the Frankfurt am Main region (fra1); static content is delivered through Vercel's global network.

When you visit the website, technically necessary data is processed: IP address, date and time, page requested, referrer, browser and operating system. This is required to deliver and secure the website (Art. 6(1)(f) GDPR). Vercel keeps server logs for a short period and then deletes them.

We have a data processing agreement with Vercel. Vercel is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition. More information: vercel.com/legal/privacy-policy.

When you request a demo or a quote or contact us, we process the details you provide: name, company, email address, phone number, preferred timeframe and any optional information (message, website, uploaded files such as a logo or photos).

The purpose is to handle your request, build the demo and get in touch with you. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Your details are sent by email to our mailbox (email hosting with our hosting provider in Bosnia and Herzegovina). Uploaded files are stored with Vercel Blob (Vercel Inc., see section 3). Bosnia and Herzegovina has no EU adequacy decision; the transfer takes place because it is necessary to carry out pre-contractual measures at your request (Art. 49(1)(b) GDPR).

We delete your data once the enquiry is closed and no statutory retention obligations apply — if no contract is concluded, after 24 months at the latest.

To protect against spam, our forms contain an invisible check field and measure the time taken to fill them in; your IP address is briefly processed in memory for this purpose (Art. 6(1)(f) GDPR).

So that we know which channel brought you to us (e.g. Google search or an ad), we store campaign parameters (utm parameters, gclid, fbclid), the referrer and the landing page in your browser's local storage on your first visit. This data only leaves your device if you submit a form yourself, and is then sent along with your enquiry.

The legal basis for storing it on your device is § 25(2) no. 2 TDDDG; for processing it with your enquiry, Art. 6(1)(f) GDPR (measuring the effectiveness of our advertising). You can delete it at any time by clearing this website's data in your browser.

Technically necessary storage — such as your choice in the cookie banner — is based on § 25(2) no. 2 TDDDG.

Analytics and marketing services (sections 7 and 8) are only loaded after you consent in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Without consent these services are not loaded and no data is sent to them.

You can withdraw your consent at any time with effect for the future by clearing this website's data (cookies and local storage) in your browser; the banner will then appear again and you can choose anew.

With your consent we use Google Analytics 4 and Google Ads conversion tracking provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to measure visitor numbers, use of the website and the success of our ads. Cookies are set and usage data is processed (pages viewed, device information, approximate location, clicks on contact buttons, submitted forms). When you submit a form, your email address and phone number may be sent in hashed form (enhanced conversions).

Google Analytics 4 does not store full IP addresses. Data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR. More information: policies.google.com/privacy.

With your consent we use the Meta Pixel provided by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) to measure the effectiveness of our ads on Facebook and Instagram. Usage data (page views, form submissions, clicks on contact buttons) is sent to Meta, which may link it to your account. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR, Meta Controller Addendum). Data may be transferred to the USA; Meta is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR. More information: facebook.com/privacy/policy.

We use the Inter and Geist Mono typefaces. They are downloaded when the website is built and served from our own server; no connection to Google's servers is made when you visit the website.

If you click a WhatsApp button, you are forwarded to WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). Only then is data transferred to WhatsApp; WhatsApp's privacy policy applies (whatsapp.com/legal). We use messages you send us to handle your request (Art. 6(1)(b) GDPR). You are always welcome to call or email us instead.

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal email to info@grow.ba is all it takes.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the place of your residence, your workplace or the place of the alleged infringement — in Germany, this is the data protection authority of your federal state.

Providing your data is voluntary. Without your name and contact details, however, we cannot process your enquiry. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

We update this privacy policy when our processing or the legal situation changes. The version published here applies.