Privacy Policy

The controller of your personal data is:

EDIN BABIĆ BH DELIKATESE d.o.o. Arnautovići bb, 71300 Visoko, Bosna i Hercegovina Data-protection e-mail: privacy@edinbabic.com

For any question about how we process your data or about exercising your rights, contact us at the e-mail address above.

We collect only the data needed to provide our services and fulfil your orders:

• Account data: first and last name, e-mail, encrypted password, order history.
• Order and delivery data: delivery and billing address, telephone number, order contents.
• Payment data: payments are handled by payment service providers; we do not store full card numbers, only the confirmation and status of the transaction.
• Communications: messages you send us by e-mail or the contact form for support and enquiries.
• Newsletter: e-mail address and consent status if you subscribe to our newsletter.
• Website and analytics data: IP address, browser type, pages visited and similar technical data, generally in pseudonymised form.

We process your data for the following purposes and on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): processing orders, delivery, account management and customer support.
• Consent (Art. 6(1)(a) GDPR): sending the newsletter and setting non-essential cookies. You may withdraw your consent at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): security of the site, fraud prevention and improving our offering and services.
• Legal obligation (Art. 6(1)(c) GDPR): accounting, tax and other statutory retention duties.

We share your data only to the extent necessary to provide the service, with carefully selected partners acting as processors under a data-processing agreement:

• Payment service providers that process payments.
• Delivery services and couriers, including BH Pošta, to deliver orders.
• E-mail and analytics providers for communication and statistics.
• Hosting and infrastructure providers on which our site runs.

We do not sell your data to third parties. We disclose data to public authorities only where required by law.

We generally process your data within Bosnia and Herzegovina and the European Economic Area (EEA). Where a service provider processes data outside the EEA, the transfer takes place only subject to appropriate safeguards under the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses.

We keep personal data only as long as necessary for the purpose for which it was collected, or as required by law:

• Order and invoice records: kept for about 10 years to meet accounting and tax obligations.
• Account data: kept for as long as your account exists, or until you request deletion.
• Newsletter: data is kept until you withdraw consent or unsubscribe.
• Analytics data: kept for at most about 14 months, after which it is deleted or anonymised.
• Support messages: kept for the limited period needed to handle the enquiry and any later complaint.

Once the period ends, we securely delete or anonymise the data.

In relation to your personal data you have the following rights:

• Right of access to your data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with a supervisory authority. In Bosnia and Herzegovina this is the Personal Data Protection Agency (AZLP); if you reside in the EU, the competent data protection authority of your country.

Our site uses cookies and similar technologies. Necessary cookies are set automatically, while non-essential cookies load only after your consent. For details on the types of cookies and on managing your consent, see our Cookie Policy.

To exercise any of these rights, or for any data-protection question, contact us by e-mail at privacy@edinbabic.com. We will respond to your request without undue delay and at the latest within the periods set by the GDPR. To protect your data, we may ask you to confirm your identity.