Privacy policy

01Who is responsible for your data

The controller is ŠAHBAZ GROUP d.o.o. (Šahbaz Travel), Viteška ulica bb, 74250 Maglaj, Bosnia and Herzegovina, tax ID (JIB) 4219301300006. For any privacy question, write to info@sahbaz.ba or call +387 61 505 208.

02What data we collect

• Quote requests: type of transport, start, destination, date, number of passengers, name, company name (if you give it), email, phone, message and any file you attach (e.g. an itinerary).
• Contact by phone, email, Viber, WhatsApp or Messenger: the information you send us in that conversation.
• Contracts and trips: the data needed to carry out the transport and issue invoices, such as the client's details and, where the law requires it, a passenger list.
• Technical data: IP address and browser data logged by servers for security, and, only with your consent, data on how the site is used (analytics) and marketing cookies.

03Why we process data and on what basis

• Answering your enquiry and preparing a quote: steps taken at your request before entering into a contract.
• Carrying out the trip and keeping in touch during it: performance of a contract.
• Invoices, bookkeeping and transport documents: legal obligation.
• Keeping the site secure and protecting the form from abuse: legitimate interest.
• Visitor analytics and ad measurement: your consent, which you can withdraw at any time.

04Who receives your data

We do not sell data. We use service providers who process it on our behalf:

• Vercel Inc.: website hosting.
• Resend Inc.: delivering the email with your enquiry to us.
• PostHog Inc.: analytics and session recordings, only with consent; data is stored on servers in the EU.
• Meta Platforms Ireland Ltd.: Facebook Pixel for ad measurement, only with consent.
• Google: Google Maps for the map, the route preview in the form and Google reviews. When the map loads, Google receives your IP address.
• Viber, WhatsApp and Messenger: if you message us there, their privacy policies also apply.

We disclose data to public authorities where the law requires it. Some of these providers are outside Bosnia and Herzegovina (e.g. in the USA); transfers to them rely on standard contractual clauses or other safeguards permitted by law.

05How long we keep data

• Enquiries that did not lead to a contract: up to 1 year after the last contact.
• Contract and invoice data: as long as accounting and tax rules require.
• Analytics data: up to 1 year.
• Cookies: as listed in the Cookie policy.

06Your rights

You have the right to access your data, have it corrected or erased, restrict processing, data portability and to object to processing based on legitimate interest. You can withdraw cookie consent at any time via the “Cookie settings” link at the bottom of the page.

Send your request to info@sahbaz.ba. We reply without undue delay and within 30 days at the latest.

07Complaints

If you believe we process your data unlawfully, you can lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.ba). Visitors from the European Union can also contact the supervisory authority in their own country.

08Security

The site uses an encrypted connection (HTTPS), the form is protected against automated submissions, and enquiries are accessible only to people who need them for their work.

09Children

The site is not intended for people under 16. Enquiries for groups of children are sent by a parent, school, club or another responsible person.

10Changes

When we change this policy, we publish the new version on this page with the date of the change.