Privacy Notice

This Notice consolidates information on the processing of personal data of clients, insured persons and business partners of Vipox d.o.o. Sarajevo, as well as visitors to the website www.vipox.ba. It applies to all channels through which we come into contact with your personal data: the conclusion and performance of insurance policies, and the use of our website.

This Notice is a summary of the Personal Data Protection Rulebook of Vipox d.o.o. Sarajevo (an internal act that regulates the processing of personal data within the Company in detail), adapted for the purpose of publicly informing clients and website visitors. The full version of the Rulebook is available on request, through our Personal Data Protection Officer (DPO, szlp@vipox.ba, phone +387 33 717 156), or for inspection at the registered office of Vipox d.o.o. Sarajevo.

1. What processing this Notice covers

This Notice applies to the processing of personal data of:

• clients, insured persons, insurance beneficiaries, legal representatives and injured parties with whom we come into contact when providing insurance brokerage services;
• business partners and their representatives with whom Vipox d.o.o. Sarajevo cooperates;
• visitors to the website www.vipox.ba.

As a rule, Vipox d.o.o. Sarajevo acts as a controller of personal data, independently determining the purposes and means of processing. In certain situations, where a business partner forwards client data to Vipox for the provision of brokerage services, Vipox acts as a processor and in that case processes the data exclusively in accordance with the instructions of that business partner as the controller.

2. What categories of data we collect

In the course of insurance brokerage and communication via the website, we collect and process personal data to the extent necessary to provide our services, depending on the type of insurance and your role (insured person, insurance beneficiary, legal representative or injured party):

• basic identification and contact data;
• data related to the insurance policy and the insured object or person;
• documentation related to claims, if you report a claim;
• special categories of data, exclusively where necessary for a specific type of insurance, and exclusively with your explicit consent. These data are kept under enhanced protection measures, physically separated from other documentation.

3. How we use your personal data and on which legal bases

• Performance of the insurance contract: risk analysis, preparation of quotes, conclusion and administration of the policy, claims handling, communication with insurance companies — on the basis of contract performance;
• Compliance with legal obligations, including obligations under the Act on the Prevention of Money Laundering and Financing of Terrorism (AML/CFT) — on the basis of a legal obligation;
• Processing of health data for life/health insurance, exclusively on the basis of your explicit consent, which you may withdraw at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Legitimate interest of Vipox d.o.o. Sarajevo, in cases where processing is not based on a contract, a legal obligation or consent, but there is a justified business reason that does not override your fundamental rights and freedoms. This includes protection against fraud and unlawful conduct, security of information systems, and the establishment, exercise or defence of legal claims.

Vipox d.o.o. Sarajevo does not use automated decision-making or profiling. Risk assessment and quote preparation are performed by an authorised person, not an automated system.

We are obliged to inform you whether providing the requested data is mandatory and what the consequences are if you do not provide it:

• Basic identification data and data related to the insured object/person: providing this data is a condition necessary for the conclusion and performance of the insurance contract. If you do not provide it, we are unable to prepare a quote, conclude an insurance policy or process your claim.
• Data we are legally obliged to collect: providing this data is a legal obligation. If you do not provide it, we will not be able to establish or continue a business relationship with you, in line with legal restrictions.
• Special categories of data: providing this data is voluntary and based on your explicit consent. The consequence of refusing consent is that we may not be able to arrange that specific type of policy, if the processing of such data is necessary for risk assessment or contract performance. This does not affect the possibility of arranging other types of insurance that do not require such data.

4. Who we share your data with

We share your data only with those recipients that are necessary for the provision of our services, to the extent required for that purpose:

• insurance companies with which you conclude a policy, acting as independent data controllers;
• business partners and correspondents with whom Vipox d.o.o. Sarajevo cooperates in the course of insurance brokerage, acting as processors of personal data;
• lawyers and courts, where necessary, in the course of resolving claims or disputes;
• competent state authorities and bodies, where necessary to comply with legal obligations.

We do not sell your data, nor do we share it with third parties for marketing purposes.

5. Transfers of data outside Bosnia and Herzegovina

The vipox.ba website is hosted in Bosnia and Herzegovina. Transfers of data outside Bosnia and Herzegovina may occur through the services of Google LLC (Google Analytics for visit analytics and Google Maps for displaying the location on the Contact page), headquartered in the United States of America. Google LLC is certified under the EU-U.S. Data Privacy Framework, a recognised mechanism ensuring an adequate level of personal data protection for such transfers.

For other business partners and correspondents established outside Bosnia and Herzegovina, personal data is transferred only where appropriate safeguards are in place (e.g. standard contractual clauses or binding corporate rules).

6. How long we keep your data and how we protect it

We keep your personal data for as long as necessary to fulfil the purpose for which it was collected. The criteria we use to determine the retention period are: the duration of the insurance contract and the statutory retention periods for business documentation. We are obliged to keep certain categories of data even after the business relationship ends, in accordance with legal obligations.

Upon expiry of these periods, the data is deleted or anonymised, unless a legal obligation requires longer retention.

We store your personal data on secure servers with restricted and appropriately protected access. Access to your data is limited exclusively to authorised employees and business partners of Vipox d.o.o. Sarajevo, who are obliged to keep the data confidential and to act in accordance with the protection measures.

7. Your rights

With regard to your personal data, you have the right to:

• access the data we process about you;
• rectification of inaccurate or incomplete data;
• erasure of data, where the legal conditions are met;
• restriction of processing, in certain cases provided for by the Act;
• portability of the data you have provided to us, in a structured, commonly used and machine-readable format, where the processing is based on your consent or a contract and is carried out by automated means;
• objection to processing based on legitimate interest;
• withdrawal of consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

You may submit requests to exercise these rights to our Personal Data Protection Officer (DPO) by e-mail at szlp@vipox.ba, using the form Request for the Exercise of Rights Related to Personal Data (PDF, in Bosnian) or via the online request form. We will respond to your request without undue delay, and no later than 30 days from its receipt.

If you believe that the processing of your personal data is contrary to the Act, you have the right to lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina (AZLP, www.azlp.ba).

Where we process your personal data in the capacity of a processor, we will forward your request to the appropriate controller and act in accordance with its instructions.

8. Minors

Our website is not intended for independent use by persons under 18 years of age. If insurance is arranged for the benefit of a minor, consent to the processing of the minor's personal data is given by a parent or legal representative, in accordance with a special Consent Form. We do not knowingly collect minors' personal data via the contact form on the website; if we notice that a minor has independently submitted their data through the website, we delete such data without delay.

9. The website www.vipox.ba

This section contains information specific to your visit to the website, in addition to the general information in sections 1-8.

9.1. Data collected via the website

• Contact form: first and last name, e-mail address, company name (if provided), phone number (if provided), content of the message/inquiry — for the purpose of responding to your inquiry, on the basis of your consent given upon submission.
• Claim report form: through this form we collect the data necessary to process your claim: type and description of the loss, basic contact data, policy data, circumstances of the loss, financial data for payment, and attached documentation. Special categories of data are collected exclusively with your explicit consent, which you express by ticking the field provided for that purpose in the form.
• Server/technical data about the visit (e.g. IP address, browser type, date and time of access), recorded by our hosting provider for the purpose of security and proper functioning of the website — on the basis of legitimate interest.
• Analytics data on website usage (Google Analytics) — collected exclusively with your prior consent, which you give via the cookie management tool (cookie banner) when visiting the website.

9.2. Cookies

The vipox.ba website uses technically necessary cookies, required for its functioning, for which consent is not needed. With your prior consent, the website also uses analytics cookies (Google Analytics) to improve the user experience.

When visiting the website, the cookie management tool lets you accept all cookies, allow only technically necessary cookies, or choose which categories of cookies you wish to allow. You can change or withdraw your choice at any time using the same tool, without affecting the lawfulness of processing carried out before the withdrawal.

A detailed description of cookies by type, duration and purpose is available in the Cookie Policy.

9.3. Recipients of data from the website

• Website hosting providers, acting as processors of personal data on behalf of Vipox d.o.o. Sarajevo, on the basis of a signed data processing agreement. The contact forms on the website are managed directly by Vipox d.o.o. Sarajevo, without an external CRM provider;
• Google LLC, through Google Analytics for visit analytics (IP addresses are anonymised) and Google Maps for displaying the location on the Contact page.

9.4. Retention of data from the website

We keep contact form data until a reasonable period from the last communication has expired, or in accordance with the legislation applicable to any resulting business relationship; claim report form data is kept in accordance with the claim retention periods referred to in section 6 of this Notice; and the retention period for cookie consent data is aligned with the Cookie Policy available on the website. Exceptionally, we may retain all of the above data for longer where we have a legitimate interest in doing so.

10. Further processing for new purposes

Should the need arise to process your personal data for a purpose not stated in this Notice, we will inform you of the new purpose and other required information before such processing begins, and, where required by the Act, we will seek your consent for processing for that new purpose.

11. Links to external websites

Our website may contain links to third-party websites (e.g. Google Maps, insurance companies). By clicking such a link you leave our website and move to the third party's website. We recommend that you review the privacy policy of every external website you visit. Vipox d.o.o. Sarajevo is not responsible for the content, privacy policy or data protection practices of any external website or service.

12. Contact

If you have any questions, want to know more about how your personal data is processed, or wish to exercise any of your rights, contact us by e-mail at szlp@vipox.ba, by phone at +387 33 717 156, by post at Vipox d.o.o. Sarajevo, Čekaluša 52, Sarajevo, or via the contact form available on the website www.vipox.ba. If we have not resolved your issue, you have the right to contact the Personal Data Protection Agency in Bosnia and Herzegovina (AZLP, www.azlp.ba).

Last updated: 10 July 2026

This Notice is updated as needed, in particular after changes to the purposes of processing, data recipients, legal bases or technical tools used on the website. We will inform you of material changes by a visible notice on the website www.vipox.ba. The current version is always available at the registered office of Vipox d.o.o. Sarajevo and on the website.