Privacy policy

Last updated: 14 August 2026

This page explains what personal data this website collects, why, and what you can ask us to do with it. It is written to meet the EU General Data Protection Regulation and the UK GDPR, which apply to us because we offer services to people and businesses in those regions.

1. Who is responsible for your data

Jaha Web Solutions, a registered business in Bosnia and Herzegovina, is the data controller.

• Owner: Reuf Jahic
• Location: Srebrenik, Bosnia and Herzegovina
• Email: [email protected]

There is no support desk in between. The person who answers your email is the person who runs the business.

2. What we collect

When you use the contact form we receive your name, email address, the service you selected, the plan where that applies, your website address where you provide it, and the contents of your message.

When you request a free audit we receive your name, email address, the website to be reviewed, the type of audit selected, and any notes you add.

When you email us directly we receive whatever you put in that email.

When you browse the site our server records the usual technical information: IP address, browser and device type, the pages requested and the time. Cloudflare, which sits in front of the site, records similar information for security.

We do not ask for special category data. Please do not send health information, identification numbers, card numbers or passwords through the forms on this site.

3. Why we use it, and on what legal basis

• To answer your enquiry and prepare an offer. Steps taken at your request before entering into a contract, Article 6(1)(b).
• To deliver and support work you have engaged us for. Performance of a contract, Article 6(1)(b).
• To keep the site available and free of abuse, including blocking spam and automated attacks. Our legitimate interest in protecting the site, Article 6(1)(f).
• To understand how the site is used, through analytics. Your consent, Article 6(1)(a), which you give or refuse when you first arrive and can change at any time.
• To meet accounting obligations where an engagement results in an invoice. Legal obligation, Article 6(1)(c).

We do not profile you and we do not make automated decisions about you.

4. Who else sees it

We keep the number of parties involved deliberately small.

• Cloudflare, Inc. operates the network in front of this site. It handles security filtering, the Turnstile check on our forms, and cookieless traffic statistics. It processes your IP address and connection metadata.
• Google Ireland Ltd and Google LLC provide our business email through Google Workspace, and Google Analytics where you have accepted analytics cookies. Anything you send us by email or through a form arrives in that mailbox.
• Our own servers hold the website and its database, including form submissions. We manage them ourselves, so no additional hosting company has routine access.

We do not sell your data, we do not share it with advertising networks, and we do not pass it to other clients.

5. Transfers outside Bosnia and Herzegovina

Cloudflare and Google are established in the United States and may process data there. Both operate under the European Commission standard contractual clauses and both participate in the EU-US Data Privacy Framework. Where we host or maintain a site for you, the data stays on our servers in the European Union unless we have agreed otherwise with you in writing.

6. How long we keep it

• Form submissions stored in the website database are kept for 24 months, then deleted.
• Email correspondence is kept for as long as the working relationship lasts, and afterwards only where it is a record of what was agreed.
• Accounting records are kept for the period required by law in Bosnia and Herzegovina.
• Server and security logs are kept for a short period, normally weeks, and are overwritten in the ordinary course.
• Analytics data is kept for the retention period set in Google Analytics, which we keep at the shortest option that still allows year on year comparison.

7. Your rights

You can ask us to give you a copy of the data we hold about you, correct it, delete it, restrict what we do with it, or provide it in a portable format. You can object to processing we carry out on the basis of legitimate interest, and you can withdraw consent for analytics at any time.

Write to [email protected]. We answer within 30 days, there is no charge, and we will not ask you to justify the request.

If you are not satisfied with how we handled it, you can complain to the Personal Data Protection Agency of Bosnia and Herzegovina, or, if you are in the EU or the UK, to the supervisory authority where you live.

8. How we protect it

The site is served over HTTPS. Administrative access requires two factor authentication. The servers are patched and monitored by us. Form submissions are checked by Cloudflare Turnstile, which confirms a submission comes from a person rather than a script.

No system is perfectly secure. If a breach ever affected your data in a way that presented a real risk to you, we would tell you and the relevant authority without waiting to be asked.

9. Cookies and analytics

Nothing that identifies you is set before you choose. When you first arrive you are asked whether to allow analytics, and refusing is as easy as accepting. You can change that choice at any time from the Cookies link in the footer of every page.

• Strictly necessary. WordPress may set a functional cookie, for example to remember a language choice or keep you signed in if you have an account with us. Cloudflare Turnstile may set a short lived cookie while it verifies a form submission. These are always active because the site cannot work without them.
• Analytics, only with your consent. Google Analytics sets cookies beginning with _ga to count visits and see which pages are read. They expire after two years. If you refuse, they are never set.
• Cloudflare Web Analytics counts page views without cookies and without following you across other sites.

There are no advertising cookies and no tracking pixels on this site.

10. Testimonials and client references

Where a client agrees, we publish their name, role and company alongside their comment, and we show client logos to identify work we have carried out. This is done on the basis of consent, and anyone can ask us to remove their name, comment or logo at any time by writing to [email protected].

11. Changes to this policy

If we change how we handle personal data we will update this page and the date at the top. Material changes will be described here rather than quietly edited in.

12. Contact

Questions about this policy, or about anything on this site:

[email protected]
Jaha Web Solutions, Srebrenik, Bosnia and Herzegovina