Skip to Content
Enter
Skip to Menu
Enter
Skip to Footer
Enter
Last Updated
November 11, 2026

Privacy Policy

This Privacy Policy explains what personal data we collect when you visit tunel.studio or contact us, why we collect it, who we share it with and what rights you have. We process personal data in line with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH No. 12/25) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller of your personal data is Računarsko programiranje "ТУНЕЛ СТУДИО" Nemanja Janjić s.p. Banja Luka, trading as Tunel Studio, Novaka Pivaševića 30I, 78000 Banja Luka, Bosnia and Herzegovina, JIB 4513419530001 ("Tunel Studio", "we", "us"). Full details are on our Company Information page.

For any privacy question or request, email hello@tunel.studio.

2. What data we collect and why

When you browse the website. Our hosting provider automatically processes technical data needed to deliver the site: IP address, browser and device type, pages requested, date and time, and referring page. We use it to run the website securely and keep it available. Legal basis: our legitimate interest in operating a secure website.

When you fill in the contact form. We collect your name, company, work email and whatever you write about your project. The form is protected by an anti-spam check (Cloudflare Turnstile), and submissions are delivered to our email inbox. We use this data to reply to you and to discuss a possible project. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in answering business inquiries.

When you book a call. If you book a strategy session through Calendly, we receive your name, email, the time you picked and any answers you give in the booking form. We use it to hold the call. Legal basis: steps taken at your request before entering into a contract.

When you email us. We process your email address, name, signature details and the content of your message to reply and to handle the request. Legal basis: steps taken at your request before entering into a contract, or our legitimate interest in answering correspondence.

When you accept analytics or marketing cookies. With your consent only, we use tools that measure how the site is used and which companies visit it (see section 4). Legal basis: your consent, which you can withdraw at any time through the cookie settings button on the website.

When we work together. If you become a client, we process the contact details of your team members and project correspondence to deliver the services agreed in our contract, and invoicing data to meet our tax and accounting obligations. Legal basis: performance of a contract and legal obligation.

Business contacts we reach out to. We sometimes contact people at companies we believe could benefit from our services, by phone or LinkedIn, using business contact details that are publicly available. We use only business information (name, role, company, business contact details). Legal basis: our legitimate interest in promoting our services to businesses. You can ask us to stop at any time and we will not contact you again.

We do not send newsletters or marketing emails. We only email you in reply to your inquiry or about a project we work on together.

3. Cookies and similar technologies

When you first visit, a banner lets you accept all cookies, reject non-essential cookies or choose by category. Non-essential tools load only after you consent. You can change your choice at any time through the cookie settings button on the website.

  • Essential: needed for the site to work and to remember your cookie choice. Always active.
  • Analytics: Google Analytics and Hotjar, to understand how visitors use the site so we can improve it.
  • Marketing: Meta Pixel and the Apollo website tracker, to measure advertising and to recognise which companies visit our site.
  • Functional: embedded content such as the Calendly booking widget and videos, which may set their own cookies once loaded.

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site from working.

4. Service providers we use

We share personal data only with providers that help us run the website and our business. They process data on our behalf under data processing terms, or as independent controllers under their own privacy policies.

  • Webflow, Inc. - website hosting, content delivery and the contact form. Legal basis: legitimate interest. Location: USA, covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Cloudflare, Inc. - anti-spam check on forms (Turnstile) and hosting of video files. Legal basis: legitimate interest. Location: USA, covered by the EU-US Data Privacy Framework.
  • Google (Workspace) - the email inbox where inquiries arrive and are answered. Legal basis: steps before a contract and legitimate interest. Location: EU and USA, covered by the EU-US Data Privacy Framework.
  • Calendly LLC - booking strategy calls. Legal basis: steps before a contract. Location: USA, covered by the EU-US Data Privacy Framework.
  • ConsentPro - showing the cookie banner and storing your choice. Legal basis: legal obligation. Standard Contractual Clauses apply where data leaves the EEA.
  • Google (Analytics, Tag Manager) - website usage statistics. Legal basis: consent. Location: EU and USA, covered by the EU-US Data Privacy Framework.
  • Hotjar Ltd. - heatmaps and session insights, with form inputs masked. Legal basis: consent. Location: Malta (EU).
  • Apollo.io - identifying which companies visit our website. Legal basis: consent. Location: USA, covered by Standard Contractual Clauses.
  • Meta Platforms Ireland Ltd. - Pixel and Conversions API for ad measurement and retargeting, only when we run ads. Legal basis: consent. Location: Ireland and USA, covered by the EU-US Data Privacy Framework.
  • jsDelivr - delivering website scripts. Legal basis: legitimate interest. Location: EU and worldwide content delivery network.

We may also disclose personal data to authorities when the law requires it, or to professional advisers such as accountants and lawyers who are bound by confidentiality. We do not sell personal data.

5. International transfers

We are based in Bosnia and Herzegovina, and some of our providers are based in the USA. When personal data is transferred to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses, together with any additional measures the provider offers.

6. How long we keep data

  • Inquiries, booking details and emails from people who do not become clients: up to 24 months after our last contact, then deleted.
  • Client project correspondence and contact details: for the duration of the project and up to 24 months after it ends, unless the client relationship continues.
  • Contracts, invoices and accounting records: for as long as tax and accounting law requires, generally 10 years.
  • Analytics data: Google Analytics 14 months, Hotjar 365 days.
  • Cookie consent records: 12 months, after which the banner asks again.
  • Server logs: as set by our hosting provider, typically up to 30 days.

7. Your rights

You have the right to:

  • access the personal data we hold about you and receive a copy;
  • correct inaccurate or incomplete data;
  • have your data deleted when there is no longer a reason to keep it;
  • restrict how we process your data;
  • receive your data in a portable format;
  • object to processing based on our legitimate interest, including any outreach to you;
  • withdraw your consent at any time, without affecting processing that happened before.

To use any of these rights, email hello@tunel.studio. We reply within one month and may ask you to confirm your identity first.

You can also lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u BiH, Vilsonovo šetalište 10, 71000 Sarajevo, azlp.ba). If you live in the EU or EEA, you can complain to the data protection authority in your country.

8. Security

The website runs on HTTPS, access to our inbox and tools is limited to the people who need it and protected with two-factor authentication, and we choose providers with recognised security standards. No system is completely secure, so if we become aware of a breach that affects your data, we will notify you and the authorities as the law requires.

9. Automated decisions and children

We do not make decisions about you based solely on automated processing. Our website and services are aimed at businesses and are not directed at anyone under 16.

10. Changes to this policy

We update this policy when our tools or practices change. The date at the top shows the latest version. For significant changes, we will show a notice on the website.

11. Contact

Questions about this policy or your data: hello@tunel.studio, or by post to Tunel Studio, Novaka Pivaševića 30I, 78000 Banja Luka, Bosnia and Herzegovina.