Privacy Policy of Law Office Prnjavorac
Data controller: Law Office Prnjavorac, Tuzla | Effective from: 5 September 2026
In brief: We process your personal data only to the extent needed to answer your enquiry, to represent you and to meet the obligations that the laws of Bosnia and Herzegovina impose on an attorney. The website has no forms, requires no registration and uses no advertising cookies; the only visitor statistics tool is Google Analytics, which loads only after your first interaction with the page. Everything you entrust to us as a client is covered by attorney-client privilege.
- Legal framework: the Personal Data Protection Act of Bosnia and Herzegovina (Official Gazette of BiH, no. 12/25), the Law on the Legal Profession of the Federation of BiH (Article 23, attorney-client privilege) and, for clients from the European Union, the General Data Protection Regulation (GDPR).
- What we do not do: we do not sell data, send marketing messages, profile visitors or make automated decisions.
- Your rights: access, rectification, erasure, restriction of processing, portability, objection and a complaint to the Personal Data Protection Agency of BiH; we reply within 30 days.
- Contact for data questions: advokat@advokat-prnjavorac.com, +387 35 258 110, ÄorÄa MihajloviÄa 10b, 75000 Tuzla.
This policy explains, in plain language, what happens to your personal data when you visit advokat-prnjavorac.com, when you contact us by e-mail, telephone or message, and when you become our client. It is written in accordance with Articles 14 and 15 of the Personal Data Protection Act of Bosnia and Herzegovina, which require the data controller to tell the data subject who processes the data, why, on what basis, to whom it is passed on, how long it is kept and what rights the data subject has. The full text of the Act is published, in Bosnian, on our page Zakon o zaÅ”titi liÄnih podataka BiH.
Who processes your data
The data controller within the meaning of Article 4 of the Personal Data Protection Act of BiH is Law Office Prnjavorac, ÄorÄa MihajloviÄa 10b, 75000 Tuzla, Bosnia and Herzegovina, telephone +387 35 258 110, e-mail advokat@advokat-prnjavorac.com. For all questions about the processing of personal data and for exercising the rights described in this policy, contact attorney Azur Prnjavorac at the details given. The office is not under a statutory duty to appoint a data protection officer, so these matters are handled by the attorney personally.
Visiting the website: server logs and Google Analytics
You can read the website without registering and without entering any data; it contains no contact, comment or subscription forms. Each time a page is opened, the server hosting the website, like every web server, records technical access data in its log: the IP address from which you accessed the site, the date and time, the address of the page opened, the page you came from, and the type of browser and operating system. This data is used solely for the operation of the server, troubleshooting and protection against attacks; it is not linked to your name and is deleted automatically after a short period set by the hosting provider.
For visitor statistics we use Google Analytics 4, a service of Google. The script is not loaded immediately, but only after your first interaction with the page (scrolling, a click or a key press), so that merely opening a page sends nothing to Google. Google Analytics places the cookies _ga and _ga_G-Y1X18T3HZD in your browser, with a lifetime of up to two years, to distinguish visits from the same browser, and records the pages opened, an approximate location derived from the IP address, and the type of device and browser. According to Google’s documentation, Google Analytics 4 does not store full IP addresses. We see the reports only in aggregated form (number of visits per page, country and device) and cannot identify an individual visitor from them. The data is processed on Google’s servers, including those in the United States. If you do not want Google Analytics to record your visit, block cookies in your browser settings or install the Google Analytics opt-out add-on; the website continues to work without any restriction. There are no other cookies, tracking tools, advertising networks or social media plug-ins on the website.
When you contact us
When you send us an enquiry by e-mail, telephone or a message via WhatsApp, Viber or Signal, or ask for a video consultation via Zoom, Microsoft Teams or Google Meet, we process the data you give us yourself: your name, contact details, the content of the enquiry and any documents you attach. We use this data to reply to you, to assess whether we can take on the matter and to prepare an offer. You choose the channel of communication yourself; when you choose one of the applications mentioned, you accept that the content of the message or call passes through the servers of the company providing that application, under its own privacy rules. For sensitive data and documents we recommend e-mail or a visit to the office in person.
Data of clients and of other persons in a case
When you engage us, we process all the data needed for representation: identification data (name, personal identification number, address, data from identity documents and powers of attorney), data on the case and the facts, data from court and administrative files, land registers, cadastre, civil registers and other registers, data on payments for the calculation and collection of fees and expenses, and data on our communication with you. A case inevitably also involves data on other persons: opposing parties, witnesses, experts, heirs, family members and persons to whom documents relate. We obtain this data from you, from courts and authorities, from public registers and from other participants in the proceedings, and we process it strictly within the limits of what representation requires.
In some cases, above all family, inheritance and damages cases, it is necessary to process special categories of personal data under Article 11 of the Act (data on health, family circumstances, religious or national affiliation) or data on criminal proceedings under Article 12 of the Act. We process such data only when it is necessary for the establishment, exercise or defence of legal claims, as permitted by Article 11, paragraph 2, item f) of the Act, and with particular care.
Legal bases for processing
Every processing operation has its basis in Article 8, paragraph 1 of the Personal Data Protection Act of BiH and, for clients from the European Union, the corresponding basis in Article 6, paragraph 1 of the GDPR. We do not ask for consent where consent is not the required basis, because that would create the false impression that representation could continue without the data that the law and the court require.
| Purpose | Data | Legal basis (BiH Act / GDPR) |
|---|---|---|
| Operation and security of the website | server log (IP address, time, page, browser) | legitimate interest of the controller: Article 8(1)(f) / Article 6(1)(f) |
| Visitor statistics | Google Analytics, aggregated data, _ga cookies | legitimate interest of the controller, with the option to opt out: Article 8(1)(f) / Article 6(1)(f) |
| Reply to an enquiry and offer | name, contact details, content of the enquiry, attached documents | steps at the request of the data subject prior to entering into a contract: Article 8(1)(b) / Article 6(1)(b) |
| Representation and legal advice | all data needed for the case, including data of third persons | performance of the contract of representation and the attorney’s legal obligations: Article 8(1)(b) and (c) / Article 6(1)(b) and (c); for special categories Article 11(2)(f) / Article 9(2)(f) |
| Invoicing, collection and bookkeeping | data on invoices and payments | legal obligation of the controller under tax and accounting regulations: Article 8(1)(c) / Article 6(1)(c) |
| Protection of our rights | data from files and correspondence | legitimate interest of the controller (collection of fees, defence against claims): Article 8(1)(f) / Article 6(1)(f) |
Attorney-client privilege
Everything you entrust to us as a client, and everything we learn in a case in any other way, the attorney is bound under Article 23 of the Law on the Legal Profession of the Federation of Bosnia and Herzegovina to keep as a professional secret, in preparation, during representation and after it ends. The same duty binds everyone who works in the office. Attorney-client privilege prevails over any provision of this policy: we disclose data from a case to no one, except where representation requires it or the law obliges us to. The Personal Data Protection Act expressly respects this duty and provides, in Article 16, paragraph 5, item d), that information on processing is not given where personal data must remain confidential under an obligation of professional secrecy. The rights of access, erasure and objection of another person involved in a case are therefore exercised only to the extent that does not breach the privilege of our client. More on this on the page attorney-client privilege in Bosnia and Herzegovina.
To whom we disclose data
We do not sell personal data and do not pass it to anyone for marketing purposes. The recipients of data are only those required by representation or by law: courts, prosecutors’ offices, notaries, administrative authorities, land registry offices, the cadastre, civil registry offices, business registers, enforcement officers, expert witnesses, translators and interpreters, insurers, the opposing party and its attorney to the extent the proceedings require, and attorneys in other countries when a case has an international element. Case files are kept in the office, without external cloud services for document storage and without an external accountant. The hosting provider of the website and e-mail has technical access to the servers, and Google receives visit data as described above. When you communicate with us via WhatsApp, Viber, Signal, Zoom, Microsoft Teams or Google Meet, their providers process communication data under their own privacy rules, and it is you who choose that channel.
Transfers of data to other countries
Client data is stored and processed in Bosnia and Herzegovina. A transfer to another country occurs in three situations. The first is Google Analytics, where aggregated visit data is also processed on servers in the United States; the Council of Ministers of BiH has not adopted a decision on the adequacy of the level of protection for that country, so the transfer relies on the fact that it does not concern data by which we could identify you and that you can opt out of it. The second is the messaging and video call applications that you choose yourself; there the transfer is necessary for the communication you have requested (Article 51, paragraph 1, items a) and b) of the Act). The third is representation with an international element, when submissions, documents and powers of attorney are delivered to courts, authorities, notaries or attorneys in another country; that transfer is necessary for the performance of the contract with you and for the establishment, exercise or defence of legal claims (Article 51, paragraph 1, items b) and e) of the Act, Article 49, paragraph 1, items b) and e) of the GDPR).
We draw the attention of clients from the European Union, the European Economic Area and Switzerland to the fact that, for the purposes of the GDPR, Bosnia and Herzegovina is a third country for which the European Commission has not adopted an adequacy decision. Your data is processed in Bosnia and Herzegovina because you yourself have requested representation before the courts and authorities of Bosnia and Herzegovina, and it is protected by the Personal Data Protection Act of BiH, which is aligned with the GDPR, and by attorney-client privilege.
How long we keep data
| Type of data | Period |
|---|---|
| Server logs | a short technical period set by the hosting provider, as a rule a few weeks |
| Google Analytics | cookies up to two years in your browser; event data in Google’s system for at most 14 months, according to our setting |
| Enquiries that did not lead to representation | up to one year from the last correspondence, after which they are deleted |
| Case files and correspondence with the client | after the end of representation, for as long as the Law on the Legal Profession, the Statute and the Code of the Bar Association of the Federation of BiH, limitation periods and the need to defend against possible claims require; our rule is five years from the closing of the case |
| Invoices and accounting records | for the periods prescribed by tax and accounting regulations |
Your rights and how to exercise them
Under Articles 17 to 23 of the Personal Data Protection Act of BiH and, for clients from the European Union, under Articles 15 to 21 of the GDPR, you have the right of access to your data and to a copy of it, the right to rectification of inaccurate and completion of incomplete data, the right to erasure where there is no longer a basis for processing, the right to restriction of processing while a disputed question is being resolved, the right to portability of the data you have given us yourself, and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Send your request by e-mail to advokat@advokat-prnjavorac.com or by post to the address of the office. To protect data against unauthorised access we may ask you to confirm your identity.
- We reply without undue delay and at the latest within 30 days of receiving the request; where a request is complex, the period may be extended under Article 14, paragraph 3 of the Act, of which we inform you within the first 30 days.
- If we do not act on a request, we state the reasons. Attorney-client privilege and statutory duties to keep files may limit erasure and access to data that also relates to other persons.
- If you consider that processing is unlawful, you may lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina, DubrovaÄka 6, 71000 Sarajevo, www.azlp.ba, or bring an action before the competent court. Clients from the European Union may also contact the supervisory authority in their country of residence.
Security, children and automated decisions
The website is delivered exclusively over an encrypted connection (HTTPS). Files and electronic correspondence are kept in the office, on password-protected devices, with access limited to the attorneys and to persons bound by attorney-client privilege. We review security measures in accordance with Article 34 of the Act, and in the event of a data breach likely to endanger your rights we would inform you and the Agency within the periods set in Articles 35 and 36 of the Act. The website is not intended for children and we do not knowingly collect data of persons under 18 through it; we process children’s data only in cases in which we represent a parent or guardian. We do not use automated decision-making or profiling, and we use e-mail and telephone solely for communication about your case, never for marketing messages.
Changes to this policy
We amend this policy when the regulations, the tools used by the website or the way the office works change. The version in force is always the one published on this page, with the date in the heading. This version is effective from 5 September 2026 and replaces the earlier text.
Frequently asked questions about privacy
The questions visitors and clients ask us most often about personal data.
Does advokat-prnjavorac.com use cookies?
The website itself sets no cookies. The only cookies come from Google Analytics (_ga and _ga_G-Y1X18T3HZD), which loads only after your first interaction with the page and serves solely for aggregated visit statistics. You can block them in your browser or with Google’s opt-out add-on, and the website continues to work without restriction. There are no advertising cookies or social media plug-ins.
What happens to the data from an enquiry that does not lead to representation?
We keep the enquiry and the attached documents for up to one year from the last correspondence, as long as is needed to answer possible follow-up questions and to prove what we advised, and then delete them. At your request we delete them earlier, unless the law obliges us to keep them.
How is what I entrust to the attorney protected?
By attorney-client privilege under Article 23 of the Law on the Legal Profession of the Federation of BiH, which binds the attorney and all employees of the office during representation and after it, and which ceases only with your express permission or in the narrow cases the law expressly lists. The Personal Data Protection Act respects this privilege, so other persons involved in a case cannot obtain what you have entrusted to us through the right of access.
Can I ask for my data to be deleted from a case file?
You can submit a request at any time, but the deletion of the file of a closed case is as a rule not possible while the retention periods imposed on the attorney by the Law on the Legal Profession, the Statute and the Code of the Bar Association and the limitation periods are running, because the file also serves your protection if the case is reopened. Data that is not needed we delete immediately, and after the retention periods expire we delete the file as a whole.
I live in Germany, Austria or Switzerland. Does the GDPR apply to my data?
We recognise your rights under the GDPR in full and this policy also cites the GDPR bases. For the GDPR, Bosnia and Herzegovina is a third country without an adequacy decision of the European Commission, but your data is processed here because you yourself have requested representation before the courts and authorities of Bosnia and Herzegovina, which Article 49 of the GDPR expressly permits, and it is protected by the Personal Data Protection Act of BiH, aligned with the GDPR, and by attorney-client privilege.
Whom can I complain to if I believe my data has been processed unlawfully?
First to us, at advokat@advokat-prnjavorac.com, because most misunderstandings are resolved at once. Then to the Personal Data Protection Agency of Bosnia and Herzegovina, DubrovaÄka 6, 71000 Sarajevo, www.azlp.ba, or by an action before the competent court. Clients from the European Union may also contact the supervisory authority in their own country.
Clients have trusted us since 1993.
The law office Prnjavorac has been active since 1993. Today, in its fourth decade of work, it has 1,056 Google reviews with a rating of 5.0 / 5 across two independent Google business profiles.
All client reviews are publicly available on both Google business profiles, without filtering, mediation or moderation by the law office.
Other areas of the firm's work
We provide legal assistance and representation across a wide range of areas in Bosnia and Herzegovina:
