Request a Quote
Last updated:

Privacy Policy

How OD Oneway Studio collects, uses and stores data about visitors and clients of oneway.ba — and what rights you have.

Who processes your data

The data controller is OD Oneway Studio, a sole proprietorship based at Džemala Bijedića 279L, 71210 Ilidža, Bosnia and Herzegovina. For any privacy questions, write to info@oneway.ba.

We process data in accordance with the Law on Personal Data Protection of Bosnia and Herzegovina and, for visitors from the European Union, the General Data Protection Regulation (GDPR).

What data we collect and why

  • Contact form: name, email and message. We use them only to reply to your enquiry. The message is sent by email to our inbox and is not stored in the website's database.
  • Project estimate request: project type and description, services, indicative budget and deadline, name, email and, optionally, phone and company name. We use them to prepare an offer and get back to you. The request is stored in our database and we receive an email notification.
  • Client portal: your account details (name, email, password in hashed form), plus enquiries, offers, invoices and documents related to our work together. We use them to provide the service you ordered.
  • Technical data: your IP address is used temporarily to protect forms from abuse (rate limiting) and is not stored. Our hosting provider keeps standard system logs for security and operation.

The legal basis is your request, i.e. steps before and during a contractual relationship, our legitimate interest in keeping the site secure, and your consent for analytics (see below). We do not sell data and do not use it for advertising.

Analytics

Vercel Web Analytics: we record aggregated visit data (which page, which site you came from, country, device and browser type). It uses no cookies and does not track you across visits, so we do not ask for consent for it.

Google Analytics 4: loaded only if you click “Accept” in the cookie notice. Google then sets the _ga and _ga_… cookies (lasting up to 2 years) and records how you use the site: pages visited, traffic source, submitted forms and clicks on key links. We never send your name, email or message content. Advertising features and Google signals are turned off. The service is provided by Google Ireland Limited; data may be transferred to the US under the EU-US Data Privacy Framework.

You can withdraw consent at any time via the “Cookie settings” link at the bottom of the page — the Google Analytics cookies are then deleted and measurement stops.

Cookies and local storage

  • oneway-lang (cookie, 1 year): remembers your chosen language. Necessary.
  • oneway-theme, oneway-lang and oneway-consent (browser local storage): remember your theme, language and cookie choice. Necessary.
  • payload-token (cookie): client portal login, only while you are signed in. Necessary.
  • _ga, _ga_… (Google Analytics cookies, up to 2 years): only with your consent.

Who else has access to data

We use trusted service providers who process data only on our instructions:

  • Vercel Inc. — website hosting and cookieless analytics; servers in Frankfurt (EU).
  • Neon — database; servers in Frankfurt (EU).
  • Resend — sending emails from the website (enquiry notifications, password resets).
  • Google — business email (Google Workspace) and, with your consent, Google Analytics.

Where data is transferred outside the EU/BiH, this happens with appropriate safeguards (e.g. the EU-US Data Privacy Framework or standard contractual clauses).

How long we keep data

We keep enquiries and estimate requests for as long as needed to reply and for any subsequent cooperation, and no longer than two years after our last contact. Data related to contracts and invoices is kept for as long as accounting and tax regulations require. A client portal account is deleted at your request or when our cooperation ends.

Your rights

You have the right to request access to your data, its correction or deletion, restriction of processing and data portability, to object to processing and to withdraw consent you have given. Send your request to info@oneway.ba — we reply within 30 days.

If you believe we are not processing your data lawfully, you can contact the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.ba) or the data protection authority in the EU country where you live.

Changes

We update this policy when the way we process data changes. The date of the last update is shown at the top of the page.