Privacy Policy

The controller of personal data within the meaning of the Law on Personal Data Protection of Bosnia and Herzegovina (the "Law") is:

"EDM" d.o.o. Sarajevo Kalmija Baruha Street No. 1, Sarajevo, Bosnia and Herzegovina ID No.: 4202898560003 | Court Register No.: 65-01-0459-21 Email: support@kotabooking.com

You use the Kota Booking platform in accordance with this Privacy Policy. Please read it carefully.

We collect the following categories of personal data:

Subscriber account data: first and last name, company name, email address, password (stored in hashed form), phone number, and address.

Subscriber client data: first and last name, phone number, email, appointment history, and notes entered by the subscriber into the platform's CRM functionality.

Scheduling data: appointment date and time, selected service, staff name, and notes.

Technical data: IP address, browser type, operating system, pages visited, and session cookies.

Payments: transaction data (amount and date). Card data is not processed directly by us, but through a certified payment processor.

We process your personal data for the following purposes:

• Providing and managing the appointment booking service • Creating and managing user accounts • Sending automated appointment reminders • Charging subscriptions and managing invoices • Providing technical support and responding to inquiries • Improving and developing the platform (anonymized aggregated data) • Meeting legal obligations

We do not use your data for automated profiling or decision-making that would have a legal effect on you.

Personal data is processed on the following legal bases:

Contract: processing is necessary for the performance of the contract for use of the platform (Terms of Use) that we enter into with subscribers.

Legal obligation: to the extent that processing is necessary to comply with legal obligations under the laws of Bosnia and Herzegovina (for example, tax records).

Legitimate interest: to improve platform security and prevent abuse, where such processing does not override your rights.

Consent: for sending marketing communications (newsletter), but only if you have expressly agreed. You may withdraw consent at any time.

We do not sell your personal data to third parties. We may share it only in the following cases:

Service providers: we use trusted third parties for hosting (Vercel), email delivery (Resend), payment processing (Lemon Squeezy), and analytics. These providers process data solely on our instructions.

Legal obligation: if disclosure is required to comply with an order of a court or other competent authority in Bosnia and Herzegovina.

Business transfer: in the event of a merger, acquisition, or sale of company assets, users will be notified before their data becomes subject to a different privacy policy.

All service providers are contractually required to maintain an appropriate level of personal data protection.

We retain your data for as long as necessary for the purpose for which it was collected or as required by applicable law.

Account data is retained while the account is active. After account deletion, data is anonymized or deleted within 90 days, except for data we are legally required to keep longer (for example, accounting records for 5 years under the regulations of Bosnia and Herzegovina).

Client data (CRM) entered by the subscriber is deleted together with the subscriber's account or upon explicit request.

Technical log files are retained for no longer than 12 months.

In accordance with the Law on Personal Data Protection of Bosnia and Herzegovina, you have the following rights:

• Right of access: you may request a copy of the personal data we hold about you • Right to rectification: you may request correction of inaccurate or incomplete data • Right to erasure: you may request deletion of your data (the "right to be forgotten") • Right to restriction of processing: in certain cases, you may request a temporary suspension of processing • Right to data portability: you may receive your data in a structured, machine-readable format • Right to object: you may object to processing based on legitimate interest

You may send requests to exercise your rights to support@kotabooking.com. We will respond within 30 days. If you are dissatisfied, you may file a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina.

We use the following categories of cookies:

Essential cookies: necessary for platform functionality (authentication and session security). You cannot disable them.

Analytics cookies: we use anonymized analytics tools to monitor site performance and understand usage patterns. We do not collect personal data through analytics.

You can manage cookies through your browser settings. Disabling analytics cookies does not affect platform functionality.

We apply appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit (TLS/HTTPS) • Password encryption (bcrypt hashing) • Role-based access control and authorization • Regular security reviews and updates • Hosting on infrastructure certified to industry standards

If a security incident could compromise your data, we will notify you without undue delay in accordance with legal obligations.

Kota Booking reserves the right to change this Privacy Policy. We will notify you of any material changes by email or through an in-platform notice at least 14 days before they take effect.

We recommend reviewing this page periodically. The date of the latest update is always shown at the top of the document.

For any questions regarding the processing of personal data, the exercise of your rights, or this Privacy Policy, please contact us at:

"EDM" d.o.o. Sarajevo Kalmija Baruha Street No. 1, Sarajevo, Bosnia and Herzegovina ID No.: 4202898560003 | Court Register No.: 65-01-0459-21 Email: support@kotabooking.com

You may also submit complaints to the Personal Data Protection Agency of Bosnia and Herzegovina (www.azlp.ba).