Banja Kulaši
SR EN DE RU

Privacy

Privacy policy

“Banja Kulaši” d.o.o. Kulaši – Prnjavor

Last updated: 28 October 2026

1. Data controller

The data controller is “Banja Kulaši” d.o.o. Kulaši – Prnjavor, Kulaši bb, Kulaši – Prnjavor, Bosnia and Herzegovina, telephone +387 (0)51 666 101.

Data protection officer: Dušanka Domuz, telephone +387 (0)51 666 153, e-mail szzp@banjakulasi.com.

2. Personal data we collect and process

We collect and process personal data that you give us yourself or that we access in other databases in accordance with the law, including:

Data on domestic guests

  • Name and surname
  • Sex
  • Place of birth
  • Municipality of birth
  • Country of birth
  • Address
  • Personal identification number (JMBG)
  • Region
  • Citizenship
  • Number and date of issue of the passport or identity card

Data on foreign guests

  • Name and surname
  • Sex
  • Place of birth
  • Country of birth
  • Address
  • Citizenship
  • Number and date of issue of the passport or identity card
  • Type and number of visa
  • Expiry date of the residence permit
  • Border crossing and date of entry

Patient records

For external patients (not staying at the hotel) and for patients staying at the hotel:

  • Name and surname
  • Name of one parent
  • Personal identification number (JMBG)
  • Date of birth
  • Type of insurance (option: uninsured)
  • Place of residence
  • KSZ registration

For patients referred by the Health Insurance Fund (FZO) who stay at the hotel:

  • Name and surname
  • Name of one parent
  • Personal identification number (JMBG)
  • Date of birth
  • Place and municipality of residence
  • Country of origin
  • Patient’s telephone number
  • Type of insurance: compulsory (no co-payment charged) or 6 – co-payment (no co-payment charged)
  • Identification number of the health insurance card (e-card)
  • Basis of referral: 0 – planned (regular referral)
  • Type of referral: B – hospital
  • Institution that issued the referral
  • Doctor who referred the patient
  • Referral diagnosis
  • Insurance (city)
  • Name and surname of the admitting doctor (attending physician of Banja Kulaši)
  • Contact person in the patient’s family

Data on employees

  • Name and surname
  • Personal identification number
  • Sex
  • Day, month and year of birth
  • Place, municipality and country of birth, and citizenship
  • Permanent or temporary residence
  • Residence and work permit or confirmation of work registration, if the employee is a foreign national or stateless person and is required to have them
  • Education, professional examination, additional training, certificates of completed non-formal training and similar
  • Number and date of the employment contract or appointment decision
  • Start date of employment
  • Duties of the job position
  • Whether the employment is fixed-term or permanent, and the expected duration of fixed-term employment
  • Duration of the probationary period, if agreed
  • Number and date of the trainee employment contract, length of the traineeship, and the date and result of the professional examination, if required and taken
  • Duration of work abroad, country and place of work, if the employee is posted abroad
  • Whether the work counts towards insurance service with an increased duration
  • Whether the work may only be performed after prior and regular assessment of working capacity
  • Place of work or, if there is no permanent or main place of work, a note that work is performed in various places
  • Agreed weekly working hours, full-time working hours or prescribed reduced working hours
  • Length of employment before joining the employer
  • Pensionable service before joining the employer
  • Periods of suspended employment
  • End date of employment
  • Reason for termination of employment

Technical data

Technical data resulting from visits to our website: IP address, information about the browser and device, hashed data from an analytics tool.

3. Purposes and legal bases of processing

Data are processed for:

  • providing and charging for accommodation and catering services,
  • meeting legal obligations in tourism, taxes and visitor tax, and the register of guests’ stays,
  • the security of the premises and guests through video surveillance,
  • recruitment and human resources management,
  • communication over the internet and improving the user experience.

4. Recipients of data and transfers to third countries

Your data are not passed on to third parties, except:

  • where there is a legal obligation,
  • to our contracted processors (e.g. IT maintenance, Microsoft for e-mail services),
  • for foreign nationals, data are passed on to the competent authority and the estranac.ba application.

Processors process data exclusively on our behalf, under contractual obligations of confidentiality and protection.

We do not transfer your personal data to third countries, and we do not create profiles or process your personal data for automated decision-making.

5. Cookies

Our website uses cookies to improve functionality and the user experience. We use two kinds of cookies. The full list is in our Cookie policy.

a) Technical (necessary) cookies

These cookies are necessary for the basic functioning of the site (e.g. secure sign-in, navigation, displaying content). They do not collect personal data and cannot be switched off.

b) Analytics cookies

We use Google Analytics, a service of Google LLC, which allows us to analyse website traffic and user behaviour. Google Analytics uses cookies to collect information such as:

  • IP address (anonymised before storage),
  • type of device and browser,
  • length of visit and pages viewed,
  • how visitors arrived at the website.

These data are used exclusively for statistical purposes, to improve content and the user experience.

To manage tags and measure the effectiveness of campaigns we use:

  • Google Tag Manager – for the technical management of analytics and marketing tags,
  • Meta Pixel – for measuring the effectiveness of advertising on social networks (Meta Platforms Ireland Ltd.).

These tools may transfer certain technical data (e.g. IP address, device type, behaviour on the site) to third parties, in accordance with their privacy policies. Analytics and marketing cookies are loaded only after you give consent in the cookie window.

6. Maintaining and improving the website

On the basis of legitimate interest, we use information about your visit to our website in order to display the website to you. This information allows us to analyse and improve our website without compromising privacy.

7. Technical and organisational security measures

We have introduced strict data protection measures:

  • encryption of traffic on the site (HTTPS),
  • protection of servers and premises with restricted access,
  • strong passwords, antivirus software,
  • access to data only for authorised persons,
  • regular staff training on personal data protection.

8. Communication

If you give us your contact details (e.g. when you contact us by e-mail or telephone), we will use them only to contact you and to prepare an offer, a pro forma invoice or similar.

If you have used our services, we will use your e-mail address to inform you about news and to advise you on how best to use our services. If you do not wish to receive our e-mails, you can click the unsubscribe link at the bottom of the e-mail.

If you do not wish to fill in contact forms on our site, you can contact us in another way – by e-mail to szzp@banjakulasi.com.

9. Data retention period

We do not keep personal data longer than necessary for the purpose for which we obtained them.

This assessment is based on the type of personal data, the product or service for which we collected them, and the period for which you, as the data subject, can reasonably expect your data to be kept (e.g. business cooperation – a maximum of 10 years after the cooperation ends; newsletters – until consent is withdrawn).

10. Your rights

As a data subject you have the following rights:

Right of access

The data subject has the right to obtain from the controller confirmation as to whether their personal data are being processed and, if so, access to the personal data and the following information: the purpose of processing; the categories of personal data processed; the recipients or categories of recipients to whom the data have been or will be disclosed, in particular recipients in another country or an international organisation; the envisaged period for which the data will be stored or, if that is not possible, the criteria used to determine that period; and any restriction of access in accordance with the law.

Right to rectification

The data subject has the right to have inaccurate personal data rectified by the controller without undue delay. Taking into account the purpose of processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

Right to erasure

The data subject has the right to have the controller erase personal data concerning them, and the controller is obliged to erase the data without undue delay, where one of the following applies:

  • a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • b) the data subject has withdrawn the consent on which processing was based under Article 8(1)(a) or Article 11(2)(a) of the Personal Data Protection Act (ZZLP), and there is no other legal ground for processing;
  • c) the data subject has objected to processing under Article 23(1) ZZLP and there are no overriding legitimate grounds for processing, or the data subject has objected under Article 23(2) ZZLP;
  • d) the personal data have been unlawfully processed;
  • e) the personal data have to be erased to comply with a legal obligation of the controller;
  • f) the personal data have been collected in relation to the offer of information society services referred to in Article 10(1) ZZLP.

Erasure is possible only where we have no overriding legitimate grounds for processing.

Right to restriction of processing

The data subject has the right to restriction of processing where one of the following applies: the data subject contests the accuracy of the personal data, for a period enabling the controller to verify their accuracy; the processing is unlawful and the data subject opposes erasure and requests restriction instead; the controller no longer needs the personal data for processing, but the data subject requires them for the establishment, exercise or defence of legal claims; the data subject has objected to processing under Article 23(1) ZZLP, pending verification whether the controller’s legitimate grounds override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance, where processing is based on Article 8(1)(a) or Article 11(2)(a) ZZLP or on a contract under Article 8(1)(b) ZZLP, and the processing is carried out by automated means.

Right to object

You have the right to object to processing, in particular where it concerns direct marketing.

If you believe your rights have been infringed, you can contact us directly by e-mail at szzp@banjakulasi.com or the competent supervisory authority:

Personal Data Protection Agency of Bosnia and Herzegovina
Dubrovačka 6, 71000 Sarajevo
E-mail: azlpinfo@azlp.ba

11. Changes to this privacy policy

We update this privacy policy regularly so that it remains accurate and in line with applicable law. All changes will be published on our website, in accordance with the principle of transparency.