SERP / Obrtnica Privacy Policy

Public notice on the processing of personal data | Federation of Bosnia and Herzegovina

The Bosnian publication is the governing text for the Federation of Bosnia and Herzegovina. This English version is provided for access.

1. Who we are and who this Policy covers

1.1 SERP Corporation d.o.o., Srebrenička bb, 77250 Bosanski Petrovac, JIB 4263990680006, registration number 017-0-Reg-26-000337 (“SERP”, “we”) is the controller for the processing described in this Policy.

1.2 This Policy covers visitors to our public pages, people who request a demo or contact us, account users, representatives and contacts of organizations, payers, support users, and people who communicate with SERP.

1.3 Obrtnica is the name of the SERP cloud ERP product. This Policy covers the public site, registration, account management, and SERP’s own business processing. It does not describe every processing of business data that a customer organization carries out in its workspace.

2. When SERP is controller and when it is processor

2.1 SERP is the controller when it determines the purpose and means of processing, in particular for:

• registration, user accounts, authentication, and security;
• organization, contract, acceptance, invoicing, and collection data;
• enquiries, demo requests, support, and feedback;
• abuse prevention, audit, legal requests, and compliance;
• operation of the public site and permitted analytics or attribution; and
• programs or features for which SERP itself determines the purpose.

2.2 The customer organization is generally the controller of the business and personal data its users enter in the workspace, such as data about employees, customers, suppliers, accounting, and payroll. SERP processes that data on the organization’s behalf under the Subscription Agreement and the DPA.

2.3 For questions about business data in a workspace, contact the organization that operates that workspace first. SERP will assist it in line with the DPA.

2.4 Being a payer, sponsor, referral, or member of the same organization does not by itself grant access to another workspace.

3. Data we collect

3.1 Public site and technical data

We may process IP address, date and time, requested page, referrer, request identifier, browser and device type, language, approximate location derived from network data, response status, and security events.

When analytics is enabled, we may process aggregated visit data through Google Analytics 4 on marketing pages, sign-in, registration, and the signed-in application. A page view carries a surface label and the first path segment, not the full document address. Microsoft Clarity on those pages runs only after consent to analytics. The Google tag loads in advanced consent mode: before a choice, analytics_storage is denied (cookieless measurement). With consent we also send funnel events (lead, registration, setup completion, upgrade confirmation). When a subscription invoice is marked paid, the server sends Google Analytics only that event, without the invoice number, amount, or organization name.

When Clarity is enabled, the signed-in application, sign-in, and registration send Microsoft data about interface use (including session recordings). Strict text masking should be enabled in the Clarity project before production use.

If marketing attribution is allowed, we may record UTM parameters, campaign source, landing page, the page from which a demo was chosen, content, and language. Details are in the Cookie Policy.

3.2 Contact, demo, and newsletter

We process name, business email, company, message, and information you provide yourself. The demo form may include the number of clients and accountants, the mix of client types, jurisdictions, current software, business problem, and referral source.

3.3 Registration and account

We process first name, last name, business email, optional phone, password hash, security settings, language, account status, memberships, roles, permissions, sign-in time, sessions, tokens, and data needed to recover or protect the account.

During registration we also process the organization’s legal name and form, address, municipality, postal code, registration number, JIB, VAT number, responsible person, and activity codes.

3.4 Contract, billing, and acceptance

We process the identity of the authorized acceptor, the organization, workspace, billing group, payer, plan, seats, add-ons, invoices, payments, credits, tax data, and billing communications.

Evidence of electronic acceptance may include the document version and hash, the authorization confirmation text, UTC and local time, IP address, user agent, event identifier, and delivery confirmation.

3.5 Use of the Platform, support, and security

We process account events, administrative changes, audit records, request identifiers, errors, background job status, and security signals.

For support and feedback we process the request content, messages, active workspace, submitter, route and module, language, application version, an optional business-record identifier, and the last API request ID.

3.6 Data from other sources

We may receive data from your organization’s administrator, payer, or authorized representative, from public registers, from an integration you chose, from an authentication or security provider, and from authorities when that is lawful.

If we did not obtain the data directly from you, we will inform you within the time and scope the law requires, unless a legal exception applies.

4. Why we process data and the legal basis

4.1 Where we rely on legitimate interest, we assess necessity, expectations, and the impact on your rights, and we apply minimization and the right to object.

4.2 We do not use consent as a condition for processing that is necessary for a contract. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

4.3 We do not sell personal data or use it to advertise third parties based on behavior without a separate notice and any consent that is required.

5. Automation and AI features

5.1 When an organization enables the relevant feature, the Platform may use automation or AI to extract and classify data from documents. Those results are assistive and are subject to review by an authorized user.

5.2 SERP does not make a solely automated decision about a natural person that produces a legal or similarly significant effect, unless that processing is specifically described, has an appropriate legal basis, and has safeguards.

5.3 When SERP processes a document through AI on behalf of an organization, the role, vendor, location, and transfer are governed by the DPA, the Order, and the Subprocessor Register.

6. Who we disclose data to

We disclose data only when it is needed:

• to authorized SERP employees and engaged persons;
• to administrators and authorized users of your organization;
• to the payer only for data needed for the accepted billing, without automatic access to the workspace;
• to infrastructure, storage, email, job-queue, observability, maps, or AI-processing vendors listed in the public Subprocessor Register;
• to banks, fiscal gateways, email recipients, and other integrations the organization expressly chooses;
• to professional advisers, auditors, and insurers under confidentiality;
• to competent authorities when the law requires or permits it; and
• to a business acquirer after appropriate review and protection.

A vendor may be a subprocessor for business data and a processor for SERP’s own controller processing. Current status, purpose, and location are published in the Subprocessor Register.

7. Transfers to another country

7.1 Some vendors or their supporting services may process data outside Bosnia and Herzegovina. Before a transfer we identify a permitted mechanism under Chapter IV of the Law and record known locations and safeguards.

7.2 We do not present EU standard contractual clauses as a sufficient Bosnia and Herzegovina mechanism if the Law requires another clause, an adequacy decision, or approval by the Agency.

7.3 Information about a specific vendor and mechanism is available in the public Subprocessor Register or on request, to the extent that does not undermine security.

8. How long we keep data

8.1 We may keep data longer when the law requires it, there is a legal hold, an unresolved dispute, a security investigation, or a need to prove a fact. Access is then limited to the purpose of retention.

9. Your rights

Under the Law you may have the right to:

• receive information and access your personal data;
• request correction of inaccurate data or completion of incomplete data;
• request erasure when there is no longer a legal basis;
• request restriction of processing;
• receive the data or transmit it to another controller where that applies;
• object to processing based on legitimate interest;
• withdraw consent;
• seek protection in relation to automated decision-making; and
• lodge a complaint with the Agency or bring a claim before the competent court.

Send a request to support@serpcorporation.us. We may ask for information reasonably needed to confirm identity. We will respond without undue delay and within the statutory period.

Personal Data Protection Agency in Bosnia and Herzegovina: Dubrovačka 6, 71000 Sarajevo, azlp.ba.

10. Security

We apply technical and organizational measures appropriate to the risk, including access control, tenant isolation, protection of transmission and storage, secrets management, security logs, incident response, backups, and secure development according to the actual production profile.

No system is absolutely secure. Further information is in the Security Addendum, without disclosing details that would weaken protection.

11. Children’s data

The public site and the Platform are intended for business users and are not directed at children. Registration may be completed only by a person with legal capacity who is authorized to act for the organization.

If we learn that we have collected a child’s data for our own purpose without an appropriate basis, we will take reasonable steps to delete it. Data about children that an organization lawfully processes through its business functions is governed by its instructions and the DPA.

12. Cookies and local storage

The current application primarily uses localStorage and sessionStorage for authentication, the active workspace, language, the registration flow, interface settings, and, where allowed, marketing attribution.

When analytics is enabled, we use Google Analytics 4, which may set cookies or similar identifiers in the browser after consent. Page views on sign-in, registration, and the application are sent without the full document address. Microsoft Clarity (clarity.ms) on marketing pages follows consent to analytics; on the signed-in application, sign-in, and registration it runs when a project ID is set.

The detailed list, purposes, and periods are in the Cookie Policy.

13. Changes to this Policy

We will publish a new version with an effective date. We will announce a material change of purpose, legal basis, recipients, or rights with a clear notice and, where required, ask for new consent.

We keep previous published versions with an identifier, content hash, and effective date.

14. Contact