Privacy policy

Groundwork Maljevačka 9A 77230 Velika Kladuša Bosnia and Herzegovina Email: info@groundwork.ba

We collect personal data only when you provide it: through the contact form (name, organisation, role, email, message) or by booking a call (name, email, organisation, role, country, program description, timeline). In addition, with your consent, the site uses Google Analytics 4 to count visits and understand how it’s used — see “Cookies and analytics” below.

Solely to respond to your enquiry, schedule a call if you booked one, and conduct any subsequent engagement. We do not maintain a marketing list and we do not share your data with anyone except the processors listed below.

Form submissions are received by a Cloudflare Worker in Cloudflare's edge infrastructure and delivered to our inbox via the Microsoft Graph API (Microsoft 365 tenant). No third-party form-handling service is involved. Scheduling uses Microsoft Bookings; if a call is booked, Microsoft Corporation processes the appointment data and Microsoft Teams hosts the call. Data is processed under Microsoft's standard EU data-protection terms. Email delivery and inbox storage are provided by Microsoft 365 (Microsoft Ireland Operations Ltd). Hosting: Cloudflare, Inc., the United States — under EU-US Data Privacy Framework adequacy. Site analytics: Google Ireland Limited (Google Analytics 4) — under EU-US Data Privacy Framework adequacy. We keep GA4’s advertising features turned off (no Google Signals, no audience targeting, no remarketing).

We retain contact-form submissions and booking records for up to 24 months, after which they are deleted unless an active engagement requires them. Records belonging to an engagement are kept for its duration and any retention period that tax or accounting law imposes on the engagement's own records. Operational logs: the contact endpoint records the outcome of each submission — what happened to it, the language of the page, a timestamp and a random reference — so that failures are visible to us. These lines carry no personal data, with one exception: if a message fails to reach our inbox, the log also records your email address and the length of your message, so that we can still reply to you. Cloudflare keeps these logs for a few days (three on our current plan) and then deletes them.

Under GDPR Articles 15–22 you have the right to access, rectify, erase, restrict, object to, and request portability of your personal data. To exercise these rights, email info@groundwork.ba. We respond within one month.

If you believe your data is processed unlawfully, you may complain to a data-protection supervisory authority — in Germany the data-protection authority of your federal state, in Bosnia the Personal Data Protection Agency (Agencija za zaštitu ličnih podataka u BiH).

This site uses Google Analytics 4 (GA4) to measure visits, page views, and basic device/region attributes — but only if you allow it in the consent banner. Until you accept, no GA4 script loads and no analytics cookies are set. If you accept, GA4 sets cookies named `_ga` and `_ga_<measurement-id>` in your browser; they recognise repeat visits and aggregate metrics. We do not use GA4’s advertising features. You can change your decision at any time via the “Cookie settings” link in the footer. Google also publishes an official browser opt-out at https://tools.google.com/dlpage/gaoptout — it disables GA across every site, not only this one. Browser-level Do Not Track / GPC and tracker-blockers (uBlock Origin, Brave Shields, etc.) work too. No other tracking or advertising cookies are set on this site.