1. Purpose and Legal Basis for the Processing of Personal Data

1.1

MKF MI-BOSPO processes your personal data for the following purposes:

• assessment and approval of loan applications;
• fulfilment of contractual obligations;
• responding to clients’ inquiries and requests;
• compliance with legal obligations;
• marketing and communication only with the explicit consent of the data subject.

1.2

MKF MI-BOSPO processes personal data on the following legal bases:

• performance of a contract or taking pre-contractual steps (Article 8, paragraph 1, point b) of the Law);
• compliance with legal obligations (Article 8, paragraph 1, point c) of the Law);
• consent of the data subject (Article 8, paragraph 1, point a) of the Law);
• legitimate interest of MI-BOSPO as the data controller or of a third party (Article 8, paragraph 1, point f) of the Law), provided that such processing does not adversely affect the rights and freedoms of the data subject.

2. Rights of Data Subjects

The data subject has the right to:

• request access to their personal data and information on the purpose of processing, categories of data, recipients and the planned retention period;
• request the rectification of inaccurate or incomplete data;
• request the erasure of data (the right to be forgotten), subject to statutory limitations;
• restrict the processing of personal data in certain circumstances;
• object to the processing of personal data;
• withdraw consent where processing is based on consent;
• exercise the right to data portability in accordance with the law;
• lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina.

To exercise your rights, you may contact the Data Protection Officer of MKF MI-BOSPO by e-mail at szzlp@mi-bospo.org or in writing at the following address: Bosne srebrene b.b., 75000 Tuzla.

3. Transfer of Personal Data to Other Data Controllers

Personal data of data subjects may be transferred to other data controllers only for the purpose of fulfilling contractual obligations, where required by the law, pursuant to an order of a competent court or authority, with the explicit consent of the data subject, or where necessary for the legitimate interest of MKF MI-BOSPO or a third party, subject to the principles of data minimisation and purpose limitation.

Where personal data are transferred to other data controllers, MKF MI-BOSPO acts in accordance with the principles of purpose limitation and data minimisation, ensuring that only the data necessary to achieve a clearly defined and lawful processing purpose are transferred.

Personal data must not be shared with third parties without a valid legal basis established by law or the explicit consent of the individual concerned.

With each data controller or data processor to whom personal data are transferred, MKF MI-BOSPO concludes a separate agreement on the processing and protection of personal data, which defines the rights and obligations of the parties, technical and organisational security measures, and ensures compliance with the Law on the Protection of Personal Data of Bosnia and Herzegovina and relevant regulations.

MKF MI-BOSPO regularly assesses the lawfulness, purpose and proportionality of each transfer of personal data, taking into account the protection of the rights and freedoms of data subjects.

Personal data shall not be transferred for direct marketing purposes without the consent of the data subject.

4. Security of Personal Data

Personal data are processed in a manner that ensures an appropriate level of security and confidentiality, as well as compliance with all principles of lawful processing, including purpose limitation, data minimisation, accuracy and storage limitation.

To protect personal data from unauthorised access, misuse, loss, destruction or alteration, appropriate technical and organisational security measures are implemented in accordance with the risks that may affect the rights and freedoms of data subjects.

The measures include, among others:

• encryption, pseudonymisation and access controls for personal data;
• restricting access to personal data;
• regular backups and protection of information systems;
• employee training and monitoring of compliance with internal data protection policies;
• monitoring and recording access to and activities involving data through technical monitoring systems;
• regular assessment and improvement of security measures in line with technological developments and changes in risks.

5. Data Retention Period

Personal data are retained for as long as necessary to fulfil the purpose for which they are processed, after which they are archived in accordance with legal and contractual obligations.

6. Changes to the Privacy Policy

MKF MI-BOSPO regularly updates its Privacy Policy to ensure that it contains accurate information. All amendments and additions will be published on the website and made available to clients in a timely manner, in accordance with the principle of transparency.

7. Data Protection Officer Contact Details

Contact details of the Data Protection Officer:

• E-mail: szzlp@mi-bospo.org
• Address: Bosne srebrene b.b., 75000 Tuzla