Privacy Policy

Kojeza is a web-based marketplace that connects hikers with guided tours and hiking societies (Planinarska društva) in Bosnia and Herzegovina. The platform is operated by Monoklik d.o.o., a company registered in Bosnia and Herzegovina, referred to in this policy as “we”, “us” or “our”.

Monoklik d.o.o. is the controller of the personal data described below. This policy explains what we collect, why we are allowed to collect it, who we share it with, how long we keep it, and what you can require us to do. By using Kojeza you confirm that you have read it.

• Company: Monoklik d.o.o.
• Registered seat: Kolodvorska 12, 71000 Sarajevo, Bosnia and Herzegovina
• JIB (company ID number): 4203627400007
• Data protection contact: info@kojeza.com

We process personal data only where we have a legal basis for doing so. For each purpose, that basis is:

• Performance of a contract — creating and running your account, taking bookings, processing payments, and letting organizers manage the tours you registered for. Without this data we cannot provide the service.
• Compliance with a legal obligation — keeping accounting, invoicing and tax records that the laws of Bosnia and Herzegovina require us to retain.
• Our legitimate interests — keeping the platform secure, preventing fraud and abuse, resolving disputes, and understanding in aggregate how Kojeza is used so we can improve it. We balance these interests against your rights, and you may object at any time.
• Your consent — approximate location data, and marketing messages. Consent is always optional, and you can withdraw it at any time without affecting anything we did before you withdrew it.

• To operate, maintain, and improve the Kojeza platform
• To create and manage your account
• To facilitate event registration, participant management, and communication between organizers and hikers
• To send you service-related notifications, event updates, and reservation confirmations
• To ensure the safety and security of our platform and users
• To comply with legal obligations, keep the accounting records we are required to keep, and resolve disputes
• To measure in aggregate how the platform is used, so we can improve it

We do not sell your personal information. We share data only with the following service providers, each of which processes it on our instructions and is bound by a data processing agreement:

• Firebase (Google) — Authentication and user management
• Cloudflare R2 — Image and file storage
• Neon — PostgreSQL database hosting
• Vercel — Web application hosting and deployment
• Google Maps — Location services and mapping
• Railway — Backend API hosting
• Monri — Secure card payment processing for paid tours

When you register for an event, your name, email, and phone number are shared with the event organizer so they can manage participation and reach you about the tour. The organizer is a separate controller for that purpose and is responsible for how they handle your details.

We may also disclose data where we are legally required to — for example to a court, a tax authority, or the police acting on a lawful request.

Kojeza is operated from Bosnia and Herzegovina, but the service providers listed above are established outside the country, mainly in the European Union and the United States. Your personal data is therefore transferred abroad.

Our database and backend servers are hosted in Frankfurt, Germany. File storage and content delivery run on Cloudflare's global network. Authentication and mapping are provided by Google.

Where personal data leaves Bosnia and Herzegovina, we rely on the data processing agreements and standard contractual clauses offered by each provider, which oblige them to protect your data to a standard equivalent to the one described in this policy. You may request further detail about these safeguards using the contact details below.

We keep personal data only as long as we need it. In practice that means:

• Account and profile data — for as long as your account is active. If you delete your account, we remove this data within 30 days.
• Booking, payment and invoice records — for the period that the accounting and tax legislation of Bosnia and Herzegovina requires us to keep them, which continues after your account is deleted. These records cannot be erased on request, but we restrict them to accounting use only.
• Event participation records — held by the organizer of the tour you joined. We retain our own copy in anonymised form for statistics.
• Event chat messages — for as long as the event chat they belong to exists.
• Correspondence with us — up to two years after the matter is closed.

In accordance with applicable data protection law, you have the following rights:

• Right of Access — You can request a copy of the personal data we hold about you.
• Right to Correction — You can update or correct inaccurate personal data through your profile settings or by contacting us.
• Right to Deletion — You can delete your account at any time from your profile settings. This removes your personal data, except for the accounting records described above, which we are legally required to keep.
• Right to Data Portability — You can request your data in a structured, machine-readable format.
• Right to Object — You can object to processing that we base on our legitimate interests.
• Right to Restriction — You can ask us to pause processing while a dispute about the accuracy or lawfulness of your data is resolved.
• Right to Withdraw Consent — Where we rely on your consent, such as location data or marketing messages, you can withdraw it at any time. Withdrawing consent does not make our earlier processing unlawful.
• Right to Lodge a Complaint — If you believe we have handled your data unlawfully, you can complain to the supervisory authority: Agencija za zaštitu ličnih podataka u Bosni i Hercegovini, Vilsonovo šetalište 10, 71000 Sarajevo (azlp.ba).

To exercise any of these rights, write to info@kojeza.com from the email address on your account.

We will reply to your request within 30 days. If a request is unusually complex and we need longer, we will tell you why within that same period.

We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects concerning you or similarly significantly affects you. Guide verification, organization approval and payment disputes are all reviewed by a person.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority without undue delay, and we will tell you directly where the risk to you is high.

While you hold an account or a booking, we send you service messages you cannot switch off: registration confirmations, tickets, changes to a tour you joined, payment receipts, and safety notices. These are part of providing the service.

Marketing messages — news, offers and recommendations unrelated to a booking you already made — are sent only if you have opted in. Marketing is off by default. You can opt in or out at any time in your account settings, or through the unsubscribe link in any marketing email. Declining marketing never affects your use of Kojeza.

Kojeza uses only cookies that are strictly necessary to run the service: those that keep you signed in and maintain your session, set by Firebase Authentication. We do not use advertising cookies, and we do not run third-party analytics or tracking scripts. Because we set no optional cookies, we do not ask you for cookie consent. If that ever changes, we will ask for your consent before setting them.

Kojeza accounts are intended for people aged 16 and over, and we do not knowingly let anyone under 16 create one. A parent or guardian may register a child for a tour through their own account; in that case the parent or guardian provides the child's details, consents to us processing them, and remains responsible for that information. If you believe a child has created an account, or that we hold a child's data without a parent's involvement, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date, and — where the change significantly affects you — by email. Your continued use of Kojeza after changes take effect constitutes your acceptance of the revised policy.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email: info@kojeza.com

Monoklik d.o.o., Kolodvorska 12, 71000 Sarajevo, Bosnia and Herzegovina — JIB 4203627400007