Privacy Policy
DRAFT: This Privacy Policy reflects only the site's current technical implementation. It must be reviewed and approved by the client and legal counsel before it is published.
Who we are
InGeo is a surveying firm based in Sarajevo, Bosnia and Herzegovina. Contact details (address, phone, e-mail) are on the Contact page.
Full registered business name and company registration number: TODO — confirm with the client.
What data we collect
Via the contact form we collect: name, phone and/or e-mail address, and the message text.
Via the quote form we collect: name, phone, service type, and optionally an address/cadastral parcel number and area.
Both forms allow optionally attaching documents (PDF, JPG, PNG or DWG), up to 6 files, at most 10 MB per file and 25 MB in total.
We only process your data once you explicitly confirm consent via the required checkbox on the form.
How we use your data
We use your data solely to respond to your enquiry or quote request and to communicate with you about it. We do not use it for marketing, and we never sell or rent it to third parties.
How your submission is delivered
Form data is e-mailed to the internal InGeo team via AWS SES.
Attached documents are never included directly in the e-mail — the message only references the file's name, size, and an internal storage key.
Storage of attached documents
Attached documents are stored in a private S3-type bucket (Amazon S3 or MinIO, depending on the environment), with no public access — a document cannot be reached via a public link.
Before storage, the file's actual content is checked, not just its extension, so only allowed formats are accepted (PDF, JPG, PNG, DWG).
Abuse protection (anti-spam)
To defend against automated (bot) submissions, the form uses a hidden trap field, a fill-time check, and a per-IP request limit (at most 5 per minute and 40 per day).
The IP address is processed for this purpose only transiently, in server memory — it is never written to a database and is cleared on every service restart.
When a submission is judged automated, it is silently discarded — never forwarded or permanently stored.
Cloudflare Turnstile (bot check)
The form may display a Cloudflare Turnstile check, which helps tell automated (bot) submissions apart from real visitors. It loads a script from challenges.cloudflare.com and sends the check's result to Cloudflare for verification.
Cloudflare, as an independent service provider, processes technical data for this purpose under its own privacy policy (cloudflare.com/privacypolicy).
Cookies
The site does not use cookies to remember the selected page language, nor cookies for analytics or visitor tracking.
The only cookies that may appear come from the external Cloudflare Turnstile check (when active on the form) and are subject to Cloudflare's own privacy policy.
How long we keep data
TODO — confirm with the client the exact retention period for enquiry/quote data and attached documents, and the process for deleting them.
Your rights
Under applicable personal-data-protection law in Bosnia and Herzegovina, you have the right to access, correct, and delete your personal data, and to object to its processing.
TODO — confirm with legal counsel the exact statutory reference, any designated data-protection contact, and the name and contact details of the relevant supervisory authority for complaints.
Contact about this policy
For any question about this privacy policy or about how your data is processed, contact us via the details on the Contact page.
TODO — confirm with the client whether a dedicated privacy e-mail address is wanted, separate from the general contact address.
Changes to this policy
This policy may be updated to reflect changes to the site or to applicable law.
Last updated: TODO — fill in at publication.