Privacy and personal data protection policy

Last updated: 31.8.2026.

Introduction

VanillCore d.o.o., the operator of the Godi.ba platform, is committed to protecting the privacy and security of its users’ personal data.

This Privacy Policy explains what personal data we collect, why we process it, how we use it, with whom it may be shared, and what rights users have in relation to their personal data.

Personal data is processed in accordance with applicable personal data protection legislation of Bosnia and Herzegovina, including the Law on the Protection of Personal Data (“Official Gazette of Bosnia and Herzegovina”, No. 12/25) and, where applicable, relevant requirements of the EU General Data Protection Regulation (GDPR).

Data Controller

The controller of personal data is:

VanillCore d.o.o.
Kromolj 31
71000 Sarajevo, Bosnia and Herzegovina
Company ID: 4202837180003
VAT ID: 202837180003
Phone: +387 61 544 588
Email: info@godi.ba
Website: godi.ba

For questions concerning the processing of personal data, users may contact us using the email address above.

Personal Data We Collect

Depending on how the platform is used, we may collect the following categories of personal data.

User information

first and last name;
email address;
telephone number;
country of residence;
account information;
information necessary for communication and customer support.

Reservation information

details of the reserved service;
reservation date and time;
date of service;
number of guests;
special requests related to a reservation;
communications with users and service providers;
reservation history.

Payment information

Godi.ba does not store full payment card details.

Transaction-related information may include:

transaction amount;
currency;
transaction date and time;
transaction status;
transaction identifier;
information required for accounting, customer support and dispute resolution.

Sensitive card information is processed by the relevant payment service providers and participants in the card payment system.

Technical information

When using our website, certain technical information may be collected automatically, including:

IP address;
device type;
operating system;
browser type and version;
language settings;
website usage information;
pages visited;
date and time of access.

Marketing information

Where the user has provided the appropriate consent, we may process the user’s email address and other relevant information for newsletters, promotional communications and information about offers.

Purposes of Processing

We may process personal data for the following purposes:

creating and managing user accounts;
processing reservations;
performing contracts with users;
processing and recording payments;
communicating with users;
providing customer support;
sending reservation confirmations and related notifications;
handling complaints and disputes;
preventing fraud and misuse;
protecting the security of the platform;
complying with legal and accounting obligations;
analyzing website usage;
improving our products and user experience;
personalizing content where applicable;
sending marketing communications based on appropriate consent;
displaying relevant advertising where applicable and in accordance with user preferences.

Legal Basis for Processing

Depending on the specific purpose, processing may be based on:

performance of a contract or taking steps at the user’s request before entering into a contract;
compliance with a legal obligation;
legitimate interests of VanillCore d.o.o., where legally permitted;
the user’s consent, where consent is required.

Users may withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Cookies and Analytics

Godi.ba uses cookies and similar technologies for website functionality, security, analytics, improving the user experience and, where applicable, marketing.

We may use third-party technologies and services including:

Google Analytics;
Google Ads;
Meta Pixel;
Google Maps;
newsletter and similar communication tools.

Cookies necessary for website functionality may be used without separate consent where permitted by applicable law.

For non-essential cookies and technologies, users will, where required, be given the opportunity to accept or reject their use through appropriate cookie settings.

Google Analytics, Google Ads and Meta Pixel

Godi.ba may use Google Analytics to understand how users interact with the website.

Google Ads and Meta Pixel may be used to measure and optimize advertising activities.

These technologies may collect information about website usage, devices, interactions with content and advertisements, and other technical information in accordance with the respective providers’ privacy policies and the user’s selected settings.

Where consent is required for a particular type of processing, the relevant technologies will only be activated after consent has been provided.

Google Maps

Godi.ba may use Google Maps to display locations of tourism offers and other geographic information.

The use of Google Maps may involve the processing of certain technical information in accordance with the provider’s terms and privacy practices.

Users may subscribe to receive newsletters and promotional communications.

Marketing communications may include information about:

new offers;
destinations;
experiences;
special promotions;
events;
Godi.ba content and updates.

Users may unsubscribe at any time by using the unsubscribe link included in marketing communications or by contacting Godi.ba.

Recipients of Personal Data

User data may only be made available to recipients where necessary for a legitimate business or legal purpose.

These may include:

tourism service providers and partners involved in a specific reservation;
payment service providers;
banks and other participants in the payment system;
hosting and IT infrastructure providers;
analytics and marketing service providers;
customer support providers;
accounting, legal and other professional advisers;
competent authorities where required by law.

Where service providers process personal data on our behalf, we seek to establish appropriate contractual and security measures.

Partners and Reservation Data

When a user makes a reservation, certain information may be shared with the partner providing the reserved service, to the extent necessary to fulfill the reservation.

Partners may use such information only for purposes related to fulfilling the reservation and other legitimate obligations associated with providing the service.

International Data Transfers

Some service providers whose technologies we use may process data outside Bosnia and Herzegovina.

Where an international transfer of personal data applies, VanillCore d.o.o. seeks to ensure that such processing is carried out using appropriate legal, contractual and security safeguards in accordance with applicable law.

Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected or as necessary to comply with legal, accounting, tax or other obligations or to protect legitimate interests.

Reservation and financial transaction data may be retained longer than data used solely for user accounts or marketing where required by law or legitimate business requirements.

When data is no longer required, it will be deleted, anonymized or otherwise removed from active processing in accordance with applicable requirements.

User Rights

Subject to applicable law, users may have the right to:

receive information about the processing of their personal data;
request access to their personal data;
request correction of inaccurate or incomplete data;
request deletion where the legal requirements for deletion are met;
request restriction of processing where applicable;
object to certain types of processing;
withdraw consent where processing is based on consent;
exercise other rights provided by applicable law.

Requests may be submitted to:

info@godi.ba

Requests should contain sufficient information to allow us to identify the user and properly process the request.

Children

Godi.ba is not intended for children who are unable to independently enter into a contract or provide valid consent under applicable law.

If we become aware that we have collected a child’s personal data without an appropriate legal basis, we will take reasonable steps to delete such information.

Data Security

VanillCore d.o.o. applies appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, destruction, alteration or other unauthorized processing.

Further information about security measures is provided in our Security Policy.

Personal Data Breaches

In the event of a security incident involving personal data, VanillCore d.o.o. will take appropriate measures to contain the incident, investigate and document it and, where legally required, notify the competent authority and affected individuals.

Changes to this Privacy Policy

This Privacy Policy may be updated from time to time due to changes in our business, technology or applicable legal requirements.

The current version of this Privacy Policy, together with the date of the latest update, will be published on this page.

VanillCore d.o.o.
Kromolj 31, 71000 Sarajevo, Bosnia and Herzegovina
info@godi.ba