Privacy Policy
Version: v1.0 · Effective from: 29.10.2026 · Previous version: none
1. Who processes your data
Controller: a company established in the United States whose product is Normalius (normalius.com); in this policy: the "Provider" (also "we").
The Provider's identification details are shown above; on request we also send them in text form to info@normalius.com.
Privacy contact: info@normalius.com; by post to the Provider's address shown above. Please use this address for all questions about personal data, whether you are in Bosnia and Herzegovina, Serbia, Montenegro, the EU or another country. Data protection officer: the Provider has not appointed a data protection officer. Please send all data protection questions to info@normalius.com.
2. Scope
Normalius has two roles:
- Controller for data of website visitors and of persons who submit a quote request (contact details, company information from the questionnaire that we use for the quote), and for contract, billing and communication data.
- Processor for data that a company (client) gives us so that we can prepare its documentation, after payment of the quote. The client then decides on the processing as controller, and the processing is governed by the Data Processing Agreement (DPA), which forms part of the Terms. For these matters please contact the company you work for; we act on its instructions.
The service is intended for businesses (B2B), not for consumers. The service is offered to companies established in Bosnia and Herzegovina, Serbia and Montenegro.
References to articles in this policy are to the Law on Personal Data Protection, "Official Gazette of BiH" 12/25 (BiH Law). Persons in Serbia and Montenegro also have the rights provided by the personal data protection law of their country.
3. What data we process, why, and on what basis
| # | When | Data | Purpose | Legal basis (BiH Law) | Retention |
|---|---|---|---|---|---|
| 3.1 | Visiting the website | IP address, access time, requested page, browser type (server logs kept by the hosting provider) | operation and security of the website, detection of abuse | legitimate interest, Art. 8(1)(f) | the period set by the hosting provider (Hostinger) for server logs |
| 3.2 | Submitting a request | IP address in the request counter | protection against automated and bulk submissions (rate limiting) | legitimate interest, Art. 8(1)(f) | only as long as needed for rate limiting |
| 3.3 | Quote request (through the form or by e-mail) | name, business e-mail, phone, company name, country, company ID / tax ID (optional), selected package, language | preparing and sending the quote, communication about the request | for the company: steps prior to entering into a contract at the company's request, Art. 8(1)(b); for the company's contact person: legitimate interest in communicating with the company that requested the quote, Art. 8(1)(f) | see section 6 |
| 3.4 | Quote request | company information from the questionnaire (e.g. headcount, sector, systems in use); where the questionnaire contains names or roles of employees, also those | estimating scope and price for the quote | Art. 8(1)(b) | see section 6 |
| 3.5 | Quote request | acceptance record: version of the Terms, version of this policy, confirmation on processing of company data, timestamp | evidence of what was accepted and when | legitimate interest, Art. 8(1)(f): establishing and defending legal claims | see section 6 |
| 3.6 | Payment | payer name and account, amount, date and payment reference; once card payment is available: payer name, e-mail, billing address, payment status, last four digits and card brand (the Provider does not receive the full card number or security code; Stripe receives them) | collecting payment of the quote | performance of the contract, Art. 8(1)(b) | see section 6 |
| 3.7 | After payment | quote, invoice, payment data | accounting and tax | legal obligation to keep accounting and tax records, Art. 8(1)(c) | period required by the accounting and tax laws that apply to the Provider |
| 3.8 | After payment | data the company provides for its documentation (including names and roles of employees) | preparing the client's documentation | Normalius is a processor; the legal basis is determined by the client (see section 2 and the DPA) | per DPA, section 10 |
The data in 3.3 and 3.4 is required to prepare a quote; without it we cannot answer the request. Please do not enter special categories of data (e.g. health, religion) or data not needed to describe the company. Where the questionnaire allows it, describe employees by role (e.g. "ISMS manager") instead of by name; names can be added after the contract is concluded.
We do not use the data for advertising, do not sell it and do not share it with third parties for their marketing. If we later wish to send you an offer for another service, we do so only with an opt-out in every message, and after you object we no longer send such messages (BiH Law Art. 23).
4. How your request travels and who can read it
- You complete the questionnaire in your browser. Until you submit it, the draft answers are stored only on your device (browser
localStorage). We do not see them. - When you click "Order and request the pro-forma invoice", your browser encrypts the entire request (contact details, questionnaire and confirmations) with the provider's public key before sending it.
- The website hosting provider (Hostinger) receives and stores only the encrypted version of the request. Hostinger does not have the decryption key.
- The provider downloads the request to its virtual server, which is the only place where the decryption key is kept, and deletes the encrypted copy from the website after a confirmed download. An encrypted request that has not been downloaded is deleted automatically after 30 days at the latest.
- The request is decrypted on that virtual server. The decrypted request and the documents we prepare are kept there, in a protected folder of a separate user account, outside the software development environment. We rent the server from the provider Evolushost (Evolus IT Solutions GmbH) in a data centre in Austria (EU). The server provider has technical access to the server (section 5).
- The finished document package is transferred from the virtual server to the provider as a ZIP archive encrypted with AES-256, by e-mail only to the provider's fixed internal address (never to your address). The password is never sent by e-mail. The message does not contain your company name, only the request number. The provider's e-mail service carries the encrypted archive and sees message data (sender, recipient, time, subject with the request number).
- The provider hands the package over to you separately, in the way agreed with you.
- If you send your order by e-mail to info@normalius.com, the message goes through the Provider's e-mail service (Microsoft 365, section 5) and is not encrypted the way a request through the form is. In the e-mail, include only your contact details and the company name; do not send documents, passwords or data about employees.
Software and artificial intelligence (AI) assistants do not receive your data. Documents are generated from templates.
5. Who receives the data
| Recipient | Role | What it receives |
|---|---|---|
| Hostinger (the Hostinger group company with which the Provider has its hosting contract) | processor: website hosting and temporary storage of encrypted requests | encrypted request; IP addresses and server logs (3.1 and 3.2) |
| Evolushost (Evolus IT Solutions GmbH, Austria) | processor: virtual server on which requests are decrypted and stored and documentation is prepared | decrypted request (contact details, questionnaire, acceptance record) and prepared documents; the provider has technical access to the server |
| Provider's e-mail service: Microsoft 365 (Exchange Online), Microsoft | processor: sending quotes, correspondence and internal transfer of the package from the server to the provider, in accordance with the data processing agreement with Microsoft | name, e-mail, correspondence, quote; the package only as an encrypted ZIP archive without the password, labelled with the request number |
| Stripe (Stripe, LLC, USA), once card payment is available | card payments: processor for part of the processing and independent controller for part (fraud prevention, legal obligations of payment services); Stripe's privacy policy applies to that part | card payment data under 3.6, IP address and device data at checkout |
| Your bank and the Provider's bank | independent recipients | payment data (3.6) |
| Lead Auditor working with the provider | person authorised to process, bound by confidentiality | only after a contract is concluded and only for reviewing the documentation package before handover (under the DPA) |
| the bookkeeping service that keeps the Provider's books, when engaged by the Provider | processor | quote, invoice, payment data |
| public authorities | independent recipients | only where required by law |
The full list of sub-processors with location and status is published on the "Sub-processors" page of this website.
6. How long we keep data
| Data | Period |
|---|---|
| Encrypted request at Hostinger | until confirmed download, at most 30 days from submission |
| Questionnaire draft in your browser | until the request is submitted successfully, when the draft is deleted from the browser automatically; if you do not submit it, until you delete it ("Delete draft" button or clearing browser data) |
| Request without a concluded contract (contact details, questionnaire, acceptance record) | 6 months from sending the quote, then deletion |
| Contact details and acceptance record where a contract is concluded | contract term and the limitation period for contractual claims under the governing law (Terms, section 13) |
| Company data for documentation and generated documents (Normalius as processor) | contract term, then deletion within 30 days and from backups within 90 days (DPA section 10.2), unless the client requests return |
| Quote, invoice, payment data | period under the accounting and tax laws that apply to the Provider; data Stripe keeps as independent controller is kept under its own policy |
| Server logs and request counter | see 3.1 and 3.2 |
After the period ends, the data is deleted or irreversibly anonymised.
7. Cookies and similar technologies
The website does not use cookies for tracking, analytics or advertising and does not load third-party tracking tools. The website does not load external fonts, scripts or content from content delivery networks (CDN), so when you visit it your browser does not send your IP address to third parties other than the website's hosting provider (section 5).
The website uses the browser's localStorage only to keep the questionnaire draft on your device while you fill it in. This data does not leave your device until you click "Order and request the pro-forma invoice". For this reason the website does not show a cookie banner.
8. Profiling and automated decision-making
We do not profile individuals and do not take decisions based solely on automated processing that produce legal or similarly significant effects for you. Quotes are prepared and sent by a person.
9. Transfers outside BiH and outside the EU
- Hostinger stores encrypted requests in its data centre, under the hosting contract. The content of the request is encrypted before it is sent and Hostinger does not have the decryption key.
- Hostinger also uses its own sub-processors for its services, with the safeguards set out in its data processing agreement.
- Decrypted data is kept on a virtual server at the provider Evolushost in Austria (EU).
- For persons and companies in BiH, Serbia and Montenegro, sending data to the EU is a transfer to another country. The rules on transfers to other countries in the BiH Law (Art. 46–51), or in the laws of Serbia and Montenegro, apply to such transfers.
- United States. The Provider is a US company and accesses the data on the server in Austria as such; we treat this access as a transfer of data to the US. On the Provider's side, access is limited to persons working for the Provider, bound by confidentiality, and only for the purposes in this policy.
- Stripe (once card payment is available). Card payment data is processed by Stripe, LLC in the US and by Stripe's affiliates and sub-processors in other countries. Stripe sets out its transfer mechanisms in its data processing agreement and privacy policy; transfers take place according to the information published by Stripe.
- E-mail (Microsoft 365). Messages (quote, correspondence, encrypted package) are stored with Microsoft, in accordance with the data processing agreement with Microsoft. Microsoft is a US company.
10. Your rights
You have the right to request:
- access to your data and a copy;
- rectification of inaccurate data;
- erasure;
- restriction of processing;
- portability of data you provided;
- objection to processing based on legitimate interest, including direct marketing (BiH Law Art. 23).
Send your request to info@normalius.com. We may ask for additional confirmation of identity if we cannot establish that the request is yours. We reply without undue delay and at the latest within 30 days; this period may be extended by a further 60 days where necessary, and we will inform you of this within the first period (BiH Law Art. 14(3)). Where a law that applies to the processing sets a shorter period, we observe the shorter period. Requests concerning data under 3.8 are forwarded to the company that is the controller.
Complaint to a supervisory authority. You have the right to lodge a complaint with a supervisory authority or to bring an action before the competent court:
- BiH: Personal Data Protection Agency in Bosnia and Herzegovina, azlp.ba;
- Serbia: Commissioner for Information of Public Importance and Personal Data Protection, poverenik.rs;
- Montenegro: Agency for Personal Data Protection and Free Access to Information, azlp.me;
- EU: the supervisory authority of the Member State where you live or work (e.g. Croatia: AZOP, azop.hr).
11. Security
The measures are described in section 4 and in Annex 2 of the DPA. Annex 2 distinguishes measures in place from planned measures.
12. Changes to this policy
Each version has a number and a date. With every quote request we record the version you were shown. Material changes are published on this page before they apply, with a new version number and date.