Privacy Policy

Last updated: November 11, 2026

This policy explains which personal data COMMIT d.o.o. collects when you use the neksus.ba website and send us an enquiry through it, why we collect it, who we entrust it to, how long we keep it and what rights you have. It is written in line with the EU General Data Protection Regulation (GDPR, Article 13) and the Law on Personal Data Protection of Bosnia and Herzegovina.

It applies to this website and to enquiries sent through it. It does not apply to the Neksus ERP application (app.neksus.ba): the processing of customer data there is governed by the contract and the data processing agreement concluded with each customer. The exception is section 3, which describes how the application handles data received from Google accounts. Use of the website itself is governed by our Terms of Use.

1. Data controller

The controller of your personal data is COMMIT d.o.o., Kralja Petra Karađorđevića 103, 78000 Banja Luka, Bosnia and Herzegovina. For any question or request concerning your personal data, write to info@neksus.ba or call +387 65 302 988. We currently have no appointed data protection officer; the e-mail address above is the single point of contact for all data protection matters.

2. What we process, why, and on what legal basis

a) Contact form and presentation requests

  • Data: first and last name, e-mail address (required), and optionally company name, phone number, type of user, area of interest and the text of your message. Without a name and an e-mail address we cannot reply, so the form cannot be sent without them.
  • Purpose: to answer your enquiry, schedule a presentation or prepare an offer, and to continue the conversation about that enquiry. We do not use the data for marketing you did not ask for.
  • Legal basis: when you write on behalf of a company or organisation, Article 6(1)(f) GDPR, our legitimate interest in answering a business enquiry addressed to us; when you write as a sole trader or in your own name, Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract.
  • Your message is delivered to our mailbox through the Resend service (see section 4). Sending the form is not consent to anything beyond this purpose.

b) Direct contact by phone or e-mail

We process the data you give us yourself, for the purpose of replying to you, on the basis of Article 6(1)(f) GDPR.

c) Technical data when you visit the website (hosting server logs)

  • Data: IP address, date and time of the request, page requested, browser and device type.
  • Purpose: delivering the website, security and abuse detection.
  • Legal basis: Article 6(1)(f) GDPR, our legitimate interest in running a secure and stable website.
  • Retention: our hosting provider Vercel keeps request logs for a short period, from one hour up to a few days depending on the hosting plan; we do not export them to other systems. Details in the Vercel privacy policy.

d) Audience measurement (Vercel Web Analytics)

  • Works without cookies, does not read data stored on your device and does not store your IP address. To tell visits apart within a single day it uses a temporary hash derived from the IP address and browser, which is automatically deleted within 24 hours and does not allow a person to be identified.
  • Data: pages visited (address without query parameters), referrer, country, device type, browser and operating system, and three events: contact form submitted, click on the phone number, and click on the button to schedule a presentation. The events never carry the contents of form fields or any personal data. We only ever see aggregate figures.
  • Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing how many people visit the website and which pages are useful, so we can improve the content. Because the measurement is aggregate, cookieless and free of profiling, we rely on this basis rather than on consent, which is also why the website shows no cookie banner. You can object at any time with one click in section 7, and the measurement is then switched off on your device immediately.
  • We do not use Google Analytics, Facebook Pixel or any other tracking or advertising tool.

e) Cookies and local settings

This website itself does not set any cookies. The language is part of the page address (/en/), so nothing needs to be remembered. The one exception is the embedded Google map on the Contact page (section f), where Google may set its own cookies. The only thing the website may store on your device is your own choice to switch audience measurement off (section 7), saved as a local browser setting at your explicit request; you can remove it by switching the measurement back on or by clearing your browser data.

f) Google map on the Contact page

The Contact page contains an embedded Google Maps map showing our location. When that page opens, your browser connects to Google's servers (Google Ireland Limited / Google LLC, USA), which receive your IP address and technical data about your browser and may set their own cookies, under the Google privacy policy. Google processes that data as an independent controller for its own purposes, not on our instructions. We show the map on the basis of our legitimate interest in helping you find our office (Article 6(1)(f) GDPR). If you would rather avoid that connection, do not open the Contact page; our address, phone number and e-mail are also in the footer of every page.

3. Google user data (Neksus application)

This section applies to the Neksus business application (Neksus ERP) at app.neksus.ba, which is shown as "Neksus" on Google's consent screen. It describes which data the application accesses in your Google account, how it uses, stores and shares that data, and how you can revoke access.

a) Sign-in with Google

When you sign in with your Google account, the application receives only your name, e-mail address and profile picture (Google scopes openid, email and profile). It uses them only to link your Google account to your user account in the application. Nothing else is taken from your Google account at sign-in.

b) Importing invoices from Gmail (OCR module)

The application accesses Gmail only when you click "Gmail" in the OCR module yourself and grant access. It then:

  • lists messages that have a PDF or image attachment;
  • downloads only the attachments you select (for example incoming invoices or bank statements) into its processing screen;
  • adds the label "Neksus OCR" to a processed message and moves it out of the Inbox; the message is not deleted.

The application does not send e-mails, does not delete messages and does not read messages you have not opened for import.

c) Importing files from Google Drive (OCR module)

The application accesses Google Drive only when you click "Google Drive" in the OCR module yourself and grant access. You can browse folders or search for a file by name, and the application downloads only the PDF files and images you select. It does not change, delete or save anything on your Drive.

d) Access token and storage

  • The Gmail and Google Drive access token stays only in your browser (in the memory of the open tab), is valid for at most one hour and is not stored on Neksus servers.
  • A selected file is processed in the application. When you save the document, the file is stored as an attachment to that document in your company's database in the application.

e) Data recognition with the Google Gemini API

To recognise the data on an invoice (supplier, amounts, line items), the application sends the selected file to the Google Gemini API. Only the file you selected is sent, and only for that recognition.

f) Limited Use

We do not sell data received from your Google account, do not share it with third parties (other than sending the selected file to the Google Gemini API as described in point e), do not use it for advertising and do not use it to train AI models.

Neksus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

g) Revoking access and deletion

  • You can revoke the application's access to your Google account at any time at myaccount.google.com/permissions by removing "Neksus". After that the application no longer has access to Gmail or Google Drive.
  • Neksus does not store the Gmail or Google Drive token, so after you revoke access there is no token on our side to delete.
  • Files you imported and saved as a document are kept for as long as your company keeps them in the application. Your company can delete them together with the document, or request deletion at info@neksus.ba or office@commit.ba.

4. Who we entrust data to (processors)

  • Vercel Inc., USA: website hosting and audience measurement.
  • Resend Inc., USA: technical delivery of contact form messages to our mailbox. Resend keeps a delivery record and the message content for a short period set in our account.
  • Our e-mail provider, on whose servers we receive and store messages.

These providers process data only on our instructions, under data processing agreements (Article 28 GDPR). Because some of them are based in the USA, transfers outside Bosnia and Herzegovina and the European Economic Area rely on the European Commission's Standard Contractual Clauses included in those agreements. We do not sell personal data and do not share it for marketing purposes. We disclose data to public authorities only where the law requires it.

5. How long we keep data

  • Contact form enquiries and correspondence: for as long as the enquiry is being handled and at most 12 months after the last contact, after which they are deleted. If the enquiry leads to a contract, only the documents needed for that contract are kept, for the periods required by accounting and tax regulations.
  • Server logs: short-term, as described in section 2c.
  • Analytics: aggregate statistics only, with no personal data; the temporary hash for up to 24 hours.
  • Your measurement opt-out: on your device, until you change it or clear your browser data.

6. Automated decision-making

On this website we do not make decisions based solely on automated processing and we do not profile visitors.

7. GDPR: your rights and how to exercise them

Under the GDPR (Articles 15 to 22) and the law of Bosnia and Herzegovina, and subject to the conditions those laws set, you have the right to:

  • access: confirmation of whether we process your data, and a copy of that data;
  • rectification of inaccurate data and completion of incomplete data;
  • erasure ("right to be forgotten") when the data is no longer needed or you object to the processing and no overriding legitimate ground applies;
  • restriction of processing, for example while the accuracy of the data is being verified;
  • data portability: the data you gave us on the basis of a contract or consent, in a structured, machine-readable format;
  • object to processing based on legitimate interest (sections 2a to 2d);
  • withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.

Objecting to audience measurement: because the statistics are aggregate and we cannot link them to you afterwards, the effective way to object is to switch the measurement off on your device. From that moment nothing about your visits is sent.

Audience measurement on this device: …

All other requests: send them to info@neksus.ba. We reply without undue delay and at the latest within one month; for complex requests that period may be extended by a further two months, in which case we will inform you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests. To protect your data we may ask you to confirm your identity.

Complaints: you have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (www.azlp.ba). If you live in the EU or the European Economic Area, you may also contact the supervisory authority of your own country. We would appreciate the chance to resolve any concern with you directly first.

8. Data security

The connection to the website is encrypted (HTTPS/TLS). Access to data is limited to the people who need it for their work, our providers are bound by data processing agreements, and the contact form is protected against automated spam submissions.

9. Children

The website is intended for business users. We do not knowingly collect data from persons under 16; if we learn that we have received such data, we delete it.

10. Changes to this policy

A new version is published on this page with the date of the update. For material changes we will notify the users we are in contact with.

11. Contact

COMMIT d.o.o., Kralja Petra Karađorđevića 103, 78000 Banja Luka, Bosnia and Herzegovina. E-mail: info@neksus.ba. Phone: +387 65 302 988.

← Back to homeContact us