- Data controller: Baker Tilly Re Opinion Ltd. Sarajevo
- Address: Bulevar Meše Selimovića 81a, 71000 Sarajevo, Bosnia and Herzegovina
- Contact: info@bakertilly.ba, +387 33 525 226
We process personal data in line with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH, No. 12/25) and, where it applies, the EU General Data Protection Regulation (GDPR).
Data you send us
When you email or call us, we use your name, contact details, company and what you tell us to answer your enquiry and, if you become our client, to prepare and provide our services. We do this at your request before entering into a contract, or in our legitimate interest in answering business enquiries.
Audit proposal requests
On the home page and the audit service page you can check whether your company needs a statutory audit. The figures you enter for the check stay in your browser; we do not receive them. If you then request a proposal, we receive the company name, your name and email address, your phone number if you give it, the figures from the check, your notes and the address of the page you sent it from. We use them to prepare a proposal and reply to you. We do this at your request before entering into a contract. The request reaches us by email through Microsoft 365, where our mailboxes are hosted. Unless you untick the confirmation box in the form, we also send a confirmation with your answers in the check and the result to your email address (as a rule, no more than once a day to the same address). We keep requests that do not lead to an engagement for up to 12 months and then delete them.
Before the request is sent, Cloudflare Turnstile checks that it comes from a person and not from a bot. Turnstile loads only when you click “Request a proposal”. For this, Cloudflare processes technical data, such as your IP address and information about your browser and device.
Clients
We process the personal data we receive while providing audit, accounting, tax, VAT representation and advisory services on the basis of our engagement agreement and the laws that apply to our profession (for example on accounting and audit, taxation and the prevention of money laundering). The details are set out in the engagement agreement.
Job applications
If you send us your CV or an application, we use it only to assess your application and keep it for as long as the selection takes, unless you agree that we keep it for future openings.
Visiting the website
The website is delivered by Cloudflare. When you open a page, Cloudflare processes technical data, such as your IP address, your browser type and the page requested, to deliver the page and to protect the website from attacks.
Analytics and cookies
- Cloudflare Web Analytics counts visits without cookies and without tracking individual visitors. It runs for everyone.
- Google Analytics 4 is used only if you accept it in the cookie notice. Google then sets analytics cookies (such as
_ga) that show us which pages are useful. Advertising features are switched off. - Your choice is remembered in your browser (
localStorage), so we do not ask on every visit.
You can change your choice at any time via at the bottom of every page. If you decline, no analytics cookies are set and existing ones are removed.
Who receives data
We do not sell personal data. It is available to our staff who need it for their work, and to service providers who work for us under an agreement (hosting, email and IT support, for example Cloudflare and Microsoft), only for that purpose. With a client’s consent, or when an engagement requires it, we share data with other Baker Tilly member firms. We disclose data to public authorities only when the law requires it.
Transfers outside Bosnia and Herzegovina
Some service providers, such as Cloudflare, Google and Microsoft, may process data outside Bosnia and Herzegovina, including in the European Union and the United States. In that case we rely on the safeguards the law provides for, such as standard contractual clauses.
How long we keep data
We keep personal data only as long as the purpose for which it was collected requires, or as long as the law requires (for example accounting and audit records, or records on the prevention of money laundering), and then delete or anonymise it.
Your rights
You can ask to see your data, to have it corrected or deleted, to restrict its processing or to receive it in a portable format. You can object to its processing and withdraw your consent at any time. Send your request to info@bakertilly.ba. You can also lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina (azlp.ba).
Changes
We update this policy when the way we process data or the way the website works changes. Last updated: 14 October 2026.