Privacy Policy — nb intelligence

Summary for quick understanding: nb intelligence analyzes exclusively publicly available digital signals (media coverage, public comments, search trends). The platform NEVER tracks private profiles, does not create individual profiles of natural persons, does not share data between clients and does not access private messages. The processing of platform users' data is carried out transparently and in accordance with the GDPR.

1. Introduction and identity of the data controller

This Privacy Policy explains how MITA Group d.o.o. (hereinafter: "we", "us", "nb intelligence" or "the Platform") collects, uses, stores and protects personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the applicable legislation of Bosnia and Herzegovina.

Company name	MITA Group d.o.o.
Address	Bosnia and Herzegovina
Platform	nbiplatform.com
Contact e-mail	privacy@nbiplatform.com
DPO	dpo@nbiplatform.com
Date of last update	July 1, 2026

2. Who this Policy applies to

This Policy applies to:

Visitors to the nbiplatform.com website
Clients using the nb intelligence platform (legal entities and sole proprietors)
Contact persons on the client side (representatives of companies, agencies and institutions)
Individuals who request a demo or make any other contact through the website

3. What data we collect

3.1 Data you provide directly

First and last name of the contact person
Business e-mail
Name of the company / organization / institution
Phone number (optional)
Message or description of business needs (if provided)

3.2 Data we collect automatically

IP address (anonymized or pseudonymized)
Browser and operating system type
Pages you visited and the duration of the visit
Source of the visit (referrer URL)
Cookies — details in Section 9

3.3 Data the NBI Platform NEVER collects

Architectural privacy guarantee: nb intelligence analyzes exclusively aggregated, anonymized public digital signals. The platform never tracks the private profiles of natural persons, does not access private messages or closed groups, does not create individual profiles of natural persons, does not share one client's data with another client and does not collect sensitive categories of personal data.

4. Purpose of processing and legal basis

Purpose of processing	Legal basis (GDPR)	Retention period
Responding to an inquiry / scheduling a demo	Art. 6(1)(b) — Performance of a contract	Until the communication ends + 12 months
Providing platform services to clients	Art. 6(1)(b) — Performance of a contract	Duration of the contract + 5 years
Sending information about the service	Art. 6(1)(a) — Consent	Until consent is withdrawn
Invoicing and accounting	Art. 6(1)(c) — Legal obligation	5 years
Security and abuse prevention	Art. 6(1)(f) — Legitimate interest	90 days
Website analytics (anonymized)	Art. 6(1)(f) — Legitimate interest	Aggregated, no time limit

5. Data processing on behalf of clients (Data Processing Agreement)

When a client uses the nb intelligence platform, the client is the Data Controller and MITA Group is the Data Processor within the meaning of GDPR Art. 28.

The client determines the purpose and the methods of data processing
MITA Group processes the data exclusively on the client's instructions
MITA Group does not allow one client's data to be accessed by another client
Every client signs a Data Processing Agreement (DPA) together with the subscription contract

6. Data sharing and transfers

Recipient	Purpose and safeguards
Cloud hosting providers (EU servers)	Storage of platform data. SCC pursuant to GDPR Art. 46.
Email service providers	Sending transactional e-mails. They process the e-mail address only.
Payment processors	Processing of subscription payments. MITA Group does not store card data.
Accounting software	Invoicing. Only data required for accounting purposes.
Public authorities / courts	Solely on the basis of a legal obligation or a court order.

All data is processed and stored on servers within the EU/EEA. In the event of a transfer outside the EU/EEA, protection is ensured through Standard Contractual Clauses (SCC).

7. Your rights under the GDPR

Right	What it means
Right of access (Art. 15)	You may request a copy of all personal data we hold about you.
Right to rectification (Art. 16)	You may request the correction of inaccurate or incomplete data.
Right to erasure (Art. 17)	You may request the deletion of your data ("the right to be forgotten").
Right to restriction (Art. 18)	You may request a temporary restriction of processing.
Right to data portability (Art. 20)	You may request a copy of your data in a machine-readable format.
Right to object (Art. 21)	You may object to processing based on a legitimate interest.
Withdrawal of consent (Art. 7(3))	You may withdraw consent at any time without negative consequences.
Right to lodge a complaint (Art. 77)	You have the right to lodge a complaint with a data protection supervisory authority.

You can send your request to: privacy@nbiplatform.com. We will respond within 30 days.

8. Security and data retention

Encryption of data in transit (TLS 1.3) and at rest (AES-256)
Access to data limited to staff on a least-privilege basis
Regular security audits and penetration tests
Pseudonymization wherever possible
Disaster recovery procedures and a business continuity plan
Mandatory data protection training for employees

In the event of a security breach, MITA Group will notify the competent supervisory authority within 72 hours (GDPR Art. 33) and the affected data subjects without undue delay (GDPR Art. 34).

9. Cookies

Type	Purpose	Legal basis	Duration
Necessary (session)	Operation of the website	Legitimate interest	Session
Analytical (anonymized)	Understanding how the website is used	Legitimate interest	12 months
Preference	Remembering user choices	Consent	12 months
Marketing (optional)	Personalized messages	Consent	6 months

10. Protection of children

The nb intelligence platform is intended exclusively for professional business use. Our services are not intended for persons under 18 years of age.

11. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes by e-mail or through a notice on the website at least 30 days before they take effect.

12. Contact and complaints

General privacy inquiries	privacy@nbiplatform.com
Data Protection Officer	dpo@nbiplatform.com
Postal address	MITA Group d.o.o., Bosnia and Herzegovina
Website	nbiplatform.com

If you believe that MITA Group is processing your data improperly, you have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.gov.ba) or with the supervisory authority in your country of residence.