University of Sarajevo

Privacy Policy

SLI Sustainability Learning and Impact | thesli.unsa.ba, thesli.org

This policy explains personal data processing connected with thesli.org, enquiries and programme applications, our newsletter and the delivery of education. Courses are paid, applications are submitted by email and payments are made to the University of Sarajevo bank account. User accounts and learning activities are provided on the separate Office for Sustainability’s educational platform. We use Zoom for online lectures and one-to-one training. Programmes are intended for adults.

1 Who is responsible for your data

The data controller is the University of Sarajevo, which delivers SLI activities through the Office for Climate Change and Sustainability, within the University of Sarajevo Centre for Research and Development.
Office contact address: Obala Kulina bana 7/II, 71000 Sarajevo, Bosnia and Herzegovina. General contact: contact@thesli.org.

2 Data we process and why

Enquiries and applications: we process your name, email address, message, selected programme and other information you provide, such as your organisation and invoicing details. We use these to respond, process applications, arrange education and communicate with participants. Steps taken at your request before a contract and performance of that contract are based on the contractual relationship.

Payments and administration: we process information needed for invoicing and payment verification, including payment details received through the University’s financial records. The bases are contract performance and legal obligations to maintain financial documentation. The thesli.unsa.ba website does not take card payments or request payment card details.

The Office for Sustainability’s educational platform: to deliver contracted education, we process account information and information about participation, assignments, assessments, progress and completion to the extent used by the relevant programme.

Online collaboration platform: for online lectures and one-to-one training, we process access details, display names, participation information, technical connection data and audio, video, messages and shared content that you enable or submit. Other participants may see your name and the content you share with them. Processing needed to deliver the education is based on contract performance.

Newsletter: we process your email address and, where provided, name, topic preferences and consent records to send updates. This is based on voluntary consent. Enrolling on a course does not itself subscribe you to the newsletter. You can unsubscribe using the link in a message or by contacting contact@thesli.org.

Website visits: hosting and security systems may process IP addresses, access times, requested pages, browser information and technical logs to operate and protect systems.

Required information is identified during enrolment. Without the information needed to identify a participant, communicate, invoice or provide educational access, we cannot process the application or provide the relevant service. Please do not send personal identification numbers, copies of identity documents or sensitive information unless specifically requested with an explanation of the need and legal basis.

3 Google Analytics and cookies

We use Google Analytics to understand website usage and improve the website. Depending on the settings, processing includes cookie identifiers, device and browser information, pages visited, interactions and approximate location. These data should not be treated as entirely anonymous.

We base analytics processing on your prior consent. You can reject analytics without losing access to basic content and change your choice. Withdrawing consent does not affect the lawfulness of earlier processing.

Cookies needed for a function you request are used only to the extent necessary.

4 Recording and automated decisions

Participants receive a specific notice before any recording. Enrolling on a course does not itself constitute consent to publish their image, voice or statements for promotional purposes.

5 Who can access the data

Authorised Office staff, relevant University departments, instructors and technical support may access data as needed for their duties. External providers may include hosting, email, newsletter, Google Analytics, Zoom and support for the Office for Sustainability’s educational platform. Where they process data on our behalf, we govern their work through appropriate agreements and instructions.

Banks process payment information in accordance with their obligations. Data are disclosed to competent authorities when legally required. If a programme requires disclosure to a certification or examination body, we inform you beforehand of the recipient, data, purpose and legal basis. A partnership does not itself mean that the partner receives all participant data.

6 Processing outside Bosnia and Herzegovina

External digital services may involve processing in other countries. Actual locations and legal mechanisms depend on the contracted services and their settings. Transfers are made only where the requirements of the applicable Bosnia and Herzegovina Law on Personal Data Protection are met.

7 How long we keep data

We retain data according to their purpose, legal obligations and documented retention periods, then delete or anonymise them. By category is:

• enquiries and applications not leading to enrolment.
• participant, course completion and certificate records.
• invoices and payment records: under applicable accounting and archiving obligations.
• accounts, assignments and logs on the Office for Sustainability’s educational platform.
• newsletter: until unsubscribe or cessation of that purpose; consent evidence and minimum suppression records.
• Analytical, technical logs, online collaboration data and any recordings.

Data needed for a specific dispute or legal obligation may be retained separately for longer, to the extent necessary. Backup deletion takes place within.

8 Your rights and contact

Subject to legal conditions, you may request access, correction, erasure, restriction and portability, and object to processing. You may withdraw consent at any time. Contact the Data Protection Officer or contact@thesli.org. Where necessary, we request only information needed to verify identity.

We respond without undue delay and within 30 days. Where the law permits an extension by a further 60 days, we explain the reasons within the initial 30 days. You may complain to the Personal Data Protection Agency in Bosnia and Herzegovina (azlp.ba), without first contacting us, or seek judicial protection.

9 Security and policy changes

We apply technical and organisational measures appropriate to the risks, including restricted data access. Please keep your login credentials secure and notify us of suspected misuse.

We publish updates on the website with their effective date. We notify affected users appropriately of material changes to processing. A new purpose requiring consent will not be based solely on publishing an updated policy.