1. Who is responsible for the processing
Cealius (a natural person) is responsible for the processing of data. The provider’s full name and address are stated in the order confirmation that the customer receives before the service is activated, and on request we also send them by email before ordering.
Email: hellocealius.com
We process personal data in accordance with the Law on the Protection of Personal Data in Bosnia and Herzegovina and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Visiting the website
Every time our server is accessed, the following is recorded automatically: IP address, date and time, requested URL, HTTP status, amount of data transferred, referring page (if sent) and browser information (user agent). This data is technically necessary to display the site, for stable and secure operation and for detecting abuse (our legitimate interest). The records are kept for 14 days and then deleted.
3. Cookies and analytics
On the public website we do not use optional cookies, advertising identifiers or cross-site tracking. We use our own first-party, cookieless analytics to measure visits and improve the website. We record the page path, traffic source/referrer domain, campaign UTM tags, country derived from the technical request, a coarse device and browser category, and events such as opening the order flow or completing an order. We do not store the raw IP address in analytics records. To estimate unique visitors we use only a daily cryptographic hash that changes every day and is not used for long-term profiling. Analytics events are retained for no more than 90 days.
Authenticated areas such as the Client Portal, Operations and cPanel/WHM may use technically necessary session and security cookies for login, session protection and abuse prevention. During card payments Stripe may use its own technically necessary security mechanisms and cookies. We do not use these data for Cealius advertising or advertising profiles.
4. Contact form and email
If you send us an inquiry through the contact form, we process the data you enter: name, email address, topic and message, as well as your consent. To protect against abuse we additionally store a shortened cryptographic value (hash) of the IP address and browser information; the raw IP address is not stored with the inquiry. We use the data solely to reply to your inquiry. The basis for processing is your consent and, for inquiries about concluding a contract, measures before concluding a contract and performance of a contract. You can withdraw your consent at any time.
We delete inquiries no later than 12 months after the last communication, unless a contractual relationship arises (in which case section 5 applies). The same rules apply if you write to us by email.
5. Ordering hosting
When you place an order we process: your name, company name, company ID (JIB) and VAT number (if you provide them), email address, phone (optional), address and country, domain, the chosen plan and payment method, and the time you accepted the terms. The purpose of processing is concluding and performing the contract, recording payments and complying with legal obligations. We keep the data in accordance with the regulations on retaining payment documentation and business records. To perform the contract, the data is entered into our control panel in order to create your hosting account. We send the order confirmation and notices about it by email, through our own mail server.
6. Card payment
Card payments and annual subscriptions are processed by Stripe Payments Europe, Ltd. You enter card details directly on Stripe’s page; we neither see nor store them. To link orders, subscriptions and renewals we store Stripe customer, subscription, Checkout Session and invoice identifiers and payment status. Stripe processes data in accordance with its own privacy policy (stripe.com/privacy).
7. Payment by bank transfer
When you pay by transfer to a transaction account, we process the payment data (amount, reference, name of the payer) for the purpose of recording the payment and assigning it to an order.
8. Recipients of data
We do not sell your data. We pass it on only when necessary to perform the contract, when there is a legal obligation or when you have given your consent.
9. Security
The transfer of data between your browser and our pages is protected by TLS encryption. The data is stored on a server under our control with restricted access.
10. Your rights
You have the right of access to your data, rectification, erasure, restriction of processing, data portability and the right to object to processing, to the extent the law grants you these rights. To exercise your rights, contact us at hellocealius.com. You also have the right to lodge a complaint with the supervisory authority: Personal Data Protection Agency in Bosnia and Herzegovina (azlp.ba).
11. Automated decision-making
We do not use automated decision-making or profiling.
12. Changes
We update this policy when changes to our services or regulations require it. The current version is always published on this page.