# Bilko Privacy Notice — Section 8.1 Document Archive Sub-Processors

<div id="bkmrk-%E2%9A%A0%EF%B8%8F-statusmc%3A-%23100045" style="background-color: #FFF3CD; border-left: 4px solid #FFC107; padding: 16px; margin-bottom: 24px;">**⚠️ STATUS**  
**MC:** #100045 | **Date:** 2026-05-08  
**Draft Status:** Pending final legal review and translations (per Lexicon S1-S4)  
**Corrections Applied:** Org.nr 932 516 136 (corrected from hallucinated 933 534 262 + wrong DPO org.nr 932 953 736), Azure Sweden Central (corrected from Norway East)</div># Privacy Policy

> **Project:** Bilko — Balkan Accounting SaaS

> **Version:** 1.1

> **Last Updated:** 2026-03-02

> **Author:** ALAI Documentation Team

> **Status:** Final (Pending Legal Review)

> **Reviewers:** DPO, Legal Counsel (RS, BA, HR), CEO

> **Classification:** Public (upon legal sign-off)

---

## Table of Contents

- [Introduction and Data Controller](#1-introduction-and-data-controller)
- [Scope and Applicability](#2-scope-and-applicability)
- [Legal Framework](#3-legal-framework)
- [Data We Collect](#4-data-we-collect)
- [Legal Basis for Processing](#5-legal-basis-for-processing)
- [How We Use Your Data](#6-how-we-use-your-data)
- [Data Retention Periods](#7-data-retention-periods)
- [Data Sharing and Third-Party Processors](#8-data-sharing-and-third-party-processors)
- [Cross-Border Data Transfers](#9-cross-border-data-transfers)
- [Your Rights as a Data Subject](#10-your-rights-as-a-data-subject)
- [Security Measures](#11-security-measures)
- [Cookies and Tracking](#12-cookies-and-tracking)
- [Children's Privacy](#13-childrens-privacy)
- [Changes to This Policy](#14-changes-to-this-policy)
- [Contact and Data Protection Officer](#15-contact-and-data-protection-officer)
- [Jurisdiction-Specific Notices](#16-jurisdiction-specific-notices)

--- ## 1. Introduction and Data Controller

Bilko is a cloud-based accounting and invoicing platform for small and medium businesses (SMBs) operating in Serbia, Bosnia &amp; Herzegovina, and Croatia. Bilko is developed and operated by **Basic Consulting AS** (trading as ALAI), a company registered in Norway.

**Data Controller:**

<table border="1" id="bkmrk-fielddetails--------"><tr><td>Field</td><td>Details</td></tr><tr><td>------------</td><td>-----------------------------------------------------------------------------------------</td></tr><tr><td>Entity name</td><td>Basic Consulting AS (ALAI)</td></tr><tr><td>Registration</td><td>Pending — Norwegian company register number (to be confirmed upon legal entity formation)</td></tr><tr><td>Address</td><td>Pending — registered address to be confirmed upon legal entity formation</td></tr><tr><td>Email</td><td>privacy@bilko.io</td></tr><tr><td>Website</td><td>https://bilko.io</td></tr>> ⚠️ LEGAL REVIEW REQUIRED: Confirm whether Bilko must establish local legal entities in Serbia (Bilko d.o.o. RS), Bosnia &amp; Herzegovina (Bilko d.o.o. Sarajevo), and Croatia (Bilko d.o.o. Zagreb) as co-controllers or separate controllers for purposes of local data protection law compliance. ZZPL Serbia and ZZLP BiH may require a locally registered representative.

**Data Protection Officer (DPO):**

<tr><td>Field</td><td>Details</td></tr><tr><td>-----------</td><td>-------------------------------------------------------------------------</td></tr><tr><td>DPO name</td><td>Alem Bašić</td></tr><tr><td>DPO contact</td><td>alem@alai.no</td></tr><tr><td>Phone</td><td>+47 40 47 42 51</td></tr><tr><td>Company</td><td>ALAI Holding AS (org.nr 932 516 136)</td></tr><tr><td>Role</td><td>Responsible for data protection compliance across all three jurisdictions</td></tr><tr><td>Appointed</td><td>2026-03-02</td></tr>---

## 2. Scope and Applicability

This Privacy Policy applies to:

- All users of the Bilko platform accessible at **app.bilko.io**
- All organizations registered on Bilko, including their authorized users (owners, admins, accountants, viewers)
- All data processed by Bilko in connection with providing cloud accounting services in Serbia, Bosnia &amp; Herzegovina, and Croatia

This policy applies to **data subjects** in three categories: - **Business owners and employees** who register and use Bilko directly
- **Clients and contacts** whose data is entered into Bilko by our users (e.g., customers listed on invoices)
- **Website visitors** to bilko.io

--- ## 3. Legal Framework

Bilko processes personal data in compliance with the following data protection laws:

<tr><td>Jurisdiction</td><td>Applicable Law</td><td>Supervisory Authority</td></tr><tr><td>------------------------</td><td>--------------------------------------------------------------------------------------</td><td>------------------------------------------------------------------------</td></tr><tr><td>**Serbia**</td><td>Zakon o zaštiti podataka o ličnosti (ZZPL), Sl. glasnik RS 87/2018 — aligned with GDPR</td><td>Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti</td></tr><tr><td>**Bosnia &amp; Herzegovina**</td><td>Zakon o zaštiti ličnih podataka (ZZLP BiH), Sl. glasnik BiH 49/2006</td><td>Agencija za zaštitu ličnih podataka (AZLP)</td></tr><tr><td>**Croatia**</td><td>GDPR — Uredba (EU) 2016/679 (directly applicable as EU member state)</td><td>Agencija za zaštitu osobnih podataka (AZOP)</td></tr>Where GDPR principles are referenced in this policy, they apply directly to Croatian users and serve as the compliance standard for Serbian users (ZZPL is GDPR-aligned). For Bosnian users, equivalent provisions of ZZLP BiH apply.

---

## 4. Data We Collect

### 4.1 Account and Registration Data

When you register an organization on Bilko, we collect:

<tr><td>Data Element</td><td>Purpose</td><td>Classification</td></tr><tr><td>------------------------</td><td>-------------------------------------------------------</td><td>--------------</td></tr><tr><td>Email address</td><td>Account authentication, notifications</td><td>L2 Internal</td></tr><tr><td>Full name</td><td>User identification within organization</td><td>L2 Internal</td></tr><tr><td>Password (bcrypt-hashed)</td><td>Authentication — never stored in plaintext</td><td>L2 Internal</td></tr><tr><td>Organization name</td><td>Multi-tenant account setup</td><td>L2 Internal</td></tr><tr><td>Country of operation</td><td>Jurisdiction-specific compliance rules (VAT rates, CoA)</td><td>L2 Internal</td></tr><tr><td>Base currency</td><td>Financial calculations</td><td>L2 Internal</td></tr>### 4.2 Financial and Tax Data

When you use Bilko to create invoices, track expenses, and manage accounting:

<tr><td>Data Element</td><td>Jurisdiction</td><td>Classification</td><td>Encryption</td></tr><tr><td>--------------------------------------------------------------</td><td>------------</td><td>---------------</td><td>--------------------------------</td></tr><tr><td>PIB (Poreski identifikacioni broj — Serbia)</td><td>RS</td><td>L4-B Restricted</td><td>Disk-level AES-256</td></tr><tr><td>JMBG (Jedinstveni matični broj građana — Serbia/BiH)</td><td>RS, BA</td><td>L4-A Restricted</td><td>AES-256-GCM field-level</td></tr><tr><td>OIB (Osobni identifikacijski broj — Croatia)</td><td>HR</td><td>L4-A Restricted</td><td>AES-256-GCM field-level</td></tr><tr><td>JIB (Jedinstveni identifikacioni broj — BiH)</td><td>BA</td><td>L4-B Restricted</td><td>Disk-level AES-256</td></tr><tr><td>IBAN / Bank account numbers</td><td>All</td><td>L4-B Restricted</td><td>Disk-level AES-256 + API masking</td></tr><tr><td>Invoice amounts (subtotal, VAT, total)</td><td>All</td><td>L3 Confidential</td><td>AES-256 at rest</td></tr><tr><td>Transaction records (debit/credit entries)</td><td>All</td><td>L3 Confidential</td><td>AES-256 at rest</td></tr><tr><td>Expense records</td><td>All</td><td>L3 Confidential</td><td>AES-256 at rest</td></tr><tr><td>Contact details (clients/vendors: name, email, phone, address)</td><td>All</td><td>L2 Internal</td><td>TLS 1.3 in transit</td></tr>> **Note on JMBG processing:** The JMBG is a sensitive personal identifier unique to each Serbian and Bosnian citizen. Bilko only collects JMBG when a user explicitly confirms that an invoice is being issued to a natural person (not a legal entity). This is a voluntary user action gated by a UI confirmation checkbox.

### 4.3 Technical and Operational Data

<tr><td>Data Element</td><td>Retention</td><td>Purpose</td></tr><tr><td>--------------------------------------</td><td>--------------------------------------</td><td>------------------------------------</td></tr><tr><td>IP address</td><td>30 days</td><td>Security monitoring, fraud detection</td></tr><tr><td>Browser user-agent</td><td>30 days</td><td>Security monitoring</td></tr><tr><td>Session tokens (JWT, refresh tokens)</td><td>15 minutes (access) / 7 days (refresh)</td><td>Authentication</td></tr><tr><td>Audit log entries (LoggedAction table)</td><td>10–11 years</td><td>Legal compliance, accounting law</td></tr><tr><td>API request logs</td><td>30 days</td><td>Security and debugging</td></tr>### 4.4 Data Entered by Users About Third Parties

Bilko is an accounting tool. Our users enter data about their clients and vendors (third parties). This includes names, contact details, and tax identification numbers of those third parties. **Bilko acts as a data processor** for this third-party data — the organization using Bilko is the data controller for their clients' data and is responsible for ensuring they have an appropriate legal basis for entering that data into Bilko.

---

## 5. Legal Basis for Processing

<tr><td>Data Category</td><td>Legal Basis</td><td>GDPR Article</td><td>ZZPL Article</td><td>ZZLP BiH</td></tr><tr><td>----------------------------</td><td>----------------------------------------------------------------------</td><td>------------</td><td>-------------</td><td>------------</td></tr><tr><td>Account email, full name</td><td>Performance of contract</td><td>Art. 6(1)(b)</td><td>Art. 12(1)(b)</td><td>Art. 7(1)(b)</td></tr><tr><td>Organization details</td><td>Performance of contract</td><td>Art. 6(1)(b)</td><td>Art. 12(1)(b)</td><td>Art. 7(1)(b)</td></tr><tr><td>Tax IDs (PIB, JIB)</td><td>Legal obligation — accounting and tax law</td><td>Art. 6(1)(c)</td><td>Art. 12(1)(c)</td><td>Art. 7(1)(c)</td></tr><tr><td>JMBG, OIB</td><td>Legal obligation — accounting and tax law (only when legally required)</td><td>Art. 6(1)(c)</td><td>Art. 12(1)(c)</td><td>Art. 7(1)(c)</td></tr><tr><td>IBAN</td><td>Performance of contract (for payment processing)</td><td>Art. 6(1)(b)</td><td>Art. 12(1)(b)</td><td>Art. 7(1)(b)</td></tr><tr><td>Invoice and transaction data</td><td>Legal obligation — accounting/tax retention requirements</td><td>Art. 6(1)(c)</td><td>Art. 12(1)(c)</td><td>Art. 7(1)(c)</td></tr><tr><td>IP address, session logs</td><td>Legitimate interest — platform security</td><td>Art. 6(1)(f)</td><td>Art. 12(1)(f)</td><td>Art. 7(1)(f)</td></tr><tr><td>Audit trail (LoggedAction)</td><td>Legal obligation — accounting law requires immutable audit records</td><td>Art. 6(1)(c)</td><td>Art. 12(1)(c)</td><td>Art. 7(1)(c)</td></tr>> ⚠️ LEGAL REVIEW REQUIRED: Confirm the specific Serbian, Bosnian, and Croatian accounting and tax laws that constitute the "legal obligation" basis for each data category listed above. Reference: Zakon o računovodstvu RS (Sl. glasnik RS 73/2019), Zakon o PDV RS, Zakon o računovodstvu i reviziji FBiH, Zakon o porezu na dohodak FBiH, Zakon o računovodstvu HR (NN 78/15 et seq.).

---

## 6. How We Use Your Data

We use the data we collect exclusively to:

- **Provide the Bilko service** — create and manage invoices, expenses, transactions, financial reports
- **Ensure legal compliance** — submit e-invoices to SEF (Serbia) and HR-FISK (Croatia), maintain accounting records per mandatory retention periods
- **Secure the platform** — authenticate users, prevent unauthorized access, detect and investigate fraud and security incidents
- **Communicate with you** — send invoice notifications, payment reminders, service announcements, and support responses
- **Improve the service** — analyze usage patterns (in aggregated, anonymized form) to improve features

We do **not**: - Sell your data to third parties
- Use your financial data for advertising or profiling
- Process your data for any purpose beyond providing the accounting service and meeting legal obligations

--- ## 7. Data Retention Periods

Data retention is governed by accounting and tax laws in each jurisdiction. We are legally required to retain certain financial records even if you delete your account.

<tr><td>Data Category</td><td>Serbia (RS)</td><td>Bosnia &amp; Herzegovina (BA)</td><td>Croatia (HR)</td><td>Basis</td></tr><tr><td>-------------------------------------------</td><td>----------------------------------------</td><td>-----------------------------------</td><td>--------------------------</td><td>--------------------------------</td></tr><tr><td>Financial statements and accounting records</td><td>10 years</td><td>FBiH: 10 years; RS entity: 11 years</td><td>11 years</td><td>Zakon o računovodstvu (RS/BA/HR)</td></tr><tr><td>Invoice records</td><td>10 years</td><td>10–11 years</td><td>11 years</td><td>Accounting and VAT law</td></tr><tr><td>Expense records</td><td>10 years</td><td>10–11 years</td><td>11 years</td><td>Accounting law</td></tr><tr><td>Audit trail (LoggedAction)</td><td>10 years</td><td>10–11 years</td><td>11 years</td><td>Accounting law</td></tr><tr><td>VAT/PDV records</td><td>10 years</td><td>10–11 years</td><td>11 years</td><td>Tax law</td></tr><tr><td>User account data (name, email)</td><td>Account lifetime + 30 days after closure</td><td>Account lifetime + 30 days</td><td>Account lifetime + 30 days</td><td>Contract performance</td></tr><tr><td>IP addresses and session logs</td><td>30 days</td><td>30 days</td><td>30 days</td><td>Legitimate interest</td></tr><tr><td>JWT refresh tokens</td><td>7 days</td><td>7 days</td><td>7 days</td><td>Contract performance</td></tr>**Important — Right to Erasure Limitation:** Under accounting and tax law in all three jurisdictions, financial records (invoices, transactions, expense records) cannot be deleted during the mandatory retention period. If you close your Bilko account, your personal identifiers (name, email) can be anonymized in your user account record, but the underlying financial transaction data must be retained for the legally required period. See Section 10 for full details on data subject rights.

---

## 8. Data Sharing and Third-Party Processors

Bilko shares your data only with the following categories of third parties, all of whom are bound by Data Processing Agreements (DPAs):

<tr><td>Processor</td><td>Role</td><td>Data Shared</td><td>Location</td><td>Transfer Mechanism</td></tr><tr><td>----------------------</td><td>-------------------------------------------------------</td><td>--------------------------------------------------------------</td><td>-------------------------------</td><td>----------------------------------</td></tr><tr><td>Railway</td><td>Cloud infrastructure (PostgreSQL database, API hosting)</td><td>All Bilko data</td><td>EU West (Amsterdam / Frankfurt)</td><td>DPA — see Section 9</td></tr><tr><td>Cloudflare</td><td>CDN, WAF, DDoS protection</td><td>IP addresses, HTTP headers</td><td>USA (but data transits EU PoPs)</td><td>DPA + Standard Contractual Clauses</td></tr><tr><td>Sentry</td><td>Error tracking and monitoring</td><td>Error traces, stack traces (may contain PII in error messages)</td><td>USA</td><td>DPA + Standard Contractual Clauses</td></tr><tr><td>Email service provider</td><td>Transactional email (invoice delivery, notifications)</td><td>Email addresses, invoice PDFs</td><td>TBD</td><td>DPA</td></tr>> ⚠️ LEGAL REVIEW REQUIRED: Select and confirm the transactional email service provider. Confirm DPA is in place with all processors above before launch. Cloudflare and Sentry are US-based — confirm SCC adequacy is sufficient for ZZPL and ZZLP BiH purposes, not just GDPR.

### 8.1 Document Archive Sub-Processors

When you enable the **document archival feature** in Bilko, the following additional sub-processors are used:

<tr><td>Sub-Processor</td><td>Purpose</td><td>Data Categories</td><td>Location</td><td>Safeguards</td></tr><tr><td>-----------------------------------------------------------------------------</td><td>---------------------------------------------</td><td>---------------------------------------------------------------------------</td><td>------------------------------------</td><td>-----------------------------------</td></tr><tr><td>**Cloudflare R2** (Cloudflare, Inc., USA)</td><td>Temporary staging for archive pipeline</td><td>Contract PDFs, invoices, care plans, incident reports, onboarding documents</td><td>EU region (eu-west bucket)</td><td>Standard Contractual Clauses (SCCs)</td></tr><tr><td>**ALAI Azure VM Paperless-ngx** (ALAI Holding AS, org.nr 932 516 136, Norway)</td><td>Long-term document archive at archive.alai.no</td><td>Same categories as above</td><td>EU/EEA (Microsoft Azure Sweden Central)</td><td>ALAI DPA + Azure SCCs</td></tr>**How document archival works:**

- **Upload:** When you mark a document for archival in Bilko (contracts, invoices, care plans, incident reports, onboarding documents), Bilko's backend writes the document to a Cloudflare R2 staging bucket in the EU region.

- **Transfer:** Every 5 minutes, a Cloud Run worker retrieves documents from R2 and uploads them to Paperless-ngx, a document management system hosted on ALAI's Azure VM (archive.alai.no) located in the Azure Sweden Central region (EU/EEA).

- **Retention:** Documents are retained in the archive according to the following schedule:

 - **Financial documents** (invoices, contracts): **7 years** (Serbian Zakon o računovodstvu, BiH accounting law, Croatian Zakon o računovodstvu) - **Care-related documents** (care plans, incident reports): **25 years** (UK NHS retention standard; pending Balkan legal review for care organizations) - **Deletion:** Documents are automatically deleted from Cloudflare R2 after successful upload to Paperless-ngx (typically within 5 minutes). Documents remain in Paperless-ngx for the retention period specified above.

**Your rights regarding sub-processors (GDPR Art. 28(4)):**- You will receive **30 days' advance notice** by email before Bilko adds or replaces any sub-processor.
- You have the right to **object** to a new sub-processor within the notice period.
- If you object and Bilko cannot offer an alternative, you may terminate your subscription without penalty.
- Contact **dpa@alai.no** to exercise this right.
- This disclosure complies with GDPR Article 28(4), Serbian ZZPL Art. 31(4), and BiH ZZLP equivalent provisions.

**Government Authorities:**When legally required, Bilko transmits e-invoice data to:

- **SEF portal** (efaktura.mfin.gov.rs) — Serbian Ministry of Finance — for RS users' B2B e-invoices
- **HR-FISK/FINA** — Croatian government e-invoicing authority — for HR users' B2B e-invoices (Phase 2)
- Tax and regulatory authorities in response to lawful requests

--- ## 9. Cross-Border Data Transfers

Bilko hosts all data on Railway's EU West infrastructure (Amsterdam/Frankfurt). Data transfer mechanisms per jurisdiction:

<tr><td>From</td><td>To</td><td>Mechanism</td></tr><tr><td>-------------------------</td><td>---------------</td><td>------------------------------------------------------------------------------------------------------------</td></tr><tr><td>Croatia (HR)</td><td>Railway EU West</td><td>No transfer mechanism needed — EU to EU transfer</td></tr><tr><td>Serbia (RS)</td><td>Railway EU West</td><td>Serbia is on the European Commission's adequacy list (Decision 2023/1485) — no additional mechanism required</td></tr><tr><td>Bosnia &amp; Herzegovina (BA)</td><td>Railway EU West</td><td>Standard Contractual Clauses (SCC 2021/914/EU) — BiH has no EU adequacy decision</td></tr>For Cloudflare and Sentry (US-based processors): Standard Contractual Clauses (SCC) apply, combined with a Transfer Impact Assessment.

> ⚠️ LEGAL REVIEW REQUIRED: Confirm that Serbia's adequacy decision (2023/1485) is still current and applies to the data categories Bilko processes. Prepare and sign SCCs with Railway for BiH user data before accepting Bosnian users. Conduct Transfer Impact Assessment for Cloudflare and Sentry.

---

## 10. Your Rights as a Data Subject

Depending on your jurisdiction, you have the following rights regarding your personal data:

### 10.1 Rights Table

<tr><td>Right</td><td>GDPR (Croatia)</td><td>ZZPL (Serbia)</td><td>ZZLP BiH</td><td>How to Exercise</td></tr><tr><td>-----------------------------------------------------------------------</td><td>--------------</td><td>-------------</td><td>---------------------</td><td>-------------------------------------------------------------------</td></tr><tr><td>**Right of access** — obtain a copy of your data</td><td>Art. 15</td><td>Art. 26</td><td>Art. 16</td><td>Export via `/api/gdpr/export` (planned) or email privacy@bilko.io</td></tr><tr><td>**Right to rectification** — correct inaccurate data</td><td>Art. 16</td><td>Art. 27</td><td>Art. 17</td><td>Edit directly in Bilko settings, or email privacy@bilko.io</td></tr><tr><td>**Right to erasure** — "right to be forgotten"</td><td>Art. 17</td><td>Art. 28</td><td>Art. 18</td><td>Email privacy@bilko.io — **subject to retention limitations below**</td></tr><tr><td>**Right to data portability** — export in machine-readable format</td><td>Art. 20</td><td>Art. 30</td><td>N/A (not in ZZLP BiH)</td><td>JSON/CSV export via Bilko (planned)</td></tr><tr><td>**Right to restriction** — limit processing</td><td>Art. 18</td><td>Art. 29</td><td>Art. 20</td><td>Email privacy@bilko.io</td></tr><tr><td>**Right to object** — object to processing based on legitimate interest</td><td>Art. 21</td><td>Art. 31</td><td>Art. 21</td><td>Email privacy@bilko.io</td></tr><tr><td>**Right not to be subject to automated decisions**</td><td>Art. 22</td><td>Art. 38</td><td>Art. 24</td><td>Bilko does not make automated decisions with legal effect</td></tr>### 10.2 Erasure Limitation (Financial Data)

The right to erasure does not apply to financial records that we are legally required to retain:

- In **Serbia**: Accounting records must be kept for **10 years** (Zakon o računovodstvu Art. 26)
- In **Bosnia &amp; Herzegovina**: Records must be kept for **10–11 years** depending on entity
- In **Croatia**: Records must be kept for **11 years** (Zakon o računovodstvu Art. 10)

If you request erasure: your personal account information (name, email, password) can be deleted or anonymized, but underlying financial transaction records (invoices, expenses, journal entries) will be retained for the legally required period in anonymized or minimal form. ### 10.3 Response Times

We will respond to data subject rights requests within:

- **30 days** (standard) — may be extended by 2 additional months for complex requests with notification

### 10.4 Right to Complain

You have the right to lodge a complaint with your supervisory authority:

<tr><td>Jurisdiction</td><td>Authority</td><td>Website</td></tr><tr><td>--------------------</td><td>------------------------</td><td>------------</td></tr><tr><td>Serbia</td><td>Poverenik za informacije</td><td>poverenik.rs</td></tr><tr><td>Bosnia &amp; Herzegovina</td><td>AZLP</td><td>azlp.gov.ba</td></tr><tr><td>Croatia</td><td>AZOP</td><td>azop.hr</td></tr>---

## 11. Security Measures

Bilko implements the following technical and organizational security measures to protect your data:

<tr><td>Measure</td><td>Description</td></tr><tr><td>-------------------------</td><td>-------------------------------------------------------------------------------------------------------------</td></tr><tr><td>Encryption in transit</td><td>TLS 1.3 (minimum TLS 1.2) for all connections via Cloudflare</td></tr><tr><td>Encryption at rest</td><td>AES-256 disk-level encryption on all Railway infrastructure</td></tr><tr><td>Field-level encryption</td><td>AES-256-GCM for JMBG (Serbia/BiH) and OIB (Croatia) — most sensitive personal identifiers</td></tr><tr><td>IBAN masking</td><td>Only last 4 digits shown in list views; full IBAN accessible only to authorized users</td></tr><tr><td>Password security</td><td>bcrypt with cost factor 12; breached password check via HaveIBeenPwned API</td></tr><tr><td>Authentication tokens</td><td>JWT RS256, 15-minute access token lifetime, 7-day refresh with rotation</td></tr><tr><td>Multi-tenancy isolation</td><td>Every database query is scoped to your organization — cross-tenant access is technically impossible by design</td></tr><tr><td>Role-based access control</td><td>4 roles (owner, admin, accountant, viewer) — users see only what their role permits</td></tr><tr><td>Rate limiting</td><td>5 failed authentication attempts per 15 minutes triggers lockout</td></tr><tr><td>Immutable audit log</td><td>All data modifications are recorded in an append-only audit trail</td></tr><tr><td>Breach notification</td><td>72-hour notification to supervisory authorities in the event of a personal data breach</td></tr>---

## 12. Cookies and Tracking

Bilko uses minimal cookies necessary to provide the service:

<tr><td>Cookie</td><td>Purpose</td><td>Duration</td></tr><tr><td>---------------</td><td>-----------------------------------------------------</td><td>--------</td></tr><tr><td>`bilko_session`</td><td>Stores encrypted session reference for authentication</td><td>Session</td></tr><tr><td>`bilko_refresh`</td><td>HTTP-only refresh token for session renewal</td><td>7 days</td></tr>> ⚠️ LEGAL REVIEW REQUIRED: Confirm cookie consent requirements under Croatian GDPR (ePrivacy Directive applies in Croatia as EU member state). Serbia and BiH may have different requirements. Determine if a cookie consent banner is required.

We do not use third-party advertising cookies or tracking pixels.

---

## 13. Children's Privacy

Bilko is a business accounting platform intended for use by business owners and accounting professionals. We do not knowingly collect data from children under 16 years of age. If you believe a child has registered on Bilko, please contact privacy@bilko.io.

---

## 14. Changes to This Policy

We may update this Privacy Policy to reflect changes to our data practices or legal requirements. We will notify you of material changes by:

- Email to your registered account email address (at least 30 days before the change takes effect)
- Prominent notice on the Bilko platform

The date of the most recent revision is shown at the top of this document. ---

## 15. Contact and Data Protection Officer

For any privacy-related questions, requests, or complaints:

**Privacy inquiries:** privacy@bilko.io **Data Protection Officer:** Alem Bašić — alem@alai.no — +47 40 47 42 51 **DPO company:** ALAI Holding AS (org.nr 932 516 136) **Postal address:** Pending — to be confirmed upon company formation (see legal review note in Section 1)

> ⚠️ LEGAL REVIEW REQUIRED: Confirm postal address for privacy contact in each jurisdiction. Consider whether a local representative must be designated in Serbia and BiH under their data protection laws.

---

## 16. Jurisdiction-Specific Notices

### 16.1 Serbia — Notice under ZZPL

This section applies specifically to users in the Republic of Serbia.

Bilko processes personal data in accordance with the **Zakon o zaštiti podataka o ličnosti** (Sl. glasnik RS 87/2018 — "ZZPL"). Your rights under ZZPL Articles 26–38 are described in Section 10 of this policy.

The supervisory authority for data protection in Serbia is the **Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti** (poverenik.rs).

Tax identification data (PIB) is processed pursuant to the **Zakon o poreskom postupku i poreskoj administraciji** and **Zakon o PDV**. Accounting records are retained pursuant to **Zakon o računovodstvu** (Sl. glasnik RS 73/2019) — minimum 10 years.

E-invoice data is submitted to the **SEF portal** (efaktura.mfin.gov.rs) pursuant to the **Zakon o elektronskom fakturisanju** (Sl. glasnik RS 44/2021). This transmission constitutes a legal obligation — no separate consent is required.

### 16.2 Bosnia &amp; Herzegovina — Obavještenje prema ZZLP BiH

This section applies specifically to users in Bosnia &amp; Herzegovina.

Bilko processes personal data in accordance with the **Zakon o zaštiti ličnih podataka** (Sl. glasnik BiH 49/2006 — "ZZLP BiH"). The supervisory authority is the **Agencija za zaštitu ličnih podataka (AZLP)** (azlp.gov.ba).

BiH has no EU adequacy decision. Data transferred to Railway (EU West) is protected by Standard Contractual Clauses (SCC 2021/914/EU).

Accounting records are retained pursuant to: FBiH — **Zakon o računovodstvu i reviziji FBiH** (minimum 10 years); RS entity — **Zakon o računovodstvu i reviziji RS BiH** (minimum 11 years). The correct retention period depends on the entity jurisdiction selected during organization registration.

> ⚠️ LEGAL REVIEW REQUIRED: Confirm that the ZZLP BiH (2006 law) is still the governing framework or if amendments/successor legislation applies. Confirm AZLP registration requirements for Bilko as a data controller operating from outside BiH.

### 16.3 Croatia — Napomena prema GDPR-u

This section applies specifically to users in the Republic of Croatia.

As an EU member state, Croatia is subject to the **GDPR (Uredba (EU) 2016/679)** directly. The supervisory authority is the **Agencija za zaštitu osobnih podataka (AZOP)** (azop.hr).

Accounting records are retained pursuant to the **Zakon o računovodstvu** (NN 78/15, 116/18, 42/20, 47/20, 114/22) and **Opći porezni zakon** — minimum 11 years.

E-invoice data (when HR-FISK integration is active) is transmitted to **FINA** pursuant to the **Zakon o elektroničkom izdavanju računa u javnoj nabavi** and related legislation. This constitutes a legal obligation.

---

## Approval

<tr><td>Role</td><td>Name</td><td>Signature</td><td>Date</td></tr><tr><td>----------------</td><td>-----------------------</td><td>---------</td><td>----------</td></tr><tr><td>Author</td><td>ALAI Documentation Team</td><td>2026-02-25</td></tr><tr><td>DPO Review</td></tr><tr><td>RS Legal Counsel</td></tr><tr><td>BA Legal Counsel</td></tr><tr><td>HR Legal Counsel</td></tr><tr><td>CEO Approval</td><td>Alem Bašić</td></tr></table>