Draft — pending legal review
Version of 14 October 2026Which personal data ISEUS processes, for what purposes, who is responsible for it and how you can exercise your rights.
Pending legal review
This is a draft pending legal review. It describes how ISEUS actually works today, but it has not yet been reviewed by a lawyer and is not final. The final version will be published at this address with its effective date.
ISEUS is a cloud-based software platform (SaaS) developed and operated by Prominech Solutions, a business registered in Bosnia and Herzegovina.
Prominech Solutions (sole proprietorship), Kruščica bb, 72250 Vitez, Bosnia and Herzegovina. Identification number: 4338282760008.
info@prominech.com. Send questions, requests to exercise your rights and complaints to this address.
This policy covers the website iseus.co.ba, the web application app.iseus.co.ba and the student mobile app.
The role depends on who decides why the data is processed. For academic data that is not Prominech Solutions but the professor or institution using ISEUS.
A professor who runs a course independently is the controller of their students’ academic data. Prominech Solutions is the processor: it processes the data only on the professor’s instructions and only to provide the service.
When an institution uses Campus, the institution is the controller and Prominech Solutions the processor. Mutual rights and obligations are set out in the contract and a data processing agreement.
For user account, subscription and billing data, security logs and visits to this website, Prominech Solutions is the controller.
Students exercise their rights regarding academic data primarily with the professor or institution. If they contact us, we forward the request to the controller and help them respond.
[TODO lawyer: data processing agreement (DPA) template for professors and for Campus institutions.]
We process only the data needed to run teaching and the service.
Name, e-mail address, role (professor, assistant, student, administrator), institution and courses, student ID number if the professor enters it, password (stored only as a cryptographic hash) and a profile photo if you add one.
Course enrolments, attendance at lectures and exercises (including the time of QR scans), groups, activities and assignments, points, exam and partial exam registrations and results, signatures, final grades, course posts and the change history (who changed what and when).
Plan, billing period, amounts, invoices and payment status. You enter card details directly with the payment provider; ISEUS never sees or stores them.
IP address, device and browser type, sign-in times, technical logs and error reports, needed for security and correct operation.
Your theme choice and cookie decision in your browser and, only with your consent, analytics data. The contact form opens your own e-mail program, so we receive your message as an ordinary e-mail.
If you use the AI assistant “Ask ISEUS”: your questions and the assistant’s answers, linked to your account and course, and usage data without any conversation content (time, model, amount of processing) needed for the monthly question allowance.
ISEUS is not meant for special categories of data (such as health data). Please do not enter them in posts, comments or files.
Every processing activity has a clear purpose and a legal basis under the GDPR and the Law on Personal Data Protection of Bosnia and Herzegovina.
Creating and running accounts, courses, attendance, exams and grades, user support and service messages (invitations, password reset, subscription warnings).
The professor or institution is responsible for having a legal basis to enter student data, for example carrying out teaching or a legal duty to keep records.
Charging subscriptions, issuing invoices and keeping business records.
Protection against abuse and unauthorised access, fixing errors, backups and the change history.
Measuring visits to iseus.co.ba, only if analytics is enabled and only after you accept it.
Answering the questions a user chooses to ask the assistant and keeping track of the monthly question allowance. Using the AI assistant is optional; the rest of ISEUS works without it. [TODO lawyer: confirm the legal basis, especially for questions from students.]
We keep data as long as it is needed for the purpose it was collected for, or as long as the law requires.
While the account is active. An expired or cancelled subscription does not delete data. After an account is closed, we delete or anonymise personal data within [PERIOD — proposed: 90 days], except data we are required to keep.
A final grade is stored when the course is completed and is not changed afterwards; a correction is a separate, logged step. A course in which at least one student has received a final grade cannot be deleted, only archived (read-only). The retention period for academic records is set by the professor or institution as controller.
Erasure requests are handled by Prominech Solutions on written request and logged, not through a button in the app, so that records the controller must keep are not lost.
Invoices and business records are kept for the period required by accounting and tax rules [PERIOD — to be confirmed with the accountant].
Server error logs are rotated daily and kept for at most 30 days. Database backups are kept for [BACKUP RETENTION PERIOD].
A conversation is deleted automatically 90 days after its last message. Its owner can delete it earlier, at any time. Deleting a course also deletes the conversations in that course.
We list only services that are enabled today or planned, with their status clearly marked. We update this list before enabling a new service.
Google Cloud. The public website iseus.co.ba runs on Google Cloud Run in the region europe-west1 (St. Ghislain, Belgium, EU). The ISEUS app, its API and the database run on Google Cloud Run and Cloud SQL in the region europe-west3 (Frankfurt, Germany, EU). The AI assistant uses Google Cloud Vertex AI in the region europe-west1 (see below). [TODO lawyer: confirm the hosting description and regions.]
Resend (Resend, Inc., USA): delivery of the app’s transactional e-mails (invitations, password reset, notifications) from no-reply@iseus.co.ba. [TODO: transfer mechanism / DPA — lawyer.]
Storage of profile photos that users upload. The ISEUS database keeps only a reference to the file.
Once payments are enabled: Monri for card payments and PayPal. They process payment data as independent payment service providers; ISEUS does not store card details.
Error tracking on the server and in the app, if enabled. On the server, request bodies, cookies and e-mail addresses are removed before sending.
Only if analytics is enabled on iseus.co.ba and only with your consent. Not used in the app.
Processing of questions to the AI assistant “Ask ISEUS” with Google Gemini models, in the region europe-west1 (St. Ghislain, Belgium, EU), with codes instead of student names. Details are in the section “AI assistant”.
Pending legal review
The AI assistant answers questions about a course. It is included in the Professor plan (500 questions per month) and the Campus plan (2,500 questions per month); the Free plan only shows an example. Students can use it only in courses whose workspace has a paid plan, up to 20 messages per day, and they never pay for it.
Google Cloud Vertex AI, model Gemini 2.5 Flash (Gemini 2.5 Pro where needed), in the region europe-west1 (St. Ghislain, Belgium, EU). ISEUS authenticates with a service account of its own Google Cloud project, without shared API keys.
Only what the answer needs: your question and part of the conversation so far, the course name and academic year, aggregate course statistics from fixed queries and help-centre texts. When a student asks, only that student’s own data (attendance, points, exams, activities) and the course announcements are sent.
Before anything is sent, student names, index numbers and e-mail addresses are replaced by codes (such as S1, S2), both in the question you type and in announcements. Names are put back into the answer only on our server and only for teaching staff, for the students they are allowed to see. The assistant never gives a student the names of other students. A name typed incompletely (for example a first name alone) may not be recognised, so do not type data into questions that is not needed.
Under the Google Cloud terms, Google does not use data sent through Vertex AI to train its models. [TODO lawyer: confirm against the current Google Cloud terms, the Cloud Data Processing Addendum and the Vertex AI data governance rules, including abuse monitoring and caching.]
Conversations are stored on our servers in the EU (Google Cloud, Frankfurt, Germany). Only the owner of a conversation can see it. It is deleted automatically 90 days after its last message, and the owner can delete it at any time.
Questions and answers are not written to technical logs. For the monthly allowance we record only data without content: time, model and amount of processing.
The AI assistant only answers and writes drafts. It does not change grades, points, attendance or any other data and does not publish anything. Answers are generated automatically and may be wrong or incomplete, so check them before you rely on them.
If ISEUS offers connecting external storage (for example your own Google Drive), ISEUS may keep references to files (identifier, name and link), but not the files themselves. Disconnecting does not necessarily delete academic records that must be retained, such as attendance, points and final grades. Files in your external storage stay under your control.
Pending legal review
Some service providers may process data outside Bosnia and Herzegovina and the European Economic Area (for example in the USA). In that case we rely on transfers to countries with an adequate level of protection or on appropriate safeguards such as the European Commission’s standard contractual clauses. The AI assistant processes questions in the EU (Belgium), and we store conversations in the EU (Frankfurt). [TODO: region and transfer mechanism for each provider.]
We apply technical and organisational measures appropriate to the type of data.
Access by role and course: staff see only their own courses and students only their own results. Institution statistics are aggregated.
Passwords are stored only as hashes (bcrypt), sign-in uses short-lived tokens and the connection is always encrypted (HTTPS).
A change history on courses, protection of QR attendance against reuse, removal of personal data from technical logs and database backups.
Under the GDPR and the Law on Personal Data Protection of Bosnia and Herzegovina you have the right of access, rectification, erasure, restriction of processing, data portability, objection and to withdraw consent at any time. Send requests to info@prominech.com; we respond without undue delay and within 30 days at the latest.
ISEUS calculates points and a suggested grade using the rules the teacher sets, and the teacher finalises the grade. ISEUS does not make automated decisions about students, and neither does the AI assistant: it only answers questions and does not change data.
If you believe your rights have been infringed, please write to info@prominech.com first and we will try to resolve it. You may also lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina and, if you live in the EU, with the supervisory authority of your country.
This website uses only necessary browser storage, and analytics only with consent. The details are in the Cookie Policy.
Cookie PolicyWe will update this policy when the processing or the list of service providers changes. We notify users of material changes by e-mail or in the app before they take effect.
Students see only their own data, access is limited by role, and data is not deleted when a plan changes.
Write to us at info@prominech.com.
