Who we are
This policy explains how Thunder (“Thunder”, “we”) handles personal data when you use Thunder’s delivery service in Sarajevo: the Thunder mobile app, the merchant dashboard, the merchant API, the parcel tracking page and this website.
We decide why and how this data is used, so we are its controller. We process it in line with the personal data protection law of Bosnia and Herzegovina, and we follow the practices of the EU General Data Protection Regulation (GDPR). Our contact details are at the end of this page.
Whose data this is about
- Merchants: shops and businesses that send parcels with Thunder, and the staff who use their account.
- Couriers, and people who apply to become one.
- Recipients: the merchants’ customers who receive parcels. They have no Thunder account; the merchant gives us their details so we can deliver.
- Visitors to this website and the tracking page.
What we collect
Merchants
- phone number, name and, if you set one, a password (stored only as a secure hash)
- business details: business name, legal form, ID number (JIB), PDV number and the email for invoices
- pickup branches with their address, map pin and contact phone
- the bank account for cash-on-delivery payouts
- orders, wallet top-ups (with the payment slip you upload), payouts, invoices, and the ratings you give couriers
Couriers and applicants
- name, phone number, JMBG, ID card or passport, driving licence, vehicle registration and plate number, and optionally vehicle insurance and a police clearance certificate, with photos of these documents
- a profile photo, the bank account for your pay, and whether you work as an employee or a freelancer
- your location while you are online (see “Courier location” below)
- deliveries, proof-of-delivery photos, cash collected and deposited (with receipts), earnings, payslips and ratings
Recipients
- name, phone number, delivery address, map pin and address notes, as the merchant gives them
- the parcel’s description, any cash-on-delivery amount, the delivery status and the proof-of-delivery photo
- the rating and comment, if you rate the delivery
Everyone who uses our apps: the device’s notification token, the app version and platform, and technical logs (such as IP address, time and errors) that keep the service working and secure. This website uses no advertising or analytics cookies; it only remembers your language choice in your browser.
Why we use it
- To deliver parcels: dispatching couriers, live tracking, delivery updates to recipients on Viber or by SMS, proof of delivery, failed attempts and returns. The legal basis is our contract with the merchant, and our legitimate interest in delivering the recipient’s parcel.
- To handle money: fees, cash on delivery, the wallet, payouts, invoices and courier pay. The legal bases are our contracts and the accounting and tax laws we must follow.
- To work with couriers: reviewing applications and documents, contracts and payroll. The legal bases are the steps before a contract, the contract itself and our obligations as an employer.
- To keep the service safe: sign-in codes, preventing fraud and misuse, security logs, and handling claims for lost or damaged parcels. The legal basis is our legitimate interest.
- To keep deliveries good: ratings and service quality. The legal basis is our legitimate interest.
We do not sell personal data and do not use it for advertising.
Courier location
The Thunder app shares a courier’s location only while the courier is online, also when the app is in the background, and stops completely when the courier goes offline.
We use it to offer deliveries nearby, to show merchants and recipients where their own parcel is, to estimate arrival times, and to answer questions about a delivery. The trail of location points is deleted after 30 days.
If you receive a parcel
The shop that sent your parcel gave us your name, phone number and address so we can deliver it. We send you delivery updates on Viber, or by SMS if Viber does not reach you, with a tracking link and, for cash on delivery, the amount and a delivery code.
The public tracking page shows only the parcel’s status, its progress and the municipality it is going to; it never shows your name, phone number or full address. Questions about the goods themselves are for the shop that sold them.
Where your data is kept
Our servers, database and files are in the European Union (Frankfurt, Germany). Some providers, such as Google and Apple, may process data in other countries; we use providers that protect it with recognised safeguards, such as the European Commission’s standard contractual clauses.
How long we keep it
- Account details: while the account is open. When it is closed we delete them, except what the law requires us to keep.
- Orders, invoices, payments, payouts and payroll: for as long as the accounting and tax laws of Bosnia and Herzegovina require.
- Courier location points: 30 days.
- Courier documents: while the courier works with Thunder, and afterwards only as long as the law requires.
- Courier applications that do not lead to work with Thunder: only as long as we need to decide on them. You can ask us to delete yours at any time.
Your rights
You can ask us:
- for a copy of the personal data we hold about you
- to correct data that is wrong or incomplete
- to delete your data, or to close your account (see the delete-account page)
- to restrict how we use your data, or to object to it
- for your data in a format you can take elsewhere
Contact us using the details below. We may ask you to confirm it is you, usually with a code sent to the phone number we have, and we answer within 30 days. You can also complain to the Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u BiH).
How we protect it
All connections are encrypted (HTTPS). Passwords are stored only as secure hashes and sign-in uses one-time codes. Courier documents and receipts are stored privately and opened only with short-lived links, and Thunder staff see only what their role needs, with their actions logged.
Children
Thunder’s apps are for businesses and for couriers aged 18 or over. We do not knowingly collect data from children through them.
Changes to this policy
When we change this policy we publish the new version on this page with its date, and tell merchants and couriers about important changes in the app before they apply.
How to reach us
Questions about this page or your personal data? Contact Thunder:
- Company
- Thunder
- Address
- 71000 Sarajevo, Bosna i Hercegovina
- info@thunder.co