Privacy Policy

This Privacy Policy defines the rules for processing personal data obtained through the monteforest.com online store (hereinafter referred to as the “Online Store”).

The owner of the Online Store and at the same time the data administrator is MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office at UL. Prusy 12B, 05-300 Prusy, POLAND, entered into the National Court Register under no. , NIP 5273042589, REGON 0001019094, hereinafter referred to as MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ.

Personal data collected by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), also referred to as GDPR.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ exercises particular diligence to respect the privacy of Customers visiting the Online Store.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ collects information regarding natural persons performing a legal act not directly related to their activity, natural persons conducting business or professional activity on their own behalf, and natural persons representing legal persons or organizational units that are not legal persons, to which the law grants legal capacity, hereinafter collectively referred to as Customers.

Customers’ personal data are collected in the case of:

• registration of an account in the Online Store, for the purpose of creating an individual account and managing this account. Legal basis: necessity to perform the contract for the Account service (Article 6(1)(b) GDPR);
• placing an order in the Online Store, for the purpose of performing the sales contract. Legal basis: necessity to perform the sales contract (Article 6(1)(b) GDPR);
• subscription to the newsletter, for the purpose of performing the contract whose subject is a service provided electronically. Legal basis – consent of the data subject to perform the contract for the Newsletter service (Article 6(1)(a) GDPR);
• using the contact form service in the Online Store for the purpose of performing the contract provided electronically. Legal basis: necessity to perform the contract for the contact form service (Article 6(1)(b) GDPR);
• using the post a review service for the purpose of performing the contract whose subject is a service provided electronically. Legal basis – necessity to perform the contract for the post a review service (Article 6(1)(b) GDPR).

When registering an account in the Online Store, the Customer provides:

• email address;
• first and last name.

When registering an account in the Online Store, the Customer independently sets an individual password to access their account. The Customer may change the password later, under the rules described in §5.

When placing an order in the Online Store, the Customer provides the following data:

• email address;
• address details:
  • postal code and city;
  • country (state);
  • street with house/apartment number.
• first and last name;
• phone number.

In the case of Entrepreneurs, the above scope of data is additionally extended by:

• the Entrepreneur’s company name;
• NIP (tax identification number).

When using the Newsletter service, the Customer provides the following data:

• email address;
• first and last name.

When using the contact form service, the Customer provides the following data:

• email address;
• first name;
• phone number.

When using the post a review service, the Customer provides the following data:

• email address;
• first and last name.

When using the Online Store Website, additional information may be collected, in particular: the IP address assigned to the Customer’s computer or the external IP address of the Internet provider, domain name, browser type, access time, type of operating system.

Navigation data may also be collected from Customers, including information about links and references they decide to click on or other activities undertaken in the Online Store. Legal basis – legitimate interest (Article 6(1)(f) GDPR), consisting in facilitating the use of services provided electronically and improving the functionality of these services.

For the purpose of establishing, pursuing, and enforcing claims, some personal data provided by the Customer as part of using functionalities in the Online Store may be processed such as: first name, last name, data regarding the use of services, if the claims arise from the manner in which the Customer uses the services, other data necessary to prove the existence of a claim, including the extent of damage suffered. Legal basis – legitimate interest (Article 6(1)(f) GDPR), consisting in establishing, pursuing, and enforcing claims and defending against claims in proceedings before courts and other state authorities.

The provision of personal data to MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ is voluntary, in connection with the concluded sales contracts or with the provision of services via the Online Store Website, with the reservation that failure to provide the data specified in the forms in the Registration process prevents Registration and setting up a Customer Account, and in the case of placing an order without Registration of a Customer Account will prevent the placement and execution of the Customer’s order.

The Customer’s personal data are transferred to service providers used by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ in running the Online Store. Service providers to whom personal data are transferred, depending on contractual arrangements and circumstances, are either subject to MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ’s instructions regarding the purposes and means of processing such data (processors) or independently determine the purposes and means of their processing (controllers).

Processors. MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ uses providers who process personal data solely on the instructions of MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ. These include, among others, providers offering hosting services, accounting services, providers of marketing systems, systems for analyzing traffic in the Online Store, systems for analyzing the effectiveness of marketing campaigns;

Controllers. MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ uses providers who do not act solely on instruction and themselves determine the purposes and means of using Customers’ personal data. They provide electronic payment and banking services.

Location. Service providers are based in Poland and in other countries of the European Economic Area (EEA).

Customers’ personal data are stored:

• Where the legal basis for processing personal data is consent, then the Customer’s personal data are processed by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ until the consent is withdrawn, and after withdrawal of consent for a period corresponding to the limitation period of claims that may be raised by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ and that may be raised against it. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic performance and claims related to conducting business activity – three years.
• Where the basis for processing data is the performance of a contract, then the Customer’s personal data are processed by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ for as long as is necessary to perform the contract, and thereafter for a period corresponding to the limitation period of claims. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic performance and claims related to conducting business activity – three years.

In the case of a purchase in the Online Store, personal data may be transferred, depending on the Customer’s choice, to the following entities for the purpose of delivering the ordered goods:

• a courier company;
• InPost Paczkomaty Sp. z o.o. based in Kraków, providing delivery services and operating a parcel locker system (Paczkomaty);
• Poczta Polska S.A. based in Warsaw.

If the Customer chooses payment via the autopay.pl system, their personal data are transferred to the extent necessary to process the payment to Autopay S.A. with its registered office in Sopot at ul. Powstańców Warszawy 6, postal code 81-718. The company was registered at the District Court Gdańsk–Północ, 8th Commercial Division of the National Court Register under no. 0000320590, NIP 585-13-51-185, REGON 191781561.

Navigation data may be used to provide better service to Customers, statistical data analysis, and adapting the Online Store to Customers’ preferences, as well as administering the Online Store.

If the Customer subscribes to the newsletter, MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ will send electronic messages containing commercial information about promotions and new products available in the Online Store to their email address.

In the event of a request, MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ provides personal data to authorized state authorities, in particular organizational units of the Prosecutor’s Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection, or the President of the Office of Electronic Communications.

The Online Store uses small files called cookies. They are saved by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ on the end device of the person visiting the Online Store, if the web browser allows it. A cookie file usually contains the domain name from which it originates, its “expiry time,” and an individual randomly selected number identifying this file. The information collected using such files helps to tailor the products offered by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ to the individual preferences and actual needs of persons visiting the Online Store. They also make it possible to develop general statistics on visits to the products presented in the Online Store.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ uses two types of cookies:

• Session cookies: after ending a given browser session or turning off the computer, the saved information is deleted from the device’s memory. The session cookies mechanism does not allow the collection of any personal data or any confidential information from Customers’ computers.
• Persistent cookies: they are stored in the Customer’s end device memory and remain there until deleted or expired. The persistent cookies mechanism does not allow the collection of any personal data or any confidential information from Customers’ computers.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ uses first-party cookies for the purpose of:

• authenticating the Customer in the Online Store and ensuring the Customer’s session in the Online Store (after logging in), thanks to which the Customer does not have to re-enter the login and password on each subpage of the Online Store;
• analysis and research and audience audit, and in particular to create anonymous statistics that help understand how Customers use the Online Store Website, which allows improving its structure and content.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ uses external cookies for the purpose of:

• promoting the Online Store via the Instagram service (administrator of the external cookie: Instagram LLC based in the USA);
• promoting the Online Store via the social network facebook.com (administrator of the external cookie: Meta Platforms Ireland Limited based in Ireland);
• presenting, on the informational pages of the Store, a map indicating the location of the office of MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ via the online service maps.google.com (administrator of the external cookie: Google Inc based in the USA);
• presenting multimedia content on the Website pages, which are downloaded from the external website www.youtube.com (administrator of the external cookie: Google Inc based in the USA);
• presenting advertisements tailored to the Client’s preferences using the Google Ads online advertising tool (administrator of the external cookie: Google Ireland Limited based in Ireland);
• authenticating the Customer in the Online Store and ensuring the Customer’s session in the Online Store (after logging in), thanks to which the Customer does not have to re-enter the login and password on each subpage of the Online Store, via the social network Facebook.com (administrator of the external cookie: Facebook Inc based in the USA or Facebook Ireland based in Ireland);
• authenticating the Customer in the Online Store and ensuring the Customer’s session in the Online Store (after logging in), thanks to which the Customer does not have to re-enter the login and password on each subpage of the Store, via the social network Google.com (administrator of the external cookie: Google LLC based in the USA);
• collecting general and anonymous statistical data via Google Analytics analytical tools (administrator of the external cookie: Google LLC based in the USA), in accordance with the policy https://www.google.com/intl/pl_pl/policies/technologies/cookies/;

The cookie mechanism is safe for the computers of Online Store Customers. In particular, it is not possible for viruses or other unwanted software or malware to penetrate Customers’ computers via this route. Nevertheless, in their browsers Customers have the option of limiting or disabling the access of cookies to computers. If this option is used, the use of the Online Store will be possible, except for functions which by their nature require cookies.

Below we present how you can change the settings of popular web browsers regarding the use of cookies:

Chrome > http://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647
Firefox > http://support.mozilla.org/pl/kb/W%C5%82%C4%85czanie%20i%20wy%C5%82%C4%85czanie%20obs%C5%82ugi%20ciasteczek
Internet Explorer > http://support.microsoft.com/kb/196955
Opera > http://help.opera.com/Windows/12.10/pl/cookies.html
Safari > http://support.apple.com/kb/PH5042

Instructions for mobile devices:

Android > http://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647
Blackberry > http://docs.blackberry.com/en/smartphone_users/deliverables/32004/Turn_off_cookies_in_the_browser_60_1072866_11.jsp
iOS (Safari) > http://support.apple.com/kb/HT1677?viewlocale=pl_PL
Windows Phone > http://www.windowsphone.com/pl-pl/how-to/wp7/web/changing-privacy-and-other-browser-settings

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ may collect Customers’ IP addresses. An IP address is a number assigned to the computer of a person visiting the Online Store by an internet service provider. The IP number allows access to the Internet. In most cases it is assigned to the computer dynamically, i.e. it changes each time it connects to the Internet. The IP address is used by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ in diagnosing technical problems with the server, creating statistical analyses (e.g., determining from which regions we record the most visits), as information useful in administering and improving the Online Store, as well as for security purposes and possible identification of unwanted automatic programs that burden the server and browse the content of the Online Store.

The Online Store contains links and references to other websites. MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ is not responsible for the privacy rules in force there.

Right to withdraw consent – legal basis: Article 7(3) GDPR.

• The Customer has the right to withdraw any consent they have given to MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ.
• Withdrawal of consent has effect from the moment the consent is withdrawn.
• Withdrawal of consent does not affect the processing carried out by MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ in accordance with the law before its withdrawal.
• Withdrawal of consent does not entail any negative consequences for the Customer, however it may prevent further use of services or functionalities which, according to the law, MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ can provide only with consent.

Right to object to processing – legal basis: Article 21 GDPR.

• The Customer has the right at any time to object – on grounds relating to their particular situation – to the processing of their personal data, including profiling, if MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ processes their data on the basis of a legitimate interest, e.g., marketing of products and services of MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, keeping statistics on the use of individual functionalities of the Online Store and facilitating the use of the Online Store, as well as satisfaction surveys.
• Opting out via email from receiving marketing communications regarding products or services will mean the Customer’s objection to the processing of their personal data, including profiling for these purposes.
• If the Customer’s objection proves justified and MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ has no other legal basis for processing personal data, the Customer’s personal data against whose processing the Customer has objected will be deleted.

Right to erasure (“right to be forgotten”) – legal basis: Article 17 GDPR.

The Customer has the right to request the deletion of all or some personal data.

The Customer has the right to request the deletion of personal data if:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• they have withdrawn specific consent, to the extent that the personal data were processed on the basis of their consent;
• they have objected to the use of their data for marketing purposes;
• the personal data are processed unlawfully;
• the personal data must be deleted in order to comply with a legal obligation provided for by the law of the Union or the law of a Member State to which MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ is subject;
• the personal data have been collected in connection with the offering of information society services.

Despite the request to delete personal data, in connection with the objection or withdrawal of consent, MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ may retain certain personal data to the extent that processing is necessary to establish, pursue, or defend claims, as well as to comply with a legal obligation requiring processing under Union law or the law of a Member State to which MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ is subject. This applies in particular to personal data including: first name, last name, email address, which are retained for the purposes of handling complaints and claims related to the use of services of MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, or additionally home address/correspondence address, order number, which are retained for the purposes of handling complaints and claims related to concluded sales contracts or the provision of services.

Right to restriction of processing – legal basis: Article 18 GDPR.

• The Customer has the right to request restriction of the processing of their personal data. Submitting a request, until it is considered, makes it impossible to use specific functionalities or services, the use of which will be associated with the processing of data covered by the request. MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ will also not send any communications, including marketing ones.
• The Customer has the right to request restriction of the use of personal data in the following cases:
  • when they question the correctness of their personal data – then MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ restricts their use for the time needed to check the correctness of the data, but no longer than 7 days;
  • when the processing of data is unlawful and instead of deleting the data the Customer requests restriction of their use;
  • when the personal data are no longer necessary for the purposes for which they were collected or used but are needed by the Customer to establish, pursue, or defend claims;
  • when they have objected to the use of their data – then restriction occurs for the time needed to consider whether – due to the particular situation – the protection of the Customer’s interests, rights and freedoms prevails over the interests pursued by the Controller by processing the Customer’s personal data.

Right of access – legal basis: Article 15 GDPR.
The Customer has the right to obtain from the Controller confirmation whether personal data concerning them are being processed, and, if so, the Customer has the right to:

• gain access to their personal data;
• obtain information about the purposes of processing, categories of personal data processed, recipients or categories of recipients of such data, the planned period of storing the Customer’s data or the criteria for determining that period (where it is not possible to determine the planned period of data processing), about the rights vested in the Customer under the GDPR and about the right to lodge a complaint with the supervisory authority, about the source of these data, about automated decision-making, including profiling, and about the safeguards applied in connection with the transfer of these data outside the European Union;
• obtain a copy of their personal data.

Right to rectification – legal basis: Article 16 GDPR.

The Customer has the right to request from the Controller the rectification without undue delay of personal data concerning them that are inaccurate. Taking into account the purposes of the processing, the Customer whose data concern has the right to request the completion of incomplete personal data, including by submitting an additional statement, by sending a request to the email address in accordance with §6 of the Privacy Policy.

Right to data portability – legal basis: Article 20 GDPR.

The Customer has the right to receive their personal data which they have provided to the Controller, and then transmit them to another controller of their choice. The Customer also has the right to request that the personal data be transmitted by the Controller directly to such a controller, insofar as this is technically feasible. In such a case the Controller will transmit the Customer’s personal data in the form of a file in csv format, which is a commonly used format, machine-readable and allows the transferred data to be sent to another controller.

In the situation of the Customer exercising an entitlement resulting from the above rights, MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ shall comply with the request or refuse to comply without undue delay, but no later than within one month of its receipt. However, if – due to the complex nature of the request or the number of requests – MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ cannot comply within one month, it will comply within the next two months, informing the Customer in advance within one month of receipt of the request of the intended extension of the deadline and its reasons.

The Customer may submit complaints, inquiries and requests to the Controller regarding the processing of their personal data and the exercise of their rights.

The Customer has the right to request from MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ the provision of a copy of standard contractual clauses by submitting an inquiry in the manner indicated in §6 of the Privacy Policy.

The Customer has the right to lodge a complaint with the President of the Office for Personal Data Protection, regarding the violation of their rights to the protection of personal data or other rights granted under the GDPR.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ provides Customers with a secure and encrypted connection when transmitting personal data and when logging into the Customer Account on the Website. MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ uses an SSL certificate issued by one of the leading global companies in the field of security and encryption of data transmitted over the Internet.

If a Customer who has an account in the Online Store has lost their access password in any way, the Online Store allows generating a new password. MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ does not send a password reminder. The password is stored in encrypted form, in a way that prevents it from being read. To generate a new password, provide the email address in the form available at the “Forgot your password” link provided at the login form for the Online Store account. The Customer will receive an electronic message to the email address provided during registration or saved in the last profile change containing a redirect to a dedicated form made available on the Online Store Website, where the Customer will be able to set a new password.

MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ never sends any correspondence, including electronic correspondence, requesting the provision of login data, and in particular the access password to the Customer’s account.

The Privacy Policy may change, of which MONTEFOREST SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ will inform Customers 7 days in advance.
Questions related to the Privacy Policy should be addressed to: kontakt@monteforest.com
Date of last modification: 10.07.2025