1. Introduction
The purpose of this Privacy Policy is to describe the rules for processing personal data when using the MONTEROSA online shop, with particular regard to operating the shop, fulfilling orders, communication and meeting legal obligations.
The controller is committed to processing personal data lawfully, fairly and transparently, in line with data protection law in force at any given time.
2. Details of the controller
Name of the controller: William Stone Magyarország Szolgáltató és Lapkiadó Korlátolt Felelősségű Társaság
Short name: William Stone Magyarország Kft.
Registered office: 2071 Páty, Várhegyi utca 16, Hungary
Postal address: 2071 Páty, Várhegyi utca 16, Hungary
Email address: monterosacaffe@gmail.com
Tax number: 13315256-1-13
Company registration number: 13-09-099751
3. Categories of personal data processed
When you use the online shop, place an order or contact us, the controller may process in particular the following data:
– name
– billing name and address
– delivery name and address
– email address
– phone number
– order data
– payment method data
– technical and logistics data needed to fulfil the order
– IP address, browsing and technical data
– data in invoicing and accounting documents
– other data provided during communication
As a general rule the controller does not store card details; such data is processed in the systems of the relevant payment provider.
4. Purposes of processing
The purposes of processing are in particular:
– operating the online shop
– receiving and managing orders
– invoicing
– processing payments
– arranging delivery
– customer service and communication
– complaint handling
– compliance with legal obligations
– ensuring the security and operation of the website
– optionally, marketing and newsletter communication, where the data subject has given consent
5. Legal bases for processing
The controller processes data on one of the following legal bases:
– performance of a contract or steps taken prior to entering into a contract
– compliance with a legal obligation
– the legitimate interest of the controller
– the consent of the data subject
Processing of data needed for orders, fulfilment, invoicing and administration is generally necessary for the performance of a contract or for compliance with a legal obligation.
Processing for marketing purposes takes place only on an appropriate legal basis, in particular consent.
6. Processors and recipients
To the extent necessary for its operation, the controller may use processors and other recipients, in particular in the following categories:
– hosting provider
– website and webshop system provider
– payment provider
– invoicing software provider
– shipping and logistics partner
– accountant, legal adviser
– email and technical service providers
The controller transfers data to these partners only to the extent necessary and in accordance with the applicable law.
7. Data retention periods
The controller does not store personal data for longer than necessary.
The retention period depends in particular on the purpose of processing and the applicable law. Accordingly:
– data relating to orders and fulfilment is processed for as long as necessary to perform the contract and for the period during which legal claims may be enforced,
– invoicing and accounting data is retained for the period required by accounting and tax law,
– data processed for marketing purposes is processed until consent is withdrawn or the purpose ceases,
– technical log data is processed for as long as necessary for system security.
8. Cookies and technical data
The website may use cookies and other technical solutions to ensure proper operation, improve the user experience, maintain security and, where applicable, for statistical or marketing purposes.
The use of cookies necessary for operation relates to the proper functioning of the website. Where other cookies are used, the controller acts in accordance with the applicable rules.
9. Rights of data subjects
In relation to the processing, the data subject has in particular the following rights:
– the right to be informed
– the right of access
– the right to rectification
– the right to erasure
– the right to restriction of processing
– the right to data portability
– the right to object
– the right to withdraw consent where processing is based on consent
The data subject may exercise these rights by sending an email to the controller.
10. Remedies
If the data subject considers that the processing of their personal data does not comply with the law, they may lodge a complaint with the competent supervisory authority or turn to a court.
The supervisory authority in Hungary:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
11. Data security
With appropriate technical and organisational measures, the controller seeks to ensure the security of personal data, in particular protection against unauthorised access, alteration, transfer, disclosure, erasure, destruction or damage.
12. Final provisions
The controller reserves the right to amend this Privacy Policy in line with changes in the law, changes in its operations or other necessary circumstances. The amended policy takes effect upon publication on the website.
Date of entry into force: [21 March 2026]