Privacy Policy

Effective from 15 October 2026.

1. Data controller

The controller of your personal data is STYL Przemysław Janik, ul. Walczaka 112, 66-400 Gorzów Wielkopolski, Poland, NIP PL5992901245 (hereinafter: “we”, the “Controller”), operating the online shop artmonte.com.

For matters concerning personal data, write to office@artmonte.com or to the address above.

2. What data we process and for what purpose

a) Order fulfilment - name and surname, delivery address, e-mail, telephone number, company details and VAT number (if provided for an invoice), the parameters of the ordered print, IP address and the language version from which the order was placed. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and legal obligations - tax and accounting (Article 6(1)(c) GDPR). Providing this data is necessary to place an order.

b) Online payments - order number, amount, currency, e-mail and the transaction status and identifier exchanged with the payment operator Autopay S.A. Legal basis: performance of a contract (Article 6(1)(b) GDPR). We do not receive your card details or bank login details - you enter them only on the operator's pages.

c) Customer account - e-mail, password (stored only as an Argon2id cryptographic hash), name and surname, order history, list of favourite artworks, date of last login. Legal basis: performance of the account agreement (Article 6(1)(b) GDPR). The account is voluntary.

d) Newsletter - e-mail address, date of subscription, IP address. Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time via the link in the message or by e-mailing us; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

e) Complaints and contact - the data provided in your message (name, e-mail, order number, content, photographs). Legal basis: performance of a contract and legal obligations (Article 6(1)(b) and (c) GDPR) and our legitimate interest in handling enquiries (Article 6(1)(f) GDPR).

f) Security and logs - IP address, request time and browser data in the server logs, and the login attempt log (IP, e-mail, time). Legal basis: our legitimate interest in ensuring the security of the shop and preventing abuse (Article 6(1)(f) GDPR).

g) Establishing, exercising and defending legal claims - data from points a-e. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

3. Recipients of data

We share your data only with entities necessary to achieve the above purposes:

- Autopay S.A. (ul. Powstańców Warszawy 6, 81-718 Sopot) - online payment operator; in respect of the transaction it is a separate controller of your data;
- the courier company carrying out the delivery - name and surname, address, telephone number, e-mail (parcel notifications);
- the print house producing the print - only the print parameters and, in the case of direct dispatch, the address details;
- dhosting.pl (dhosting.pl Sp. z o.o., Warsaw) - hosting of the shop and database on servers in Poland;
- accounting office / accounting systems - invoice data;
- public authorities, where the obligation to disclose arises from the law.

We do not sell data and do not transfer it outside the European Economic Area. We obtain the EUR exchange rate from the National Bank of Poland's service without transferring any personal data.

4. How long we keep data

- order and invoice data - for the duration of order fulfilment and for 5 years from the end of the tax year in which the document was issued (tax regulations), and in respect of claims - until the limitation periods expire;
- customer account - until it is deleted at your request; we may delete unused accounts after 3 years without a login, with prior notice;
- newsletter - until consent is withdrawn;
- complaints and correspondence - 3 years from the closure of the matter;
- server logs and login log - up to 90 days (login attempt log - 2 days);
- unpaid orders - 30 days from placement, after which they are cancelled and anonymised or deleted.

5. Your rights

You have the right to: access your data and obtain a copy of it, rectification, erasure (the “right to be forgotten” - subject to data we are required to retain under the law), restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time.

To exercise these rights, write to office@artmonte.com. We will respond no later than within one month.

You also have the right to lodge a complaint with a supervisory authority - in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl); if you live in another EEA country, you may contact the authority in your own country.

6. Cookies and browser storage

The shop uses only essential mechanisms, with no tracking or advertising tools:

- session cookie am_sess - maintains the cart, login state and form protection (CSRF); it is deleted when the browser is closed or after 2 hours of inactivity; set as HttpOnly, Secure, SameSite;
- localStorage am_favs - the list of favourite artworks stored locally in your browser (without logging in); it is not sent anywhere other than with the request to display the “Favourites” page;
- the delivery country selected in the order session.

As these mechanisms are necessary for the shop to function, they do not require consent (Article 173(3) of the Polish Telecommunications Law) and we therefore do not display a cookie banner. We do not use Google Analytics, advertising pixels or external fonts - all resources are served from our own server. The payment operator Autopay uses its own cookies on its pages in accordance with its own policy.

7. Security

The connection to the shop is encrypted (HTTPS/HSTS). We store passwords only as Argon2id hashes, access to the administration panel is protected and logged, and the number of login attempts is limited. Print-resolution image files of the artworks are stored outside the server's public directory.

8. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing and we do not profile you. The pricing in the configurator and the currency conversion are simple calculations based on the selected parameters, without any analysis of you as a person.

9. Changes to this policy

We may update this policy when the law or the way the shop operates changes. The current version, with its effective date, is always available at artmonte.com/strona/polityka-prywatnosci. We will inform registered customers of significant changes by e-mail.