PRIVACY POLICY – as of December 2021

Below we explain which data we collect from you and how we further process or store this data. Please do not hesitate to contact us if you have any questions about this privacy policy or about the processing of your personal data in general.

To make the following information easier to follow, here is an overview:

I. Name and contact details of the controller

II. How personal data is processed and the nature and purpose of its use

1. Data processing when you visit the website
   1. Accessing the website
   1. Customer account
   1. Orders via our website
   1. Newsletter
   1. Contact form
   1. Data processing by means of cookies (including Google Analytics and Facebook Pixel)
   1. Social media plugins
   1. Other processing purposes (in particular marketing, statistics)
2. Data processing for retailer enquiries

III. Storage period – deletion periods

IV. Disclosure of data

1. Authorisation to disclose
2. Recipients, general
3. Disclosure when paying by PayPal
4. Disclosure when paying via Klarna
5. Disclosure when paying by Apple Pay
6. Disclosure when paying by Google Pay

V. Rights of data subjects

1. General rights
2. Right to object

VI. Data security

VII. Currency of and changes to this privacy policy

I. Name and contact details of the controller

This privacy information applies to data processing by:

Monte Nativo Ltd.
Jaroslav Veshin 16,
Sofia, 1408 – Bulgaria
Managing director authorised to represent the company:
Bozhidar Iliev

Phone: +49 152 27893204
Email: info@montenativo.de

II. How personal data is processed and the nature and purpose of its use
We process your personal data in the ways explained in more detail below and for the purposes stated in each case.

1. Visiting the website
a) Accessing the website

When you access our website www.montenativo.de , the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file retrieved,
• website from which access is made (referrer URL),
• browser used and, where applicable, your computer's operating system and the name of your access provider

We process the data mentioned for the following purposes:

• ensuring a smooth connection to the website,
• ensuring convenient use of our website,
• evaluating system security and stability,
• tracing unauthorised or unlawful access.

The legal basis for the data processing is Art. 6(1) sentence 1(f) of the General Data Protection Regulation (GDPR, German: DSGVO). Our legitimate interest follows from the purposes of data collection listed above. In this context, we do not use the data collected for the purpose of drawing conclusions about you personally.

b) Customer account
You can set up a password-protected customer account in your name in our shop.

You can reach the registration page at the top right under the "My account" icon. To register, you need to give us your email address. We will then send you a password and a link with which you can log in to your new customer account. As soon as you have activated the link contained in the email, your customer account is activated.

There, under the "Addresses" section, you can enter personal data (first name, surname, address, email address, phone number) for the billing address and, where applicable, a different delivery address. Under the "Payment methods" section, you can select your preferred payment method.
An order cannot be placed without entering the mandatory information marked as such.

You can also change your password at any time in your customer account under the "Account details" section. For your security, every time your password is changed you will receive an email at the email address you have given in your account settings.

Under "Orders" you can view the orders you have placed so far.

You can log in to your customer account at any time by entering your username or email address and your password. You can change your billing or delivery address there at any time.
The customer data you enter is made available for the orders you place.

Only you have access to the customer account, by entering your email address and the password you have chosen. For this password, the system stores only the generated hash value. The original password cannot be recovered from this hash value. If you ever forget your password, you can reset it using the "Forgotten password" function.

Each time you log in or log out, we store the following data in addition to the data mentioned above:

• date and time of login and logout

Your personal data is processed in connection with the registration and use of your customer account for the purpose of enabling the simplified login to our online shop that you have requested, and the use of offers that are only available within the customer account (e.g. viewing your order history). The legal basis for the data processing is therefore Art. 6(1)(b) GDPR.

The data is processed for the purpose of using your customer account to place orders. The legal basis for the data processing is therefore Art. 6(1)(b) GDPR.

c) Orders via our website
You can place orders via our website either through a customer account you have already set up or one set up during the order, or as a guest, i.e. without registering. If you would like to order as a guest, please activate the "Create Monte Nativo shopping account" field.

The advantage of registering is that for future orders you can log in to our shop directly with your email address and password, without having to enter your contact details again.

When you place an order via our website, we collect the data stored in your customer account (see b) above) or, in the case of a guest order, the following data:

• email address,
• first name, surname,
• address
• preferred payment method
• content of your order.

This data is collected

• to be able to identify you as our customer;
• to process your order or enquiry
• to correspond with you;
• for invoicing;
• to handle any liability claims and to assert any claims against you;
• to ensure the technical administration of our website;

The data processing takes place at your request when you order and/or register, and is necessary under Art. 6(1) sentence 1(b) GDPR for the purposes stated, for the appropriate handling of your order and for both parties to fulfil their obligations under the purchase contract.

d) Newsletter and SMS marketing
If you sign up for our newsletter or SMS marketing on our website, we need your email address or your mobile phone number. By signing up (opt-in), you agree to receive information, offers and news from us regularly by email or SMS.

The emails and SMS messages are sent on our behalf by Klaviyo, Inc. ("Klaviyo"), 125 Summer St, Floor 6, Boston, MA 02111, United States. We have concluded a data processing agreement with Klaviyo that governs Klaviyo's obligations when processing and protecting your data. Please note that your data is generally processed and stored on Klaviyo servers in the USA.

Klaviyo uses your data exclusively for sending newsletters and SMS messages on our behalf. It is not used for Klaviyo's own purposes or passed on to third parties.

In addition, Klaviyo analyses user behaviour in our online shop so that we can optimise our marketing activities. Cookies may be used for this that link your behaviour in our web shop with your data if you have signed up for our newsletter, created a customer account or gone through an order process. You can find more information in Klaviyo's privacy policy at https://www.klaviyo.com/privacy (available in English only).

Our newsletter tool allows us, among other things, to analyse the sending and performance of our campaigns (e.g. open rates, click behaviour, purchases after clicking a newsletter). This helps us tailor our content more closely to our subscribers' interests.

The processing is based on your consent under Art. 6(1)(a) GDPR.

You can withdraw your consent or unsubscribe at any time:
– For emails, via the unsubscribe link at the end of every newsletter or by emailing info@montenativo.de.
– For SMS, simply by replying "STOP" to the message you received.

The data you provide to us when signing up for the newsletter is stored by us until you unsubscribe from the newsletter and, after withdrawal of consent or unsubscribing, is deleted both from our servers and from the servers of our service provider. Data stored by us for other purposes (e.g. in connection with a customer account you may have set up) is not affected and is subject to separate storage and deletion periods.

e) Contact form
On our website we offer you the option of getting in touch with us via a contact form. Your surname and a valid email address are required so that we know who the enquiry is from and can reply to it. Further information (first name, address, phone number, etc.) may be given voluntarily. It is entirely up to you whether you enter this data in the contact form. However, if you would like us to contact you by phone (see below), giving your phone number is of course necessary.

The personal data you provide when contacting us in this way is processed under Art. 6(1) sentence 1(b) GDPR on the basis of handling your enquiry.

If you would like us to contact you separately by phone, we need your consent for this. You give us this consent by entering your phone number. The processing of your phone number (i.e. storing and using it for the purpose of contacting you) is then justified by your consent under Art. 6(1) sentence 1(a) GDPR. You can withdraw your consent at any time.

Without this consent, we will not contact you by phone to answer your enquiry.

f) Data processing by means of cookies
We use cookies on our website.

aa) General information / consent – changing and withdrawing it / information on the cookies used on this website
A "cookie" is a – usually small – amount of data that your browser creates automatically and that may be stored in a text file on your device (laptop, tablet, smartphone or similar) when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware.

The cookies store information relating to the specific device you use. However, this does not mean that we thereby gain direct knowledge of your identity.

On the one hand, cookies are used to make using our online shop more convenient for you, e.g. through the so-called cart function. They also allow us to recognise which individual pages you have visited and when you may have abandoned an order, so that we can use the corresponding analyses to optimise the online shop for you.

bb) Necessary and functional cookies – can be used without consent
Cookies are necessary for some functions of our website, e.g. for the cart function. The online shop remembers the items you have placed in the virtual cart by means of a cookie that is stored on your device until the order is completed.

The use of these cookies is justified under Art. 6(1) sentence 1(b) GDPR in order to properly provide the function you have requested. Your separate consent is therefore not required for the use of these cookies.

cc) Usability and relevance cookies
Where cookies are used on our website to make using our offer more convenient for you, their use is justified on the basis of your express consent under Art. 6(1) sentence 1(a) GDPR. The same applies to cookies we use to recognise that you have already visited individual pages of our website. You can withdraw your consent here at any time.

dd) Google Analytics analysis tool
To analyse user behaviour on our website, we use the "Google Analytics" service of Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). The service uses "cookies". The information collected by the cookies is generally sent to a Google server in the USA and stored there. Under the data processing agreement concluded with us, Google uses the information collected to evaluate website use and website activity and provides services connected with internet use.

We have activated IP anonymisation for this processing. This means that users' IP addresses are shortened within the member states of the EU and the European Economic Area. This shortening removes the personal reference of the IP address concerned.

Your data is processed by Google Analytics only with your express consent and is then justified under Art. 6(1) sentence 1(a) GDPR.
The cookies stored on your device by Google Analytics are likewise used exclusively with your consent and are justified under Section 25(1) of the German Telecommunications and Telemedia Data Protection Act (TTDSG).

You can prevent the cookie from being stored on your device by adjusting the relevant settings in your browser. If your browser does not accept cookies, it cannot be guaranteed that you will be able to access all functions of this website without restriction.

You can also use a browser plugin to prevent the information collected by cookies (including your IP address) from being sent to and used by Google Inc. The following link takes you to the relevant plugin: https://tools.google.com/dlpage/gaoptout/eula.html?hl=de

ff) Facebook Pixel for creating Custom Audiences with advanced matching (with cookie consent tool)
Within our online offer, we use the so-called "Facebook Pixel" of the social network Facebook in advanced matching mode. Facebook is operated by Facebook Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Facebook").

Unlike the so-called standard version of the Facebook Pixel, the advanced matching function allows us to measure the effectiveness of our advertising campaigns as fully as possible.

The Facebook Pixel is used exclusively on the basis of your express consent and works as follows:

When you click on an advert placed by us and shown on Facebook, the Facebook Pixel adds a suffix to the URL of our linked page. This URL parameter is then written into the browser you are using as a so-called first-party cookie of our own website – i.e. not as a third-party cookie from Facebook. As part of advanced matching, the cookie then records the specific customer data that we collect from you on our web page linked to the Facebook ad during actions such as completed purchases, account logins or registrations (e.g. your first name and surname, your email address), as well as which actions you took on our website in response to our advert.

The cookie is then read by the Facebook Pixel and allows the data, including the specific customer data, to be forwarded to Facebook. We have no influence on the scope and further use of this data by Facebook. You can find more information on data processing, on Facebook's use of your data, on how long the data and the cookies used on your device are stored, and on your settings options for protecting your privacy here: (https://www.facebook.com/about/privacy/).

By integrating the Facebook Pixel, Facebook at least receives the information that you have clicked on one of our adverts or accessed the corresponding page of our website. This enables Facebook to precisely identify and use the visitors to our online offer as a target group, including for displaying adverts (so-called "Facebook Ads") from other advertising partners. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, it is possible that Facebook will obtain and store your IP address and other identifying features.

We use the Facebook Pixel with advanced matching in order to show the Facebook Ads placed by us only to those Facebook users who have shown an interest in our online offer or who have certain characteristics (e.g. interest in selected topics or products, determined on the basis of the web pages visited). We send these criteria to Facebook in advance (so-called "Custom Audiences"). With the help of the Facebook Pixel with advanced matching, we also want to ensure that our Facebook Ads match users' potential interests and are therefore not perceived as intrusive.

By tracking whether users were redirected to our website after clicking on a Facebook advert (so-called "conversion"), we can also evaluate the effectiveness of our Facebook adverts for statistical and market research purposes.

You can also adjust the settings for which adverts are shown to you on Facebook yourself in your Facebook account settings.
Logged-in users can deactivate the "Facebook Custom Audiences" function at https://www.facebook.com/settings/?tab=ads# . If you are logged in to Facebook, you can change your settings for adverts on Facebook at
https://www.facebook.com/help/109378269482053/?helpref=hc_fnav .

gg)Deactivating cookies
Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a notice always appears before a new cookie is created. Completely deactivating cookies may, however, mean that you cannot use all the functions of our website.

You can also deactivate third-party cookies by visiting the opt-out page of the Network Advertising Initiative at https://www.networkadvertising.org/choices/ and following the further opt-out information given there.

hh) Storage period/deletion of cookies
Please refer to the information above on the individual types of use for the storage period of the data processed with the respective cookies.

g) Social media buttons (Facebook, Instagram)
Our social media buttons are designed simply as links. Therefore, no data is automatically passed on to the operators of these social media when you visit our website. Only when you activate the relevant link are you taken to the corresponding social media page. We inform you separately about the data processing that takes place there below under section 2.
We ourselves do not process any data in this context.

h) Other processing purposes (in particular marketing, statistics)
We also process your personal data lawfully generated as described above under b), c) and e) for the following purposes:

• for sending advertising material by post about our products/services
• to manage our customer data.
• for our own analyses and statistical purposes
• for optimising our range of services

This further processing is based on our legitimate interest in advertising our products and services and in improving our advertising presence and our products and services.
The legal basis for this processing is therefore Art. 6(1) sentence 1(f) GDPR. If you do not agree to this processing, you have a right to object (see section V.2. below).

3. Data processing when you contact us in other ways (e.g. phone, email, trade fair stand)
If you contact us by email, by phone or otherwise in person, we generally record your first name and surname and, where applicable, your address and contact details. Further data may also be collected, such as order data and payment data. Otherwise, the data processing depends on the content of your enquiry or order.

Depending on the content of the enquiry or order, the legal basis for the processing is Art. 6(1) sentence 1(b) GDPR for the purpose of answering your enquiry or carrying out your order.

When a contact form available on site (e.g. at a trade fair) is used, the data processing, unless it serves to answer an enquiry (see above), takes place on the basis of your consent under Art. 6(1) sentence 1(a) GDPR.

Your personal data generated in the course of the processes described above is passed on on the basis of Art. 6(1) sentence 1(b) GDPR where this is necessary to answer your enquiry or carry out your order. Where the disclosure serves to optimise our market presence (statistics, direct advertising), it follows from our corresponding legitimate interest and is justified under Art. 6(1) sentence 1(f) GDPR.

4. Retailer enquiries
The information in section 3 above applies accordingly to retailer enquiries. Depending on the content of your enquiry, data relating to your business operations is processed. In this context, please note that we may pass the data on to third parties as part of a credit check. We will inform you about this separately where applicable.

III. Storage period – deletion periods
The data is deleted as soon as it is no longer required for the purpose of its processing or for asserting our claims, and we are not obliged by law to store it for longer. Depending on the type of processing, the personal data processed is subject to the following storage and deletion periods:

1. Processing on the website
a) Accessing the website
If you have visited our website without using the contact form, signing up for the newsletter, placing an order or using any of the other functions, your data will be deleted one month after the end of the session.

b) Customer account
The data stored under your customer account will be deleted once at least 24 months and at most 48 months have passed since your last logout. This applies subject to any longer storage period required by law. If we need the data to enforce claims, it will be stored for correspondingly longer.
The legal basis in this respect is Art. 6(1) sentence 1(c) GDPR.

c) Orders
The personal data we collect to process your order is stored until the statutory retention period expires and is then deleted, unless we are obliged under Art. 6(1) sentence 1(c) GDPR to store it for longer due to retention and documentation obligations under tax and commercial law (under the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)), or you have consented to storage beyond this under Art. 6(1) sentence 1(a) GDPR.

d) Newsletter
Information on the storage of the data you provide when signing up for the newsletter can be found above under II.1.d).

e) Contact form
If no contract is concluded, we delete the data you submitted via the contact form and that we stored for processing after one year at the latest.

f) Use of cookies
You can find out the deletion periods for the individual cookies when you give your consent via the so-called cookie banner.

g) Social media plugins
Your personal data is not processed in connection with merely linking to social media. Deletion therefore does not apply.

h) Other processing purposes (in particular marketing, statistics)
If we process your data for other permissible processing purposes in the context of marketing and statistics, it will be deleted – unless you object to the processing – 24 months after your last contact with us.

2. Contact by other means (e.g. email, phone, trade fair stand)
We automatically delete the personal data processed in connection with the enquiry once the enquiry has been dealt with and, if no contract is concluded, after 15 months at the latest. Longer storage only takes place with your express consent.

3. Retailer enquiries
We automatically delete the personal data processed in connection with the enquiry once the enquiry has been dealt with and, if no contract is concluded, after 24 months at the latest. Longer storage only takes place with your express consent.

IV. Disclosure of data
1. Authorisation to disclose
Your personal data is not transferred to third parties for purposes other than those listed below (sections 2. et seq.).

We only pass on your personal data to third parties if:

• this is permitted by law and is necessary under Art. 6(1) sentence 1(b) GDPR for the performance of contractual relationships with you,
• there is a legal obligation to disclose it under Art. 6(1) sentence 1(c) GDPR and/or
• the disclosure is necessary under Art. 6(1) sentence 1(f) GDPR for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed.

We only pass on your personal data for other purposes if you have given your express consent to this, Art. 6(1) sentence 1(a) GDPR.

2. Recipients, general
We pass on your personal data to third parties mainly to the service partners involved in performing the contract, such as the logistics company commissioned with delivery and the bank commissioned with payment matters. Under certain conditions, we also transfer your data to credit agencies (see section 4. below) and debt collection companies (see section 5. below). Finally, the contract data is transferred to our tax adviser and the relevant authorities (in particular the tax authority). Your data may also be transferred, within the scope of disclosure permitted by law, to the following third parties: processors to whom we transfer personal data in order to conduct our business relationship with you, or whom we allow access to your data stored with us. In detail: support/maintenance of IT applications; archiving; call centre services; controlling; data destruction; debt recovery; customer management; marketing; website management.

Where your personal data is passed on to third parties, however, the scope of the data transferred is limited to the necessary minimum.
The disclosure of the data is necessary in the context of initiating and/or performing the contract and is therefore justified under Art. 6(1) sentence 1(b) GDPR.

3. Disclosure when paying by PayPal
The controller has integrated PayPal components on this website. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which are virtual private or business accounts. PayPal also offers the option of processing virtual payments by credit card if a user does not have a PayPal account. A PayPal account is managed via an email address, which is why there is no conventional account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also acts as a trustee and offers buyer protection services. PayPal's European operating company is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If the data subject selects "PayPal" as the payment option during the ordering process in our online shop, the data subject's data is automatically transferred to PayPal.

The personal data transferred to PayPal is usually first name, surname, address, email address, IP address, phone number, mobile phone number or other data necessary for processing the payment. Personal data relating to the order in question is also necessary for processing the purchase contract. The purpose of transferring the data is payment processing and fraud prevention. The controller will transfer personal data to PayPal in particular if there is a legitimate interest in the transfer. The personal data exchanged between PayPal and the controller may be transferred by PayPal to credit reference agencies. The purpose of this transfer is to check identity and creditworthiness. PayPal may pass the personal data on to affiliated companies and service providers or subcontractors where this is necessary to fulfil contractual obligations or where the data is to be processed on PayPal's behalf.

By selecting this payment option, the data subject consents to the transfer of personal data required for processing the payment. The disclosure of the data is therefore justified under Art. 6(1) sentence 1(a) GDPR. The data subject can withdraw consent to the handling of personal data from PayPal at any time. A withdrawal does not affect personal data that must necessarily be processed, used or transferred for (contractual) payment processing. The processing of this data is justified under Art. 6(1) sentence 1(b) GDPR. PayPal's applicable privacy provisions can be viewed at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

4. Disclosure when paying by Klarna Pay Now
You also have the option of using the payment service provider Klarna for your purchase from us. Klarna is a service of Klarna Bank AB (publ), with its principal place of business at Sveavägen 46, 111 34 Stockholm, Sweden. If you choose to use Klarna as your payment option, you consent to us collecting the following personal data and transferring it to Klarna: name, address, date of birth, place of birth, email address, IP address, phone number and the contract data relating to the purchase in question (e.g. number of items, item number, invoice amount).
This data is transferred to Klarna so that Klarna can process your order using the payment method you have chosen.
You can find more information on data processing by Klarna at https://www.klarna.com/de/datenschutz/

The legal basis for the data processing is Art. 6(1) sentence 1(b) GDPR, as the processing of the data is necessary for payment by instant bank transfer and thus for the performance of the contract.

Withdrawing consent to the use of personal data from Klarna
You can withdraw your consent to the use of your personal data from Klarna at any time. However, Klarna may remain entitled to process, use and transfer the personal data where this is necessary for contractual payment processing by Klarna's services, is required by law, or is demanded by a court or authority. Please contact Klarna about this, e.g. by email at datenschutz@klarna.de.

5. Disclosure when paying by Apple Pay
If you have selected the "Apple Pay" payment method of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment is processed via the "Apple Pay" function of your device running iOS, watchOS or macOS by charging a payment card stored in "Apple Pay". Apple Pay uses security features built into your device's hardware and software to protect your transactions. To authorise a payment, you therefore need to enter a code you have set beforehand and verify it using the "Face ID" or "Touch ID" function of your device.

For the purpose of processing the payment, the information you provide during the ordering process, together with information about your order, is passed on to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before the data is transferred to the payment service provider of the payment card stored in Apple Pay in order to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. Once the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.

The processing of personal data that takes place here is carried out exclusively for the purpose of processing the payment and is therefore justified under Art. 6(1) sentence 1(b) GDPR..

Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymisation completely rules out any personal reference. Apple uses the anonymised data to improve "Apple Pay" and other Apple products and services.

You can find further information on data protection with Apple Pay at the following web address: support.apple.com/de-de/HT203027

6. Disclosure when paying by Google Pay
If you have selected the "Google Pay" payment method of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), the payment is processed via the "Google Pay" app on your mobile device, which must run at least Android 4.4 ("KitKat") and have an NFC function, by charging a payment card stored in Google Pay or a payment system verified there (e.g. PayPal). To authorise a payment of more than €25 via Google Pay, you must first unlock your mobile device using the verification method you have set up (such as face recognition, password, fingerprint or pattern).
For the purpose of processing the payment, the information you provide during the ordering process, together with information about your order, is passed on to Google. Google then transfers your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, which is used to verify that a payment has been made. This transaction number does not contain any information about the actual payment details of the means of payment stored in Google Pay, but is created and transferred as a numerical token valid only once. For all transactions via Google Pay, Google acts merely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the means of payment stored in Google Pay.

The processing of personal data that takes place here is carried out exclusively for the purpose of processing the payment and is therefore justified under Art. 6(1) sentence 1(b) GDPR..

Google reserves the right to collect, store and evaluate certain transaction-specific information for every transaction made via Google Pay.
According to Google, this processing takes place exclusively under Art. 6(1)(f) GDPR on the basis of the legitimate interest in proper accounting, the verification of transaction data and the optimisation and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with other information collected and stored by Google when other Google services are used.
The Google Pay terms of use can be found here:
payments.google.com/payments/apis-secure/u/0/get_legal_document
You can find further information on data protection with Google Pay at the following web address:
payments.google.com/payments/apis-secure/get_legal_document

V. Rights of data subjects
You have the following rights with regard to the processing of your personal data:

1. General rights
You have the right:

• under Art. 15 GDPR, to request information free of charge about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it was not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details;
• under Art. 16 GDPR, to request without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us;
• under Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• under Art. 18 GDPR, to request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to the processing under Art. 21 GDPR;
• under Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transfer to another controller;
• under Art. 7(3) GDPR, to withdraw your consent once given at any time by notifying us. As a result, we may no longer continue the data processing based on this consent in future, and
• under Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work or of our registered office for this purpose.

2. Right to object
If your personal data is processed on the basis of legitimate interests under Art. 6(1) sentence 1(f) GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data, provided there are grounds for this arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation.

Please note that if you object to the disclosure of your personal data in the context of a credit check, delivery on account is generally no longer possible (see section IV.4. above).

If you wish to exercise your right of withdrawal or objection, simply send an email to info@montenativo.de
Please note our information on the right of withdrawal when using our Facebook fan page above under section II.2d).

VI. Data security
During your visit to the website, we use the widely used SSL (Secure Socket Layer) method in combination with the highest level of encryption supported by your browser. This is generally 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell that a connection is encrypted because the browser's address bar changes from "http://" to "https://" and by the padlock symbol in your browser bar.
When SSL encryption is activated, the data you transfer to us cannot be read by third parties.

We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

VII. Currency of and changes to this privacy policy
This privacy policy is currently valid and is as of January 2022.
As our website and the offers on it develop further, or due to changes in legal or regulatory requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed at any time on the website at

and printed out by you.