Privacy policy

In force from 31 October 2026. This document combines the former Privacy policy and Cookie policy. It is an English translation; in case of doubt, the Polish version prevails.

This Privacy policy explains what data we process on monstermedia.pl, why, who we share it with and what rights you have. It also describes cookies and similar technologies (such as browser storage) and how to manage your consent to them.

§1 Definitions

• Website — the monstermedia.pl website (the mnstr. brand), in its Polish and English versions.
• Controller — MONSTER MEDIA Michał Urbański, ul. Barlickiego 7b/8, 40-820 Katowice, Poland, VAT ID PL6342523448, REGON 241032128.
• User — a natural person who uses the Website.
• Device — an electronic device with software through which the User uses the Website.
• Cookies — text data stored as files on the User’s Device. Browser storage (localStorage) works in a similar way.
• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
• Personal data — information about an identified or identifiable natural person, e.g. name, e-mail address, phone number or an online identifier.
• Processing — any operation performed on personal data, e.g. collection, storage, use, disclosure or erasure.
• Profiling — automated processing of personal data to evaluate certain personal aspects of a natural person.
• Pseudonymisation — processing data so that it can no longer be attributed to a specific person without additional information kept separately.

§2 Controller and contact

The controller of personal data is MONSTER MEDIA Michał Urbański. For anything concerning personal data and this policy, you can contact us:

• e-mail — [email protected],
• phone — +48 793 953 993,
• mailing address — MONSTER MEDIA, ul. Barlickiego 7b/8, 40-820 Katowice, Poland.

Pursuant to Art. 37 GDPR, the Controller has not appointed a Data Protection Officer. Please contact the Controller directly in all matters concerning data.

§3 What data we process

Data you provide yourself in forms:

• Contact form — full name, e-mail address, phone (optional) and the content of your message.
• Brief form — the scope of your needs, project stage and goal, project description, website address (optional), budget, timing, uploaded files (optional), full name, company (optional), e-mail address, phone (optional) and how you heard about us (optional).
• E-mail and phone correspondence — the data you give us when you write or call.

Messages from the forms go to the [email protected] mailbox, and a copy is stored in the Website database. We send an automatic confirmation of receipt to the e-mail address you provide.

Data collected automatically:

• technical data sent by your browser with every connection (including IP address, browser and system type, the address of the page visited), recorded in server logs by the hosting provider and by Cloudflare for security purposes,
• with your consent — analytics data from Google Analytics 4 and Microsoft Clarity (including pages visited, visit duration, device type, approximate location, traffic source, and in Clarity also a record of mouse movements and scrolling, without data typed into forms),
• a record of your cookie decision in the consent log (described in §9).

The Website does not run user accounts, a newsletter or online sales.

§4 Purposes and legal bases

• Replying to your message, preparing a proposal and a quote — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract), and when you write on behalf of a company — Art. 6(1)(f) GDPR (our legitimate interest in contact with clients).
• Website security and protection against abuse — Art. 6(1)(f) GDPR.
• Statistics and improving the Website (Google Analytics 4, Microsoft Clarity) — your consent, Art. 6(1)(a) GDPR.
• Measuring the effectiveness of our Google Ads (whether an ad click ended with a form submission or a click on our phone number or e-mail) — your consent, Art. 6(1)(a) GDPR.
• Demonstrating that we obtained cookie consent — Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
• Establishing, exercising or defending legal claims — Art. 6(1)(f) GDPR.

Storing and reading cookies on your Device complies with Art. 399 of the Polish Electronic Communications Law of 12 July 2024: necessary cookies without consent, all others only with your consent. We also apply the Polish Act of 10 May 2018 on the Protection of Personal Data.

Providing data in the forms is voluntary, but without the data marked as required we will not be able to reply. We do not make automated decisions about you and we do not profile you. We do not use remarketing or personalised ads.

§5 Who we share data with

We do not sell personal data. Access to it is limited to the entities that help us run the Website, under data processing agreements or their own processing terms:

• Zenbox sp. z o.o. — hosting of the Website and database on servers in Poland (Zenbox privacy policy, in Polish),
• Cloudflare, Inc. — protecting and speeding up the Website (privacy policy),
• Google Ireland Ltd. — Google Analytics 4, Google Tag Manager and Google Ads (ad measurement), only with your consent (privacy policy),
• Microsoft Ireland Operations Ltd. — Microsoft Clarity, only with your consent (privacy policy),
• YouTube (Google) — only on pages with an embedded video, in privacy-enhanced mode (youtube-nocookie.com); the video connects to YouTube only when you play it,
• the e-mail provider we use for the [email protected] mailbox.

Links to our Facebook and Instagram profiles are ordinary links — we do not embed plugins from these services and do not share Website data with them. Once you go to their websites, their privacy rules apply.

§6 Transfers outside the European Economic Area

Google, Microsoft and Cloudflare may also process data in the United States. Such transfers are based on the European Commission’s decision on the EU-US Data Privacy Framework, which these companies have joined, and on standard contractual clauses. We store form data on servers in Poland.

§7 How long we keep data

• Messages and briefs — for as long as needed to reply and for any resulting cooperation; we then delete or anonymise them within 30 days. The exception is when the data is needed to establish, exercise or defend legal claims — in that case we keep it for no longer than 3 years.
• Cookies — for the period given in the tables in §9 or until you delete them in your browser.
• Consent log — 24 months.
• Anonymous statistical data — with no fixed term, as it does not allow you to be identified.

§8 Your rights

• Right of access — you can find out what data we process and get a copy.
• Right to rectification — you can ask us to correct or complete your data.
• Right to erasure — you can ask us to delete your data. We may withhold erasure if the data is needed to protect our legitimate interest, e.g. to defend against claims.
• Right to restriction of processing — in the cases set out in Art. 18 GDPR, including when you contest the accuracy of the data.
• Right to data portability — you can receive your data in a structured, commonly used format.
• Right to object — to processing based on our legitimate interest (Art. 21 GDPR).
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal. You can change your cookie consent in Cookie settings.
• Right to lodge a complaint — with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority in your country.

Send requests concerning your data to [email protected]. We will reply without undue delay and within one month at the latest.

§9 Cookies and consent management

Cookies are small text files stored in your browser. Some of them are necessary for the Website to work. We store analytics and marketing cookies only if you consent.

How to manage your consent

On your first visit we show a banner where you can accept all cookies, reject them or choose categories in “Settings”. Rejecting is as easy as accepting and does not limit access to any content.

You can change your decision at any time: click the cookie icon in the bottom-left corner of the page or the Cookie settings link. When you withdraw consent, we remove analytics and marketing cookies from your browser. Your decision is valid for 12 months; after that, or when the list of tools changes, we will ask again.

We use Google Consent Mode v2: until you consent, Google tools do not store analytics or advertising cookies.

Necessary (no consent required)

Analytics (only with consent)

Marketing (only with consent)

We use them only to check whether our Google Search ads bring enquiries. We do not use remarketing or personalised ads.

Consent log

To be able to show that we obtained your consent (Art. 7(1) GDPR), we record: a random consent ID, the date, the version of this policy, the categories chosen and the address of the page where the decision was made. We do not record your IP address or any other data that would identify you. Entries are kept for 24 months. You can find your consent ID in Cookie settings.

Fonts and browser settings

The Website’s fonts are stored on our server — your browser does not connect to Google Fonts during your visit. You can also delete or block cookies in your browser settings, e.g. Chrome, Firefox, Safari, Edge. Blocking necessary cookies may make the Website harder to use, e.g. the brief form.

§10 Data security

We use technical and organisational measures that protect data against loss and unauthorised access: an encrypted connection (HTTPS), Cloudflare protection, software updates and restricted access to data. The cookies used by the Website do not contain scripts or content that could harm your Device. Data security also depends on you — keep your Device’s software and antivirus protection up to date.

§11 External links

The Website may contain links to other websites that we do not cooperate with. We are not responsible for their content or privacy rules — once you go there, their own policies apply.

§12 Changes to this policy

We may change this policy, e.g. when we add a new tool or the law changes. The current version is always available on this page, with the date it came into force at the top. If a change concerns cookies that require consent, we will ask for your consent again in the banner.