Privacy & Cookies Policy

§1General provisions

This Privacy Policy and Cookies Policy sets out how personal data of Users is processed and protected, and how cookies and similar tracking technologies are used, in connection with the website at www.startwithmonica.com and the online store at shop.startwithmonica.com.

Using the Website, the Store or the Service means that you have read this document. Where the law requires consent — in particular for non-essential cookies and for marketing communications — that consent is collected separately and explicitly. Continued browsing alone is not treated as consent.

We process personal data in accordance with applicable law, in particular the GDPR.

We take particular care to respect the privacy of Users and to ensure that data collected through the Website is processed only for the stated purposes and is not further processed in a manner incompatible with those purposes. Personal data is collected only on an appropriate legal basis, and its scope is limited to what is necessary for the relevant purpose.

If you have any questions about this document, contact us at [email protected].

We reserve the right to amend this document. Reasons may include developments in internet technology, changes in applicable law, or changes to how the Website operates. The date of the current version is shown at the top. Material changes will be announced on the Website, and notified by email where required, before they take effect. Capitalised terms have the meaning given in §2.

§2Definitions

Controller / we / us — Monika Jus, os. Wl. Jagielly 12G, 60-694 Poznan, Poland, operating as unregistered activity under the Polish Act of 6 March 2018.

User / you — any person visiting or using the Website, the Store or the Service.

Website and Store — the website and online store operated by the Controller at the addresses in §1.

Personal data / data — any information relating to an identified or identifiable natural person, such as a name, an identification number, location data, an online identifier, or factors specific to that person's identity.

Consent — a freely given, specific, informed and unambiguous indication of your wishes by which you signify agreement to the processing of your personal data.

Account — a User account created in the Store, giving access to purchased digital content, products or services under the Store Terms.

Form / Forms — places on the Website that let you submit personal data for the purposes indicated, e.g. newsletter subscription, placing an order, or contacting us.

Newsletter — a digital service provided electronically consisting in sending emails about events, services, products and other matters, including marketing and commercial content sent on the basis of your consent and/or our legitimate interest in direct marketing.

Service — the set of interoperating IT systems and software enabling the processing, storage, sending and receiving of data via telecommunications networks, including the Website, the Store, applications, and the Controller's social media profiles and channels.

GDPR — Regulation (EU) 2016/679 (General Data Protection Regulation).

AI Act — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence.

DSA — Regulation (EU) 2022/2065 on a single market for digital services.

§3Who is the controller of your personal data

The controller of your personal data is Monika Jus, at the address given in §2.

Joint controllership with social platforms

For data of persons who use our social media profiles, follow them or interact with them, we act as a joint controller together with the platform provider:

• Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02X525, Ireland — for Facebook and Instagram;
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — for YouTube;
• TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland — for TikTok;
• Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland — for Pinterest.

The essential terms of these arrangements are set by the respective providers and are available in their documentation. We use social plugins linking to these platforms, through which you may navigate to them.

§4Is providing data voluntary

Providing data is voluntary. However, failing to provide information marked as mandatory means we cannot provide the relevant service, achieve the relevant purpose, or take the requested action.

If you provide data that is not mandatory, or more than we need, that is your own decision and the processing of such excess data takes place on the basis of your consent (Art. 6(1)(a) GDPR). You consent to us anonymising or deleting data we do not require but which you have nevertheless sent us.

§5Purposes of processing and legal bases

We may process your personal data for the following purposes and on the following bases.

§6How we collect data

We collect and process only data that you provide yourself, except for data collected automatically via cookies and server logs, as described below.

When you visit the Website, information about the visit is collected automatically — for example your IP address, domain name, browser type and operating system type. This may be used to analyse User behaviour, compile demographic statistics, and personalise content to improve the Website. It is processed for administering the Website, ensuring reliable hosting, and delivering marketing content, and is not linked to the data of individual Users. See §21 for more on cookies.

Data may also be collected through the Forms available on the Website, as described in §18.

§7Your rights under the GDPREU

Under Articles 15–21 GDPR you have, at any time:

• the right of access to your data;
• the right to data portability;
• the right to rectification of inaccurate data;
• the right to completion of incomplete data;
• the right to erasure ("the right to be forgotten"), where there is no basis for continued processing;
• the right to restriction of processing, where processing was unlawful or lacked a basis;
• the right to object to processing based on our legitimate interest — and an unconditional right to object to processing for direct marketing;
• the right to lodge a complaint with a supervisory authority.

These rights are not absolute and do not apply to every processing activity. For example, obtaining a copy of your data must not adversely affect the rights and freedoms of others, such as copyright or professional secrecy. Refer to the GDPR for the applicable limitations.

You always have the right to complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, tel. +48 22 531 03 00, email [email protected]. If you are located in another EU/EEA state, you may also complain to your local authority.

To exercise your rights, contact us at [email protected] or in writing at the address in §2, indicating the scope of your request. We will respond no later than 30 days from receipt, unless an extension is justified under the GDPR, in which case we will inform you.

§8Withdrawing consent

Where you have consented to a particular activity, that consent may be withdrawn at any time. Withdrawal is as easy as giving consent.

For the Newsletter, you may withdraw consent by clicking the "unsubscribe" link in any message, which takes you to a page confirming the withdrawal. You may also withdraw by sending a statement to our email or postal address.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

In some cases data may not be deleted in full and will be retained to defend against potential claims for the period provided by law, or to fulfil legal obligations. In each case we will respond to your request and explain the basis for any continued processing.

§9International data transfers

Your data may be transferred outside the European Economic Area, in particular to the United States, because we use external service providers (such as Meta, Google or Microsoft) that store data on US servers in whole or in part.

For Meta Platforms and Google, transfers to the United States take place on the basis of:

• the European Commission's adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework, where the recipient is certified;
• Standard Contractual Clauses approved by the European Commission;
• additional safeguards applied by the provider, such as encryption and pseudonymisation.

In other cases, personal data is transferred only to recipients who guarantee an adequate level of protection, through an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules approved by the competent authority, or your explicit consent.

Detailed information is available in each provider's privacy policy, for example: Google, Meta, TikTok, Pinterest.

We select providers with whom we can conclude a data processing agreement. Note that tools change rapidly, and newer tools may result in transfers (typically of anonymised data) to third countries by their providers. If you are located in the United States, your data will be processed in the EU and/or the US depending on the provider concerned.

§10How long we keep your data

We keep your data for as long as necessary to deliver the relevant service or achieve the purposes in §5, and additionally:

• for the period of the service and cooperation, and the limitation period for claims — for data of contractors, clients and Users;
• for the period of negotiations preceding a contract — for data given in an enquiry;
• for the period required by law, including tax law — for data connected with statutory obligations;
• until an effective objection under Art. 21 GDPR — for data processed on legitimate interest, including direct marketing;
• until consent is withdrawn or the purpose achieved — for data processed on consent (afterwards, data may still be kept to defend against claims for the applicable limitation period, or a shorter period notified to you);
• until the data becomes outdated or ceases to be useful — for analytics, statistics, cookies and site administration;
• for a maximum of 2 years for persons who unsubscribed from the Newsletter, to defend against claims, or after 6 months of complete inactivity.

Retention periods expressed in years are calculated from the end of the calendar year in which processing began. Detailed periods for individual activities are in our record of processing activities.

§11Who receives your data

We use external service providers. Entities we entrust with processing guarantee appropriate protection and security required by law, in particular the GDPR, and act under a data processing agreement.

We entrust the processing of personal data to, among others:

• GoHighLevel and Mailgun — sending the Newsletter and operating the mailing system;
• GoHighLevel — building landing pages and collecting leads;
• Stripe — processing payments and issuing accounting documents;
• Google Ireland Limited, Dublin — Google services, including email;
• OVH — domain and mail server services;
• other contractors engaged for technical, administrative, accounting, HR, IT, graphic, copywriting or legal support.

Personal data may also be disclosed to public authorities, including tax authorities, to fulfil legal and tax obligations. Entities processing data on our behalf maintain European data protection standards and apply compliance mechanisms when transferring data outside the EEA, in particular Standard Contractual Clauses adopted by the European Commission in Decision 2021/915.

§12Data security

Your personal data is stored and protected with due care, under our internal procedures. We use appropriate technical and organisational measures meeting legal requirements, in particular the GDPR, above all to protect data against access by unauthorised persons.

Access to personal data is granted only to authorised persons obliged to keep it confidential, or to entities entrusted with processing under a separate agreement.

Measures we apply include TLS encryption of data in transit and access controls limiting data to authorised persons.

You should also protect your own data transmitted over the internet: do not disclose your login credentials, use antivirus protection, and keep software up to date.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and notify the competent supervisory authority within 72 hours where required by Art. 33 GDPR.

§13Children

We do not knowingly collect the data of children. You must be at least 16 to consent independently to processing for information society services through the Website, including for marketing. Otherwise, consent must be given or authorised by a person with parental responsibility. If you are under 16, you should not use the Website or the Service. We may make reasonable efforts to verify the age requirement.

§14Links to other websites

The Website may contain links to other websites, which may open in a new or the same window. We are not responsible for their content. You should review the privacy policy and terms of any website you visit.

§15Social media activity

16.1 Common provisions

We administer your data on our profiles on the platforms in §3, acting as a joint controller with the platform provider, in particular for data of persons who use the platform and our profile, follow it, or interact with us. The scope of data also follows from the provider's privacy policy.

Data provided on our profiles is processed to administer and manage the profile, communicate and interact with you, direct marketing content to you, and build a community. The basis is your consent and our legitimate interest in interacting with Users and followers. You decide voluntarily whether to like or follow.

The rules on our profile are set by us; the rules of the platform itself follow from the platform's terms. You may stop following at any time. We can see personal data such as your image, name, or general information you publish publicly or share with us in messages; all other data is processed by the platform under its own terms. Data may be shared with cooperating agencies, subcontractors, IT support or a virtual assistant where contact takes place outside the platform.

16.2 Facebook and Instagram (Meta)

Our Facebook page: facebook.com/startwithmonica. Our Instagram profile: instagram.com/startwithmonica. Data may be transferred to the US and stored on US servers. Meta relies on the EU–U.S. Data Privacy Framework adequacy decision of 10 July 2023, Standard Contractual Clauses, and additional safeguards. Data may be profiled to personalise advertising, but not subject to automated decision-making producing legal or similarly significant effects. Privacy policies: Facebook, Instagram.

16.3 TikTok

Our TikTok profile: tiktok.com/@startwithmonica. We are joint controllers with TikTok for activities pursuing common purposes, including the use of TikTok plugins on the Website. Data may be transferred to third countries outside the EEA per TikTok's terms, using Standard Contractual Clauses. Privacy policy: TikTok.

16.4 YouTube

YouTube is operated by Google Ireland Limited. Privacy policy: Google. Terms: YouTube.

16.5 Pinterest

Our Pinterest profile: pinterest.com/startwithmonica. We act as a joint controller with Pinterest Europe Ltd. for data of persons who follow or interact with our profile. Data may be transferred outside the EEA using Standard Contractual Clauses. Privacy policy: Pinterest.

§16Artificial intelligence systemsEU

We may use tools based on artificial intelligence ("AI Systems") for data analysis, automating customer service, content personalisation, and improving our services. Any use of AI takes place in accordance with the GDPR and the AI Act.

AI Systems may process your personal data to:

• analyse preferences and tailor our offer (e.g. behavioural marketing);
• automatically handle enquiries (e.g. chatbots);
• detect fraud and irregularities in transactions;
• carry out statistical analysis to improve our services.

Processing takes place only to the extent necessary, on an appropriate legal basis such as your consent (Art. 6(1)(a) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR).

Transparency. Where you interact with an AI system such as a chatbot, we will tell you clearly that you are interacting with a machine and not a human, as required by Art. 50 of the AI Act. Where we publish AI-generated or materially AI-modified content, we will label it where the AI Act requires.

Data minimisation. Our AI Systems are designed on a data-minimisation basis: we process only data necessary for the specified purpose, retention is adapted to the purpose, and once processing is complete data is anonymised or deleted unless you consent to further processing or another legal basis applies.

Protection. Our AI Systems follow "privacy by design and by default". We seek to ensure GDPR and AI Act compliance, apply encryption and pseudonymisation where possible, restrict access to authorised persons, and carry out regular reviews and data protection impact assessments where required. If you have questions about our use of AI, contact us using the details in §25.

§17Automated decision-making and profiling

Your personal data will not be used for automated decision-making producing legal effects concerning you, or similarly significantly affecting you, within the meaning of the GDPR, without your explicit consent.

Within the Website and its tracking technologies, your data may be profiled to help personalise the offer we present (mainly through behavioural advertising). This should have no effect on your legal position. The information used is anonymous and not linked to personal data you provided, e.g. during a purchase; it derives from statistical data such as gender, age, interests, approximate location and behaviour on the Website. You have the right to object to profiling.

Where an AI system makes a decision in an automated manner, you have the right to obtain an explanation of the logic applied, to object to the decision, and to obtain human review. Contact us using any method in this document. More on behavioural advertising: youronlinechoices.com.

§18Forms

We use the following types of Forms on the Website.

19.1 Newsletter subscription form

Requires your first name and email address (mandatory). You must then confirm your subscription for your address to be added to our subscriber base (double opt-in). Subscribing means you agree to receive marketing and commercial information by electronic means at the address given, and consent to the use of your terminal equipment for direct marketing of our products and services. These consents are voluntary but necessary to use the Newsletter, and may be withdrawn at any time.

The Newsletter is sent for an indefinite period, from activation until consent is withdrawn. After withdrawal, your data may be kept in the newsletter database for up to 2 years to demonstrate that consent was given, what activity took place, and when consent was withdrawn, and to address any related claims (Art. 6(1)(f) GDPR). The Newsletter may be discontinued after 6 months of inactivity, after which we delete your data from the sending system. The mailing system records activity relating to the emails sent to you (open times, link clicks, unsubscription).

We may conduct remarketing on the basis of Art. 6(1)(f) GDPR: subscriber email addresses are uploaded (hashed) to Meta's advertising manager, and advertising created by us is directed at those subscribers who are also Facebook users. Data is deleted after each campaign. Details: Meta Custom Audiences, Meta data processing.

19.2 Contact form

Lets you send us a message electronically. Your name, email address and the data in the message are processed to respond to you. After contact ends, the data may be archived (our legitimate interest). We cannot state a precise archiving period; the maximum will not exceed the limitation periods for claims, unless further contact takes place or processing rests on another basis.

19.3 Comments form

All data in the comment form is provided voluntarily; by posting you consent to its processing. The data are: first name, surname, email, website address and IP address. Providing an email address is voluntary but necessary to filter spam and display your avatar; it is not disclosed to third parties. We are not responsible for the content of comments and may decline to publish spam, offensive, unlawful, or link-laden comments.

19.4 Store order form

When placing an order you must provide certain data under the Store Terms, to fulfil the order, meet legal obligations, handle settlement and claims, and for statistical, archival and direct-marketing purposes (our legitimate interest). Mainly: first name, surname, company name, tax number, address of residence or registered office, delivery address if different, email. If you have an Account, you log in with your username (or email) and password. We keep the data for order fulfilment and, afterwards, for the period necessary to defend against claims and as required by law (e.g. invoice retention).

19.5 Complaint, withdrawal & illegal-content report forms

You may submit a complaint, withdraw from a contract, or report illegal content using the forms attached to the Store Terms, or without them by supplying the necessary data: first name and surname (or business name), address, email, phone (optionally), and bank account number (if a refund is due). Providing the data is voluntary but necessary to handle the request under the law and the Store Terms. The illegal-content report form implements our DSA obligations: we confirm receipt without undue delay, decide in a timely, non-arbitrary and objective manner, and inform you of our decision and the redress available.

19.6 Account registration form

You may create an Account in the Store by providing: first name, surname, email, address of residence, registered office address, tax number (where applicable), and a password. Account creation takes place under the Store Terms and is a service provided electronically. Mandatory fields must be completed; other data is voluntary.

§19Disclaimer and intellectual property

20.1 Nature of published content

Content on the Website does not constitute medical, nutritional, legal or other professional advice and does not address any specific factual situation. If you need help with a specific matter, consult a qualified person, or contact us. We are not responsible for the use made of the content, or for actions or omissions taken on its basis.

20.2 Copyright and related rights

Content on the Website — texts, graphics, photographs, video, educational materials, source code and other publications — is protected under applicable copyright law. We do not consent to copying, reproduction, distribution or use in whole or in part without our express prior consent, except where permitted by law (personal use or quotation within statutory limits). When quoting fragments, you must identify the author or source, state our full name, and include an active, clickable link to the full source material. Breach may give rise to civil and criminal liability; we reserve the right to pursue claims, including for damages.

20.3 Text and data mining (TDM)

Text and data mining — automated analysis of text and data in digital form to generate information such as patterns, trends and correlations — may be restricted on the Website and may require our consent. We expressly reserve our rights under Art. 4(3) of Directive (EU) 2019/790 in respect of TDM for commercial purposes, including the use of content for training artificial intelligence models. Commercial data mining requires our prior consent. TDM may be permitted without consent only for scientific and research purposes, provided it does not infringe copyright and is not for direct or indirect commercial gain.

20.4 Liability as a provider of online services

We take due care to detect and remove user-generated content that infringes third-party copyright, including on the social media described here. If you post content you did not create or hold rights to, you bear full responsibility for any infringement. Where an infringement is reported, we may remove the content, block access to it, or pass information to the competent authorities or the rights holder. You may appeal a decision to remove your content under the procedure we make available.

By commenting and publishing on our social media profiles, you grant us a non-exclusive licence to use that content to the extent enabled by the platform's functionality, for as long as it is published, until you remove it. We may moderate, hide or remove content that breaches the platform's terms, is offensive, vulgar, misleading or unlawful, is advertising or spam, or infringes copyright. Repeat offenders may be blocked. We are not responsible for content published by Users on social media, but may remove non-compliant material and report infringements to the platform. Content on the Website is current as at the date of publication, unless stated otherwise.

§20Technical requirements

To use the Website you need:

• internet access from a device (desktop, laptop or mobile), including equipment enabling communication and completion of forms, such as a working keyboard;
• a properly configured, current web browser supporting cookies — e.g. Microsoft Edge, Opera, Mozilla Firefox, Safari or Google Chrome;
• an active, properly configured email account (we recommend checking that emails from our domain are not routed to a "spam" or "promotions" folder — this depends on your mailbox settings and is outside our control);
• software to read content in the formats presented, e.g. PDF, video, MP3 or MP4.

§21Cookies policy

Like most websites, ours uses tracking technologies — cookies — to improve the Website for visitors. The Website does not collect information automatically, except for information in cookies and server logs. Cookies are small text files stored on your device when you use the Website. They may be first-party (from the Website) or third-party (from other sites). Cookies allow the content to be adapted to your needs and let us compile statistics on how the Website is used.

22.1 Categories of cookies we use

22.2 Third-party cookies

Meta (Facebook) Pixel and Facebook Ads / Custom Audiences

Provided by Meta Platforms Ireland Limited. An analytics tool that helps measure advertising effectiveness, shows what actions Users take, and helps reach a defined audience. We may conduct remarketing (Art. 6(1)(f) GDPR): hashed email addresses are uploaded to Meta's advertising manager and advertising is directed at those who are also Facebook users; data is deleted after each campaign. Information collected is anonymous at our end. Details: Meta. Opt out: Meta help.

TikTok Pixel

Used to manage advertising on TikTok and conduct remarketing (our legitimate interest), helping reach people who have already visited the Website. Details: TikTok Pixel. Privacy policy: TikTok.

Google Analytics

Used to analyse Website statistics under an agreement with Google Ireland Limited (provided by Google LLC), on our legitimate interest in compiling statistics to improve our services. We do not process any data enabling your identification through Google Analytics. Details: Google Analytics help. Privacy: Google.

Pinterest Tag

Used to measure the effectiveness of our Pinterest content and to conduct remarketing (our legitimate interest), helping reach people who have already visited the Website. Provided by Pinterest Europe Ltd. Privacy policy: Pinterest.

GoHighLevel

Our website, funnels, forms and checkout run on GoHighLevel. It sets cookies needed for the pages, forms and store to function, and may set a cookie to recognise an incomplete order so we can remind you about it (abandoned cart), on the basis of our legitimate interest. Privacy policy: GoHighLevel.

Embedded YouTube content

We may embed videos from YouTube, operated by Google Ireland Limited. YouTube may store cookies about playback on your device and assign them to your account if you are logged in. If you do not want this, log out of YouTube before visiting or do not play the video. YouTube privacy: Google, terms: YouTube.

Affiliate links

Affiliate links to third-party products may appear on the Website — a way of monetising content offered free of charge. Clicking incurs no charge for you; if you follow a link and make a purchase, we may receive a commission.

22.3 Session and persistent cookies

Two types are used: session cookies, deleted when you close your browser, log out or leave the Website; and persistent cookies, stored for the period in the cookie's parameters or until you delete them, allowing your browser to be recognised on your next visit.

22.4 Managing cookies through your browser

Browser software usually allows cookies by default. You may change your settings at any time — for example to block automatic handling or be informed each time a cookie is placed. Restricting or disabling cookies may affect some functionality. More information is in your browser's "Help" section. Deleting cookies is not the same as us deleting personal data obtained through them.

§22Cookie consent management

The Website uses the cookie-consent management built into GoHighLevel. The tool lets you consent to specific categories of cookies, reject non-essential cookies, and change your decision at any time.

How it works. On your first visit, a cookie banner is displayed. The banner presents "Accept all" and "Reject all" options with equal prominence at the first layer; rejecting is no harder than accepting. You may change your settings at any time using the "Cookie settings" link in the Website footer. Your consent decision is stored for 12 months, after which you will be asked again. You may change your cookie settings at any time, complain about the way your data is processed by the consent tool, and withdraw your cookie consent without affecting the lawfulness of prior processing.

§23Server logs

Using the Website involves sending requests to the server on which it is hosted. Every request is recorded in the server logs, which include your IP address, the server date and time, and information about your browser and operating system. Logs are saved and stored on the server, used to administer the Website, and not disclosed to anyone other than persons authorised to administer the server. We do not use server logs to identify you.

§24Changes to this policy

We may amend this document for the reasons in §1. The date of the last update is shown at the top. Where changes are material — a new processing purpose, a new category of recipient, or a change to retention — we will notify you in advance through a notice on the Website and, where required or where processing is based on your consent, by email. Where a new purpose requires consent, we will collect fresh consent rather than relying on the amended policy.

§25Contact

Controller: Monika Jus
Email: [email protected]

Data Protection Officer: We have not appointed a Data Protection Officer and carry out the obligations relating to the processing of personal data ourselves.

You acknowledge that your personal data may be provided to authorised state authorities in connection with proceedings conducted by them, at their request and where the necessity of obtaining that data is established.

Supervisory authority (EU): President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. Tel. +48 22 531 03 00. Email [email protected].