Privacy Policy

1. Introduction and Data Controller

This Privacy Policy explains how personal data is collected, used, and protected when you visit and use the website Montego (https://montegoprotaras.com/). We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Cyprus Law 125(I)/2018 providing for the protection of natural persons with regard to the processing of personal data, and applicable electronic communications legislation.

Data Controller:
Company Name: DENI VRISI CAFE LTD
Company Registration Number: ΗΕ 445066
Address: Pernera, 5296, Protaras, Cyprus
Email: [email protected]
Telephone: +357 99 00 85 00

We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so under Article 37 of the GDPR. For any privacy-related questions or requests, please contact us directly at the email address above.

Last updated: 29 October 2026

2. Personal Data We Collect and Purposes of Processing

Depending on how you interact with our website, we process different categories of personal data for specific purposes and on specific legal bases under Article 6(1) of the GDPR.

2.1 Server Logs, Caching, and Website Security

When you access our website, our hosting infrastructure and security systems (including LiteSpeed Cache, Imunify Security, and WP Ghost) automatically collect technical information sent by your browser. This includes your IP address, browser type and version, operating system, referrer URL, the pages accessed, and the date and time of the request.

Purpose: Ensuring the stability, performance, and security of the website, preventing brute-force attacks, malware, and unauthorized access.
Legal Basis: Article 6(1)(f) GDPR (our legitimate interest in maintaining a secure and functional website).

2.2 Contact Forms and Inquiries (WPForms)

When you submit an inquiry, reservation request, or other message through our website forms (powered by WPForms, including the WPForms User Journey feature), we collect the information you provide (such as your name, email address, phone number, and message content) along with technical metadata about how you navigated to the form (such as referring page and pages visited prior to submission).

Purpose: Responding to your inquiries, managing reservations or requests, and understanding how users locate our contact forms.
Legal Basis: Article 6(1)(b) GDPR (taking steps at your request prior to entering into a contract or performing a contract) and Article 6(1)(f) GDPR (our legitimate interest in answering general inquiries and optimizing user flow).

2.3 Online Orders, Bookings, and WooCommerce

Our website uses WooCommerce to facilitate online orders, purchases, or bookings. When you use these features, we process your name, billing/delivery address (if applicable), email address, telephone number, order details, and payment status. Session and cart data are stored via strictly necessary cookies (such as woocommerce_cart_hash and wp_woocommerce_session_*).

Payment transactions are processed via Stripe, JCC, PayPal, or Viva Wallet.

Purpose: Processing and fulfilling your orders or reservations, processing payments, providing customer service, and complying with accounting and tax obligations.
Legal Basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (compliance with legal obligations under Cyprus tax and commercial laws).
Retention Period: Order and invoicing records are retained for a period in Cyprus, typically 6 years from the end of the relevant tax year], while transient cart session data expires at the end of your browsing session or within 48 hours.

2.4 Spam Protection (Google reCAPTCHA)

We use Google reCAPTCHA (provided by Google Ireland Limited / Google LLC) to protect our forms and interactive features against automated abuse and spam. This service sets a strictly necessary cookie (_GRECAPTCHA) and analyzes technical and behavioral signals (such as IP address, mouse movements, time spent on the page, and browser settings).

Purpose: Protecting the website from automated spam, fraud, and abuse.
Legal Basis: Article 6(1)(f) GDPR (our legitimate interest in protecting our website and services from misuse) and Section 99(3) of Cyprus Law 112(I)/2004 (Article 5(3) ePrivacy Directive) where strictly necessary to provide the service requested safely.
Privacy Policy: https://policies.google.com/privacy

2.5 Consent Management

We use the MALAKA GDPR consent tool to record and manage your preferences regarding cookies and similar technologies across four categories: necessary, preferences, statistics, and marketing. Your choice is stored in a first-party cookie named malaka_consent.

Purpose: Complying with our legal obligation to obtain and document user consent for non-essential cookies and tracking technologies.
Legal Basis: Article 6(1)(c) GDPR (compliance with a legal obligation).
Retention Period: 180 days (after which you will be asked to renew your choice, or earlier if you clear your cookies).

2.6 Web Analytics (Google Analytics & MonsterInsights)

If you grant consent in the "Statistics" category on our cookie banner, we use Google Analytics (integrated via MonsterInsights Pro with the EU Compliance, Forms Tracking, Media, Page Insights, and Performance addons), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). Google Analytics uses cookies (such as _ga, _ga_*, and _gid) to analyze how you interact with our website, including pages viewed, form interactions, and media engagement.

Purpose: Analyzing website traffic, measuring performance, and improving our content and user experience.
Legal Basis: Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive (your explicit consent). You may withdraw your consent at any time.
Privacy Policy: https://policies.google.com/privacy

2.7 Embedded Media, Social Feeds, and External Resources

Our website integrates content and technical resources from third-party servers:

Vimeo: We embed videos hosted on Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). When loaded, Vimeo may collect your IP address, technical device information, and set cookies (such as vuid) categorized under "Marketing". This processing takes place on the basis of your consent under Article 6(1)(a) GDPR. Vimeo's privacy policy is available at https://vimeo.com/privacy.
Instagram Feed: We use the Instagram Feed Pro plugin to display social media content from Instagram. Where images or scripts are loaded directly from Meta Platforms Ireland Limited servers, your browser transmits your IP address and technical header data to Meta.
External Technical Hosts (www.i-host.gr and unpkg.com): Our website loads certain technical scripts, assets, or booking/service integrations from www.i-host.gr ( and the open-source content delivery network unpkg.com. When your browser requests these files, your IP address and browser metadata are transmitted to these hosts. Depending on whether the specific resource is strictly necessary for the site's visual rendering and requested functionality or linked to optional features, the legal basis is either Article 6(1)(f) GDPR (legitimate interest in efficient delivery of website functionality) or Article 6(1)(a) GDPR (consent).

Note on Fonts and Stylesheets: Google Fonts and Tailwind CSS are hosted locally on our own server; no personal data is transmitted to Google or external CDNs for the delivery of these fonts and stylesheets.

3. Cookies and Consent Preferences

Our website uses cookies and similar storage technologies. Strictly necessary cookies are loaded automatically as they are required for the website to function. All other cookies (preferences, statistics, and marketing) are only placed on your device if you give your explicit consent via our cookie banner.

You can review our detailed Cookie Policy or change/withdraw your cookie consent at any time by clicking the cookie settings button on our website or by using the link below:

4. Recipients of Personal Data and International Transfers

We only share your personal data with third parties where necessary for the purposes listed above, where we have a legal basis to do so, or where third parties act as our data processors under Article 28 GDPR:

Website Hosting & Technical Providers: Our web hosting provider [PLACEHOLDER: Insert name and country of your web hosting company] and IT maintenance personnel.
Payment Service Providers: [PLACEHOLDER: Insert name(s) of payment gateway providers used for WooCommerce orders, if applicable].
Analytics & Security Providers: Google Ireland Limited / Google LLC (for Google Analytics and reCAPTCHA) and security infrastructure providers.
Media, Social & External Service Providers: Vimeo.com, Inc., Meta Platforms Ireland Limited / Meta Platforms, Inc. (where Instagram content is loaded from Meta servers), www.i-host.gr, and unpkg.com.
Public Authorities: Tax authorities, law enforcement, or regulatory bodies where required by Cyprus or EU law (Article 6(1)(c) GDPR).

Transfers Outside the European Economic Area (EEA):
Some of the third-party providers mentioned above (such as Google LLC, Vimeo.com, Inc., Meta Platforms, Inc., and global CDN operators like unpkg) are based in or process data in the United States or other countries outside the EEA. Where personal data is transferred to the United States, we rely on the European Commission's Adequacy Decision for the EU-US Data Privacy Framework (Article 45 GDPR) for certified providers (including Google LLC, Meta Platforms, Inc., and Vimeo.com, Inc.), or on Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR.

5. Obligation to Provide Data and Automated Decision-Making

You are not legally required to provide personal data when simply browsing our website. However, where you wish to submit a contact form, make a reservation, or place an order via WooCommerce, providing the fields marked as mandatory is necessary to process your request or perform the contract. If you do not provide this information, we will not be able to fulfill your request or order.

We do not use your personal data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).

6. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR and Cyprus law:

Right of Access (Article 15 GDPR): You have the right to request confirmation as to whether we process your personal data and to receive a copy of that data.
Right to Rectification (Article 16 GDPR): You have the right to request the correction of inaccurate personal data or the completion of incomplete data.
Right to Erasure / "Right to be Forgotten" (Article 17 GDPR): You have the right to request the deletion of your personal data where there is no longer a legal ground for its processing, subject to statutory retention obligations.
Right to Restriction of Processing (Article 18 GDPR): You have the right to request that we restrict the processing of your data under certain statutory conditions.
Right to Data Portability (Article 20 GDPR): Where processing is based on consent or a contract and carried out by automated means, you have the right to receive the data you provided in a structured, commonly used, and machine-readable format.
Right to Object (Article 21 GDPR): Where we process your data based on our legitimate interests (Article 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation.
Right to Withdraw Consent (Article 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw your consent at any time with effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

How to Exercise Your Rights

You can exercise your rights at any time by contacting us at [email protected] or by using the data request form below:

7. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your personal data infringes the GDPR or national data protection laws, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Cyprus, the competent supervisory authority is:

Office of the Commissioner for Personal Data Protection
Kypranoros 15, 1061 Nicosia, Cyprus
P.O. Box 23378, 1682 Nicosia, Cyprus
Telephone: +357 22818456
Email: [email protected]
Website: https://www.dataprotection.gov.cy