Personal Data Processing Policy

Montebook Inc DOO Tivat

Version for montebook.com

Publication date: 13.06.2026

1. General provisions

1.1. This Personal Data Processing Policy explains what personal data is collected and processed by Montebook Inc DOO Tivat, registered at Palih Boraca 20, 85310 Tivat, Montenegro, PIB 03426688, hereinafter referred to as the “Company”, the “Controller” or “we”, when users visit https://montebook.com, submit requests through website forms, contact the Company by email, messengers, telephone, social media or other communication channels.

1.2. This Policy applies to website visitors, prospective and existing clients, property owners, buyers, tenants, partners, job applicants and other persons who provide their personal data to the Company.

1.3. The Company processes personal data in accordance with the laws of Montenegro, including the Law on Personal Data Protection of Montenegro (Zakon o zaštiti podataka o ličnosti), and other applicable regulations. Where specific processing activities are subject to European Union law, including the GDPR, the Company complies with such requirements to the extent applicable.

1.4. By using the website or sending a request through a contact form, by email, telephone, messenger or any other channel, the User confirms that they have read this Policy.

2. Key terms

2.1. Personal data means any information relating to an identified or identifiable natural person, directly or indirectly.

2.2. User or data subject means a natural person who uses the website, contacts the Company, sends a request, provides contact details, is interested in buying, selling, renting or using another real estate service, applies for a vacancy or otherwise interacts with the Company.

2.3. Processing of personal data means any operation or set of operations performed on personal data, including collection, recording, storage, organisation, use, updating, disclosure, restriction of access, erasure or destruction.

2.4. Controller means Montebook Inc DOO Tivat, which determines the purposes and means of personal data processing.

2.5. Processor means a person or organisation processing personal data on behalf of the Company, including providers of hosting, CRM systems, email services, analytics or website technical support.

2.6. Website means https://montebook.com and any subdomains used by the Company.

3. Personal data the Company may process

3.1. The Company may process the following categories of personal data:

• first name and last name;
• telephone number;
• email address;
• country of residence or city of stay;
• preferred language of communication;
• content of a request, comment, message or application;
• information about the property of interest, budget, purpose of purchase, sale or lease;
• information about a property, if the User contacts the Company as the owner or representative of the owner;
• documents and information required for preparing, supporting or completing a transaction, where such data is required by law or necessary for providing the service;
• information included in a CV, portfolio, cover letter or job application;
• information about communication with the Company, including correspondence and call history, where necessary for handling the request and maintaining service quality;
• technical data: IP address, device type, browser, operating system, pages visited, date and time of visit, cookies and similar technologies.

3.2. The Company does not request special categories of personal data, including data concerning health, political opinions, religious or philosophical beliefs, racial or ethnic origin, intimate life, sexual orientation, biometric data, criminal convictions or trade union membership, unless this is required by law or voluntarily provided by the User in connection with a specific request.

3.3. The User must not provide the Company with personal data of third parties without a lawful basis or the consent of those persons.

4. Purposes of personal data processing

4.1. The Company processes personal data for the following purposes:

• receiving and handling applications, enquiries and requests;
• contacting the User regarding purchase, sale, rental, investment and other real estate services;
• selecting real estate properties according to the User’s criteria;
• arranging property viewings, negotiations and transaction support;
• verifying and clarifying information about real estate properties;
• preparing contracts, commercial offers, documents and related materials;
• performing contracts and pre-contractual obligations;
• complying with legal requirements, including accounting, tax, fraud-prevention obligations and responses to requests from competent authorities;
• processing job applications and communicating with candidates;
• improving the website, analysing traffic and user behaviour;
• ensuring website security, preventing fraud, spam, technical failures and unauthorised access;
• sending informational and marketing messages, where the User has given consent or where such communication is permitted under applicable law.

5. Legal bases for processing

5.1. The Company processes personal data where one or more of the following legal bases apply:

• the User’s consent;
• processing is necessary to respond to the User’s request or to take steps before entering into a contract;
• processing is necessary for the performance of a contract to which the User is a party;
• compliance with the Company’s legal obligations;
• the Company’s legitimate interest, including service development, protection of rights and lawful interests, website security, business correspondence and internal reporting;
• other grounds provided by applicable law.

5.2. The User has the right to withdraw consent to the processing of personal data where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. How the Company collects personal data

6.1. The Company obtains personal data:

• when the User fills in a form on the website;
• when the User contacts the Company by telephone, email, messengers, social media or other channels;
• when the User sends a CV or applies for a vacancy;
• when the User provides documents or information for preparing a transaction;
• automatically when the User visits the website, including through cookies and analytics tools;
• from publicly available sources, where this is necessary to verify information about a property, owner, representative or counterparty and does not conflict with the law.

7. Disclosure of personal data to third parties

7.1. The Company may disclose personal data only to the extent necessary to achieve the purposes of processing.

7.2. Personal data may be disclosed to the following categories of recipients:

• employees and representatives of the Company;
• agents, brokers, partners and consultants involved in providing the service;
• lawyers, notaries, translators, accountants, banks, appraisers and other specialists, where necessary for preparing or supporting a transaction;
• providers of IT services, hosting, CRM systems, email services, analytics, communication services and technical support;
• state authorities, courts, tax, law-enforcement and other competent authorities, where disclosure is required by law;
• other persons, where the User has given consent or where such disclosure has a lawful basis.

7.3. The Company requires processors and partners to maintain confidentiality and to apply reasonable organisational and technical measures to protect personal data.

8. International transfer of personal data

8.1. In the course of operating the website and providing services, personal data may be transferred outside Montenegro, for example where international hosting, email, analytics, CRM, messenger or cloud storage services are used.

8.2. Such transfer is made only where there is a legal basis and reasonable safeguards are applied, including contractual obligations of the recipient, necessity for the performance of a contract, the User’s consent or another ground provided by applicable law.

8.3. Where personal data is transferred to a country whose level of personal data protection differs from the level of protection in Montenegro or the European Economic Area, the Company takes measures it considers necessary and reasonable in view of the nature of the data, the purposes of transfer and applicable law.

9. Retention periods

9.1. The Company retains personal data no longer than necessary for the purposes for which it was collected, unless a longer period is required by law or necessary for the protection of the Company’s rights and lawful interests.

9.2. Data relating to enquiries and applications is retained for the period necessary to handle the request, maintain communication and provide subsequent client support.

9.3. Data relating to contracts, transactions, accounting and tax records is retained for the periods provided by applicable law.

9.4. Data of job applicants is retained during the candidate review process and for a reasonable period after recruitment has ended, unless the candidate objects to such retention or longer retention is necessary to protect the Company’s rights.

9.5. Once the purposes of processing have been achieved or the applicable retention period has expired, personal data is erased, anonymised or archived where further retention is permitted by law.

10. User rights

10.1. The User has the right to:

• obtain information on whether the Company processes their personal data;
• request access to their personal data;
• request correction of inaccurate or incomplete data;
• request erasure of data where there is no lawful basis for further processing;
• object to processing for direct marketing purposes;
• withdraw consent to processing where processing is based on consent;
• request restriction of processing in cases provided by law;
• lodge a complaint with the competent personal data protection authority.

10.2. To exercise these rights, the User may send a request to the Company at: Montebook Inc DOO Tivat, Palih Boraca 20, 85310 Tivat, Montenegro, or by email: sales@montebook.com.

10.3. The Company may request additional information to verify the User’s identity where necessary to protect personal data against unauthorised access.

11. Protection of personal data

11.1. The Company applies reasonable legal, organisational and technical measures to protect personal data against unauthorised access, alteration, disclosure, loss, destruction or other unlawful use.

11.2. Such measures may include access restrictions, passwords and information system security tools, backups, access controls for employees and processors, contractual confidentiality obligations and other measures appropriate to the nature of the data and processing risks.

11.3. Despite the measures taken, transmission of data over the internet cannot be completely secure. The User should take this into account when sending data through the website, email, messengers or other communication channels.

12. Cookies and analytics technologies

12.1. The website may use cookies and similar technologies to ensure proper website operation, save user settings, analyse traffic, improve website content and assess the effectiveness of communications.

12.2. Cookies may include technical, analytics, functional and marketing cookies where such tools are enabled on the website.

12.3. The User may restrict or disable cookies in the browser settings. Some website functions may not work properly as a result.

12.4. If third-party analytics or advertising tools are used on the website, such services may process the User’s technical data in accordance with their own privacy policies. The list of such services must be specified by the Company according to the tools actually enabled on the website.

13. Marketing communications

13.1. The Company may send the User informational and marketing communications about real estate, services, market news, special offers and Company materials, where the User has given consent or where such communication is permitted under applicable law.

13.2. The User may opt out of marketing communications by sending a request to the Company or by using the unsubscribe mechanism where it is included in the message.

14. Minors

14.1. The website and the Company’s services are not intended for independent use by persons who have not reached the age of full legal capacity under applicable law.

14.2. If the Company becomes aware that it has received personal data of a minor without the required consent of a legal representative, the Company will take reasonable steps to erase such data or obtain proper consent where processing is necessary.

15. Changes to this Policy

15.1. The Company may amend this Policy from time to time to reflect changes in legislation, website operation, services, technologies or internal processes.

15.2. The current version of the Policy is published on https://montebook.com.

15.3. Continued use of the website after a new version of the Policy has been published means that the User has read the updated version.

16. Contacts

For questions regarding personal data processing, please contact:

Montebook Inc DOO Tivat

Palih Boraca 20, 85310 Tivat, Montenegro

PIB: 03426688

Website: https://montebook.com

Email: sales@montebook.com