Privacy Policy

Version 1.0 · Effective date: [TO BE COMPLETED ON PUBLICATION]
This document has been prepared for RealPak Trade d.o.o. and reflects the website as built. It has not yet been reviewed by a qualified Montenegrin lawyer.

1. Who is responsible for your data

RealPak Trade d.o.o. ("RealPak Trade", "we", "us") is the controller of personal data processed through this website.

RealPak Trade d.o.o.
Bulevar Svetog Petra Cetinjskog 54, 81000 Podgorica, Montenegro
Registration number / PIB: 03784703
VAT (PDV) number: 30/31-29369-2
Email: sales@realpak.me
Telephone: +382 67 488 826

We have not appointed a Data Protection Officer. Montenegrin law requires one only in defined cases, none of which currently applies to our activities. Privacy questions should be sent to the address above. [A dedicated privacy address such as privacy@realpak.me is recommended - to be confirmed]

2. Which law applies

Our processing is governed by the Montenegrin Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, Official Gazette of Montenegro nos. 79/08, 70/09, 44/12, 22/17 and 77/24), supervised by the Agency for Personal Data Protection and Free Access to Information.

Because we address business customers in Germany, Austria and other EU/EEA countries, and because our website is offered in German, the EU General Data Protection Regulation (Regulation (EU) 2016/679) may also apply to processing relating to individuals located in the EU/EEA, under Article 3(2)(a) GDPR - offering goods or services to data subjects in the Union. We therefore apply GDPR-level standards to all enquiries received through this website, irrespective of where the sender is located. Where the two frameworks differ, we apply the stricter requirement.

3. Scope

This policy covers personal data processed when you visit realpak.me, submit the business inquiry form or the contact form, correspond with us by email, or download documents we publish. It does not cover third-party websites we link to.

4. What we collect

4.1 Information you give us

When you submit the business inquiry form, we process: company name, contact person, business email address, country, business type, product category of interest, your message, and - if you choose to provide them - telephone number and estimated order volume. The contact form processes: name, business email address, subject, message, and optionally company and telephone.

Only the fields marked with an asterisk are required. Please do not include special categories of personal data, or personal data about third parties, in a free-text message.

4.2 Information collected automatically

When you submit a form, our server records the IP address the submission came from, the browser user-agent string, the page the form was sent from, and a timestamp. This is used to prevent automated abuse of the form and to apply a submission rate limit.

Our hosting provider additionally maintains standard web server logs. We do not operate analytics, tracking or advertising technology on this website.

4.3 Storage on your device

This website sets no cookies. If you choose a language using the language selector, that choice is saved in your browser's local storage under the key realpak-lang so that the site can remember it. Nothing is transmitted to us, and you can clear it at any time in your browser settings. See the Cookie Policy.

5. Why we process it, and on what legal basis

Processing activities

Purpose	Legal basis
Answering your business inquiry, sending you the information or quotation you asked for, and the follow-up correspondence	Steps taken at your request prior to entering into a contract - Article 6(1)(b) GDPR and the corresponding provision of the Montenegrin Law on Personal Data Protection. Where you are acting for a company rather than in your own name, our legitimate interest in responding to a commercial approach - Article 6(1)(f) GDPR.
Sending you an automatic confirmation that we received your enquiry	The same basis as the enquiry itself. The confirmation is a service message, not marketing.
Keeping a record of enquiries and of the business relationship	Our legitimate interest in managing commercial relationships and in being able to reconstruct what was agreed - Article 6(1)(f) GDPR.
Preventing automated abuse of the forms, rate limiting, keeping server logs	Our legitimate interest in the security and availability of the website - Article 6(1)(f) GDPR.
Performing a contract once an order is agreed, including passing packing instructions to our facilities	Performance of a contract - Article 6(1)(b) GDPR.
Meeting accounting, tax and customs obligations	Compliance with a legal obligation - Article 6(1)(c) GDPR.
Establishing, exercising or defending legal claims	Our legitimate interest in protecting our legal position - Article 6(1)(f) GDPR.

We do not rely on consent for any processing described above, because none of it requires consent. We do not carry out automated decision-making or profiling that produces legal effects.

6. Who receives your data

Your data is not sold, and is not shared for anyone else's marketing.

• Hostinger International Ltd (Cyprus) - our website hosting and email provider, acting as our processor under its Data Processing Addendum. Enquiries are delivered to, and stored in, our sales@realpak.me mailbox on that infrastructure. Hostinger in turn engages its own sub-processors for infrastructure, content delivery and email filtering, some established outside the EEA; where that involves a transfer out of the EEA, the European Commission's Standard Contractual Clauses apply under that Addendum. Hostinger publishes the current list of its sub-processors. We engage no processor of our own beyond Hostinger.
• Our own commercial team in Podgorica.
• Our packing and export facilities in Karachi and Lahore, Pakistan - only after an order is agreed, and only with what is needed to fulfil it. See section 7.
• Professional advisers - accountants, auditors and lawyers, where relevant.
• Public authorities - where we are legally required to disclose, for example customs or tax authorities.

Loading a page on this website makes no request to any third-party server. Fonts, stylesheets, scripts and images are all served from our own domain, so simply reading these pages discloses your IP address to nobody except our hosting provider.

7. Transfers outside Montenegro and the EEA

Our operations include Montenegro and Pakistan. Our Karachi and Lahore sites are packing and export facilities.

Enquiry data submitted through this website stays with our commercial team in Podgorica and is not routinely sent to Pakistan. Once an order is agreed, the packing facility receives only what it needs to fulfil it - packaging specifications and the destination port - which may include the business contact details required for shipping documents. That transfer is necessary for performance of the contract with you, or of a contract concluded in your interest, and is made on that basis.

Pakistan is not the subject of an adequacy decision by the European Commission. We do not claim otherwise. [Where transfers become regular rather than incidental, Standard Contractual Clauses or an equivalent instrument should be put in place - to be confirmed with counsel]

8. How long we keep it

• Enquiries that do not lead to a business relationship - 24 months from the last contact, then deleted.
• Enquiries that lead to a business relationship - for the duration of the relationship and afterwards for as long as claims may be brought or records must be kept.
• Accounting and tax records - for the statutory retention period under Montenegrin accounting and tax law. [Exact period to be confirmed with our accountant]
• Form security records (IP address, user-agent, rate-limit counters) - kept only as long as needed for that purpose and routinely cleared.
• Server logs - according to our hosting provider's standard retention. [To be confirmed with Hostinger]

9. Your rights

You have the right to ask us for access to your personal data; to have inaccurate data corrected; to have data erased; to have processing restricted; to object to processing based on legitimate interests; and to receive data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. As set out in section 5, we do not currently rely on consent for website processing.

To exercise any of these rights, write to sales@realpak.me. We may need to verify your identity. We will respond within the period required by applicable law.

10. Complaints

If you believe we have handled your data unlawfully, please contact us first so we can try to resolve it. You also have the right to complain to the supervisory authority:

Agency for Personal Data Protection and Free Access to Information
Bulevar Revolucije 11, Podgorica, Montenegro
Telephone: +382 20 634 883 / +382 20 634 884
Email: azlp@azlp.me
Web: www.azlp.me

If you are located in the EU/EEA and consider that the GDPR applies to processing concerning you, you may also be able to complain to the supervisory authority of your country of residence. We are established in Montenegro and are not currently subject to the one-stop-shop mechanism, so we cannot state that any particular EU authority is our lead authority.

11. Security

We take reasonable technical and organisational measures appropriate to the risk. The website is served over HTTPS. Form submissions are transmitted to our server over an encrypted connection and relayed to our mailbox using authenticated SMTP over TLS. Access to the sales mailbox is limited to staff who need it. Form input is validated and filtered on the server.

No method of transmission or storage is completely secure, and we do not claim otherwise.

12. Children

This is a business-to-business website addressed to commercial buyers. It is not directed at children and we do not knowingly collect data from them. We do not operate age verification, because the site offers nothing intended for or attractive to minors.

13. Changes to this policy

We may update this policy as our website or our legal obligations change. The current version and the date of the last change are shown at the foot of this page. Where a change materially affects how we use your data, we will take reasonable steps to bring it to your attention.

---

Last updated: 2026-08-09