Privacy Policy

1. Who we are

Mentio is operated by:

For the purposes of applicable data protection law, Mentio generally acts as an independent controller in relation to the personal data described in this Privacy Policy.

If and to the extent that we process personal data strictly on behalf of a client and under that client’s documented instructions, we may act as a processor for that limited processing activity, in which case a separate data processing agreement may be entered into where required by applicable law.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data we collect through:

• the Site;
• contact forms;
• enquiry forms;
• order and checkout flows;
• email communications;
• support requests;
• subscriptions;
• invoicing and billing;
• introductory or discovery calls;
• cookies and similar technologies, where used; and
• any other direct interaction between you and Mentio.

This Privacy Policy does not apply to third-party websites, third-party platforms, or third-party services that have their own privacy notices or policies.

3. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data.

4. How we collect personal data

We may collect personal data:

• directly from you when you fill in a form, contact us, place an order, subscribe, or communicate with us;
• from your employer or business where they provide your details in connection with an order or service;
• from Stripe in connection with transactions;
• automatically through cookies, logs, and similar technologies, where used;
• from publicly available sources, where relevant to onboarding, business verification, fraud prevention, or service delivery; and
• from service providers and tools we use to operate the Site and our business.

5. How we use personal data

We may use personal data for the following purposes:

• to operate, maintain, and improve the Site;
• to respond to enquiries and provide support;
• to assess, accept, manage, and deliver orders;
• to administer subscriptions and recurring billing;
• to send order confirmations, invoices, payment notices, and service communications;
• to manage onboarding and delivery;
• to prevent fraud, abuse, and misuse of the Site or services;
• to maintain business, tax, and accounting records;
• to comply with legal, tax, regulatory, and contractual obligations;
• to send service updates or legally required notices;
• to analyse Site usage and performance, where applicable;
• to improve our services, content, and user experience;
• to protect our legal rights and interests;
• to establish, exercise, or defend legal claims; and
• to send direct marketing communications where permitted by law or where you have consented, if applicable.

6. Legal bases for processing

Depending on the context, we rely on one or more of the following legal bases.

7. Direct marketing

We may send marketing communications to business contacts where permitted by applicable law, or where you have given consent.

You can opt out of marketing communications at any time by:

• using the unsubscribe link in the communication, where available; or
• contacting us at support@mentio.pro.

Even if you opt out of marketing, we may still send non-marketing communications that are necessary for service delivery, billing, legal compliance, or account administration.

8. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy.

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies.

9. Disclosure of personal data

We may share personal data with the following categories of recipients, where necessary:

• Stripe;
• hosting providers;
• email service providers;
• analytics providers, if used;
• Calendly;
• professional advisers, including lawyers, accountants, auditors, and insurers;
• regulators, courts, law enforcement, tax authorities, or other authorities where required by law;
• contractors or service providers supporting our operations; and
• potential buyers, investors, successors, or advisers in connection with a corporate transaction, subject to appropriate safeguards.

We do not sell personal data.

10. International transfers

We may transfer or allow access to personal data outside the country in which it was originally collected, including outside the EEA or the United Kingdom, where necessary for our operations or where our service providers are located in other jurisdictions.

Where a transfer of personal data is subject to restrictions under applicable data protection law, we will implement appropriate safeguards where legally required, which may include:

• an adequacy decision;
• the European Commission’s Standard Contractual Clauses;
• the UK International Data Transfer Addendum; or
• another lawful transfer mechanism.

11. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for legal, tax, regulatory, accounting, dispute-resolution, fraud-prevention, and record-keeping purposes. Where applicable law prescribes a longer retention period, we retain the relevant data for that period. Otherwise, we retain personal data only for as long as is necessary and proportionate for the relevant purpose.

Retention periods may vary depending on the type of data and the purpose of processing. For example:

• contact and enquiry data: 24 months after the last meaningful contact;
• customer and order records: 10 years;
• invoices and tax records: 10 years;
• support communications: 24 months after closure of the relevant request, unless longer retention is necessary for an active order, dispute, fraud prevention, or legal claim;
• subscription records: for the duration of the subscription and 10 years thereafter to the extent necessary for billing, tax, accounting, dispute resolution, and legal compliance;
• cookie consent records: 6 months, or for such other period as is necessary to demonstrate compliance and manage the next consent refresh cycle;
• analytics data: 14 months, or in accordance with the retention settings of the analytics service used on the Site.

Where we do not set a fixed retention period, we retain data based on criteria such as:

• the nature of the relationship;
• the purpose of the processing;
• legal obligations;
• limitation periods; and
• the need to resolve disputes or enforce agreements.

12. Data security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

However, no method of transmission over the internet or method of electronic storage is completely secure. We therefore cannot guarantee absolute security.

13. Your rights

Depending on your location and the applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• request data portability;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

If you wish to exercise any of these rights, contact us at support@mentio.pro.

We may need to verify your identity before responding to your request.

14. Complaints

If you have concerns about how we handle your personal data, we encourage you to contact us first at support@mentio.pro.

You may also lodge a complaint with the competent supervisory authority in the country where you live, work, or where the alleged infringement took place.

In Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection (CPDP):

15. Third-party services and links

The Site may contain links to third-party websites, services, or platforms. We are not responsible for the privacy practices of those third parties.

If you visit a third-party website or service, their privacy notice or policy will apply.

16. Children

The Site and services are not directed to children, and we do not knowingly collect personal data from children.

If you believe that a child has provided personal data to us, please contact us and we will take appropriate steps.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we do, we will update the “Last updated” date above. Where required by law, we will take additional steps to notify you of material changes.

18. Contact

If you have any questions about this Privacy Policy or our data practices, contact: