When we collect personal data directly from Customer representatives (e.g., for account setup, billing, or support), we act as the data controller, determining the purposes and means of processing. However, when we process personal data on behalf of a Customer (e.g., data of Authorized Users uploaded or generated through the Platform), we act as a data processor, following the Customer's instructions. In such cases, the Customer is the data controller responsible for ensuring lawful processing, and a data processing agreement (DPA) compliant with Article 28 of the GDPR will be incorporated into our Terms and Conditions ("Terms").

If you are an Authorized User, your personal data is primarily controlled by your employer (the Customer). You should refer to their privacy policies for primary details on how they handle your data. This Policy focuses on our processing activities. We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

This Policy uses a layered approach where possible, providing key information upfront with links or expansions for more details. We reserve the right to update this Policy at any time by posting the revised version on the Platform or notifying Customers via email. Changes will take effect 3 days after notice, unless a shorter period is required for legal reasons. Your continued use of the Platform after such changes constitutes acceptance.

Terms defined in our Terms of Service have the same meaning here, including "Personal Data", "Customer Data", "Authorized Users", "Content", and "Platform". Additional definitions:

We only collect Personal Data that is necessary for providing the Platform and related services. We do not collect Special Category Data unless it is explicitly included in Content uploaded by the Customer, in which case the Customer (as controller) must ensure a lawful basis exists, such as explicit consent or employment-related processing. The categories of Personal Data we collect include:

We minimize data collection and do not require individuals to provide Personal Data under statutory or contractual obligations unless specified by the Customer (e.g., for mandatory training). If data is not provided, certain Platform features may be unavailable, such as course access.

We collect Personal Data through the following methods:

We process Personal Data only for specified, explicit, and legitimate purposes. Below is a table linking the purposes of processing, the categories of Personal Data involved, and the applicable legal bases. Where we act as processor, processing is strictly per Customer instructions according to Terms and Conditions.

For any Special Category Data in Content, we do not process such data independently. You have the right to object to processing based on legitimate interests (see Section 8). Where consent is relied upon, it can be withdrawn at any time via [email protected], and withdrawal is as easy as giving consent.

We share Personal Data only when necessary and with appropriate safeguards:

5.1 With Sub-Processors: We use trusted third-party providers for services like cloud hosting (e.g., AWS), payment processing (e.g., PayPal), and AI services (e.g., OpenAI, Gemini). By using the Mentora LMS Platform you agree to be bound by Sub-processors' Terms and Privacy Policies. A current list of sub-processors is available upon request at [email protected].

5.2 With Affiliates: For internal administrative purposes, limited to entities under common control and subject to this Policy.

5.3 For Legal Reasons: To comply with laws, respond to court orders, or protect rights, property, or safety (e.g., in legal disputes).

5.4 In Business Transfers: If we undergo a merger, acquisition, or asset sale, Personal Data may be transferred to the acquiring entity, with notice provided where required.

5.5 International Transfers: Personal Data may be transferred to countries such as the US for certain sub-processors.

We do not sell or rent Personal Data.

We implement technical and organizational measures to secure Personal Data against unauthorized access, loss, alteration, or destruction. These include:

While we take all reasonable steps, no system is infallible. In the event of a personal data breach likely to result in high risk to individuals' rights, we will notify affected Data Subjects without undue delay.

We retain Personal Data only as long as necessary for the purposes outlined, or as required by law. Specific criteria and examples include:

Upon Subscription termination, we delete or return all Customer Data within 30 days, except for legally required backups (retained up to 6 months, inaccessible for other uses). Anonymized aggregates may be kept indefinitely for statistical purposes. For precise retention per data type, contact [email protected].

Authorized Users have the following rights regarding their Personal Data. These may be limited if we act as processor (in which case, contact your Employer first):

To exercise these rights, email [email protected] with details of your request. We may require identity verification. Responses are free unless requests are manifestly unfounded or excessive.

We use only essential cookies for core Platform functionality, such as session management and authentication. These are strictly necessary and do not require consent. No non-essential cookies (e.g., for advertising or third-party tracking) are used.

The Platform is designed for professional use and not intended for individuals under 18 years old. We do not knowingly collect Personal Data from children. If we become aware of such data, we will delete it immediately and notify the Customer.

The Platform may contain links to third-party websites or services (e.g., PayPal, OpenAI). We are not responsible for their privacy practices. Review their policies before interacting with the Mentora LMS Platform.

This Policy is governed by the laws of England and Wales. Any disputes will be resolved in accordance with our Terms.