Privacy Policy

Last Updated: Nov 17 2025

Thank you for visiting the Privacy Policy of Mentessa GmbH. This Privacy Policy explains how Mentessa GmbH (collectively, “Mentessa GmbH”, “we”, “us”, or “our”) collects, uses, and shares information about you (“you”, “yours” or “user”) when you access or use our websites (“Services”).

Our data protection officer is heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, datenschutz@heydata.eu.

Please note: If you are looking for the GDPR Privacy Policy for the Mentessa technology platform, you can find it at mentessa.com/gdpr.

Users are responsible for any third-party data they provide or share through the Services and confirm that they have the third party’s consent to provide such data to us.

Log and Usage Information: such as browser type you use, hardware model, operating system, IP address, unique device identifiers, access times, pages viewed, links clicked, and browsing behavior such as time spent, what site you came from, what site you visit when you leave us, and browsing behavior.

We use information we collect about you to provide, maintain, and improve our Services and other interactions we have with you. For example, we use the information collected to:

• Facilitate and improve our online experience;
• Provide and deliver products and services, perform authentication, process transactions and returns, and send you related information, including confirmations, receipts, invoices, customer experience surveys, and product or Services-related notices;
• Process and deliver promotions;
• Respond to your comments and questions and provide customer service;
• If you have indicated to us that you wish to receive notifications or promotional messages;
• Detect, investigate and prevent fraudulent transactions and other illegal activities and protect our rights and property and others;
• Comply with our legal and financial obligations;
• Monitor and analyze trends, usage, and activities;
• Provide and allow our partners to provide advertising and marketing targeted toward your interests.

We may share your Personal Information in the following situations:

• Third Party Services Providers. We may share data with service providers, vendors, contractors, or agents who complete transactions or perform services on our behalf, such as those that assist us with our business and internal operations like shipping and delivery, payment processing, fraud prevention, customer service, gift cards, experiences, personalization, marketing, and advertising;
• Change in Business. We may share data in connection with a corporate business transaction, such as a merger or acquisition of all or a portion of our business to another company, joint venture, corporate reorganization, insolvency or bankruptcy, financing or sale of company assets;
• To Comply with Law. We may share data to facilitate legal process from lawful requests by public authorities, including to meet national security or law enforcement demands as permitted by law.
• With Your Consent. We may share data with third parties when we have your consent.
• With Advertising and Analytics Partners. See the section entitled “Advertising and Analytics” below.

We use Google Analytics, an analytics service provided by Google LLC. We use this service to help analyze how users use the Service, with a view to analyzing usage across devices and offering improvements for all users. To learn more about Google Analytics, please visit their Privacy Policy. To opt-out of this feature by installing the Google Analytics Opt-out Browser Add-on, please click here.

We implement commercially reasonable security measures designed to protect your information. Despite our best efforts, however, no security measures are completely impenetrable.

We store the information we collect about you for as long as necessary for the purpose(s) for which we collected it or for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

Individuals located in certain countries, including the European Economic Area (EEA) and the United Kingdom, have certain statutory rights under the General Data Protection Regulation (GDPR) in relation to their personal data.

To the extent information we collect is associated with an identified or identifiable natural person and is protected as personal data under GDPR, it is referred to in this Privacy Policy as “Personal Data”.

Data Subject Access Requests

Subject to any exemptions provided by law, you may have the right to request:

• a copy of the Personal Data we hold about you;
• to correct the Personal Data we hold about you;
• to delete your Account or Personal Data;
• to object to processing of your Personal Data for certain purposes;

If you would like us to remove all information we hold about you, you can submit a deletion request directly using the following link: Delete my data. Once we receive your request, we will process it promptly in accordance with applicable data protection laws and confirm the deletion by email.

We will generally process requests within one month. We may need to request specific information from you to help us confirm your identity and/or the jurisdiction in which you reside. If your request is complicated or if you have made a large number of requests, it may take us longer. We will let you know if we need longer than one month to respond.

Legal Bases For Processing Personal Data

We may process your Personal Data under applicable data protection law on the following legal grounds:

• Contractual Necessity: we may process your Personal Data to enter into or perform a contract with you.
• Consent: where you have provided consent to process your Personal Data. You may withdraw your consent at any time.
• Legitimate interest: we process your Personal Data to provide our Services to you such as to provide our online user experience, communicate with you, provide customer service, market, analyse and improve our business, and to protect our Services.

Our Service is intended for adults ages 18 years and above. We do not knowingly collect personally identifiable information from children. If you are a parent or legal guardian and think your child under 13 has given us information, please email or write to us at the address listed at the end of this Privacy Policy. Please mark your inquiries “COPPA Information Request.”

Mentessa GmbH may change this Privacy Policy from time to time. We encourage you to visit this page to stay informed. If the changes are material, we may provide you additional notice to your email address or through our Services. Your continued use of the Services indicates your acceptance of the modified Privacy Policy.

You can opt out of receiving our marketing emails and/or newsletters by contacting us as described under “Contact Us” below. We may still send you transactional messages, which include Services-related communications and responses to your questions.

Information we maintain may be stored both within and outside of the United States. If you live outside of the United States, you understand and agree that we may transfer your information to the United States, and that U.S. laws may not afford the same level of protection as those in your country.

If you have questions, comments, or concerns about this Privacy Policy, you may contact us at:

• https://www.mentessa.com/contact
• privacy@mentessa.com