| Operator | MM prosta spółka akcyjna (MM P.S.A.), a simple joint-stock company incorporated under Polish law, with its registered office in Warsaw, Poland |
|---|---|
| Address | ul. Przasnyska 2 lok. 8, 01-756 Warsaw, Poland |
| KRS | 0001253975 |
| NIP | 5253098322 |
| REGON | 545262117 |
| Contact | [email protected] | [email protected] | [email protected] | [email protected] |
| Version | 1.1 - legal and editorial status as at 14 July 2026; effective upon publication on the Platform |
| Controller MM prosta spółka akcyjna (MM P.S.A.) is the controller for the main Platform processes described in this Policy. Privacy enquiries may be sent to [email protected]. |
|---|
§ 1. Controller and scope
1. The controller of personal data processed in connection with MeetMentor is MM prosta spółka akcyjna (MM P.S.A.), with its registered office in Warsaw, address: ul. Przasnyska 2 lok. 8, 01-756 Warsaw, Poland, entered in the Register of Entrepreneurs under KRS number 0001253975.
2. Privacy contact: [email protected]. General contact: [email protected].
3. At the publication date, the Controller has not appointed a Data Protection Officer. If an appointment becomes legally required or is made voluntarily, the contact details will be published on the Platform.
4. This Policy supplements the Platform Terms, Mentor Terms, AI Mentor Terms, Cookie Policy and Community Standards. For personal-data matters, this Policy and any more specific layered notice for a particular function apply.
5. Where a Mentor or another party independently determines the purposes and means of processing, that party may be a separate controller and must provide its own information where required.
6. Where a third party processes data solely on the Controller's documented instructions, the relationship is governed by a data-processing agreement where required.
§ 2. Core principles
1. We process personal data lawfully, fairly and transparently and only for specified, explicit and legitimate purposes.
2. We seek to collect data that are adequate, relevant and limited to what is necessary for the relevant purpose.
3. We take reasonable steps to keep data accurate and up to date and enable Users to correct important information.
4. We retain data only for the period justified by the purpose, legal duties, security and the establishment, exercise or defence of claims.
5. We apply technical and organisational measures appropriate to the risk and review them as the Platform develops.
6. We do not sell User databases to advertisers as a standalone product.
7. Marketing consent, non-essential cookies, public image use and optional AI Mentor participation are separated from basic service acceptance where required.
8. Recordings, transcripts, messages and Session materials may contain sensitive or confidential information and are treated as higher-protection data.
§ 3. Categories of personal data
| Category | Examples |
|---|---|
| Identity and profile data | name, surname, company name, professional title, username, profile photo, image, voice, signature, Account identifiers |
| Contact data | email address, telephone number, correspondence address, country, preferred language |
| Account and authentication data | login, User ID, password hash, authentication method, settings, consent status, login history, security events |
| Order and transaction data | Orders, services, dates, Prices, payment status, refunds, invoices, complaints, chargebacks, User Balance, vouchers and referral codes |
| Mentor data | biography, qualifications, experience, categories, languages, availability, rates, reviews, tax residence, TIN, NIP, VAT status, bank account, settlement documents and reporting information |
| Communication data | messages, support correspondence, notices, reviews, comments, forms and attachments |
| Session data | video, audio, voice, image, chat, files, recordings, transcripts, notes, summaries, call metadata, attendance and quality information |
| Technical and usage data | IP address, device and browser data, operating system, logs, cookies, local-storage identifiers, analytics events, security signals and approximate location inferred from technical data |
| Marketing data | consents, objections, source of acquisition, preferences, campaign interactions and communication history |
| Compliance and verification data | identity documents, authority, age, professional licences, sanctions checks, KYC data, AML information and data required by tax, accounting, DAC7, DSA, payment or consumer rules |
| AI-related data | prompts, outputs, feedback, model interaction history, embeddings, annotations, safety flags and Mentor materials used under separate AI terms |
| Corporate benefit data | organisation, eligibility, budget allocation, administrative use and aggregated reporting information |
§ 4. Sources of data
1. We receive data directly from Users during registration, purchase, Mentor onboarding, support contact, Referral Programme participation, use of AI functions and Sessions.
2. Data are also generated automatically when the Platform is used, including logs, cookies, security tools, analytics events, payment status and technical metadata.
3. We may receive data from payment providers, login providers, communication and video tools, transcription and AI providers, accountants, lawyers, referral partners and public authorities where lawful.
4. For Mentors, information may be checked against public registers, websites, social-media profiles, publications, professional registers, sanctions lists and other sources reasonably needed to assess identity, qualifications and profile credibility.
5. A corporate customer may provide eligibility or administrative data for an employee-benefit programme. The organisation is responsible for having an appropriate legal basis for that disclosure.
6. A User who provides another person's data must have an appropriate legal basis and provide required information to that person unless an exemption applies.
§ 5. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Account creation, login, profile operation and User support | performance of a contract or steps requested before entering into a contract |
| Orders, Sessions, payments, User Balance, invoices, refunds and complaints | performance of a contract; legal obligation; legitimate interests in administration and claims |
| Mentor onboarding, profile publication and service delivery | contract with the Mentor; legitimate interests; legal obligations; licence or consent where required |
| Identity, age, professional, tax, payment and sanctions verification | legal obligation; contract performance; legitimate interests in safety, fraud prevention and compliance |
| Recording and transcription where selected and disclosed | contract performance; legitimate interests in proof, safety, quality and claims; consent where required by the specific purpose or law |
| Session summaries, notes and accessibility functions | contract performance or User request; legitimate interests; consent where required |
| Security, fraud prevention, abuse detection and enforcement | legitimate interests; legal obligation; establishment, exercise or defence of legal claims |
| Accounting, taxes, KSeF, DAC7 and regulatory reporting | legal obligation |
| Direct service communications | contract performance; legal obligation; legitimate interests |
| Email, SMS, telephone, push or other direct marketing | consent where required; legitimate interests only where applicable law permits and required safeguards are met |
| Analytics using non-essential cookies or similar technologies | consent where required |
| Public marketing using identifiable image, voice, private statements or Session excerpts | separate consent, licence or agreement |
| Creation and commercial operation of an AI Mentor | separate Mentor agreement or consent; contract performance; legitimate interests where appropriate and lawful |
| Training or fine-tuning commercial models on identifiable User data beyond necessary service provision | separate appropriate legal basis, generally explicit and granular consent or agreement where required |
| Aggregated and effectively anonymised statistics and product development | not personal-data processing after effective anonymisation; otherwise legitimate interests subject to safeguards |
| Legal claims, audits and dispute resolution | legitimate interests; legal obligation |
§ 6. Recordings, transcripts and AI
1. A Session is recorded or transcribed only where that mode is clearly indicated before the Session and, where technically possible, while the function remains active.
2. Recordings and transcripts may be used to deliver the selected service, create notes or summaries, handle complaints, prove performance, protect safety, prevent abuse, assess quality and establish, exercise or defend claims.
3. Public use of identifiable image, voice, statements or private Session excerpts for advertising, social media, case studies or PR requires a separate legal basis and, where required, a separate voluntary consent.
4. Creation of an AI Mentor using a Mentor's voice, image, communication style, knowledge and materials is governed by separate AI Mentor Terms or an individual agreement.
5. Client statements must not be used to train or fine-tune a commercial AI Mentor in identifiable form beyond necessary service provision without a separate appropriate legal basis and transparent information.
6. Where feasible and appropriate, data used for analytics, testing and model improvement are minimised, pseudonymised or anonymised.
7. AI systems may process prompts, outputs, feedback and safety signals. Users should avoid including unnecessary special-category data, third-party secrets or confidential information.
8. The Operator may use external AI and transcription providers as processors or independent providers, subject to appropriate agreements and international-transfer safeguards.
9. Consent may be withdrawn prospectively where processing relies on consent. Withdrawal does not affect processing already lawfully performed or processing based on another valid legal basis.
§ 7. Special-category data, criminal data and minors
1. The Platform does not generally require data revealing health, racial or ethnic origin, political opinions, religion, trade-union membership, genetic or biometric identifiers, sex life or sexual orientation.
2. Users should not disclose special-category data unless it is genuinely necessary for the selected service and there is an appropriate legal basis. The Operator may remove or restrict unnecessary data.
3. Criminal-conviction and offence data are processed only where authorised by law and necessary for a specific safety, verification or legal process.
4. For Users aged 16 or 17, the Operator may require parental or guardian consent or another legally valid basis depending on the country and function.
5. Users under 16 may participate only through a parent or guardian under the Platform Terms and should not independently provide data through an Account.
6. The Operator may use age-assurance or verification measures proportionate to the relevant risk and must not use more data than reasonably necessary.
7. Where a Mentor serves minors, additional safeguarding, limited data access, recording restrictions and parental or guardian controls may apply.
§ 8. Recipients and service providers
1. Data may be disclosed to hosting, cloud, database, cybersecurity, email, SMS, push-notification, payment, video, communication, transcription, AI, CRM, analytics, customer-support, accounting, legal and tax providers.
2. Providers acting on our instructions receive only the data reasonably required for their tasks and are subject to contractual confidentiality, security and data-protection duties.
3. Client data are shared with a Mentor only to the extent necessary to perform the selected service and comply with law.
4. Data may be disclosed to banks, payment providers, insurers, professional advisers, auditors, courts, regulators, tax authorities, law-enforcement bodies or other public authorities where legally required or necessary for claims and protection of rights.
5. Data may be disclosed in a merger, investment, financing, restructuring, acquisition or sale process subject to confidentiality and legal safeguards.
6. We do not provide advertisers with a standalone database of identifiable Users for their independent unrestricted marketing.
7. The current categories of important providers and any specific provider information required by law may be made available in the Platform, consent interface or a layered privacy notice.
§ 9. International data transfers
1. Some providers or infrastructure may process data outside the European Economic Area or allow access from another country.
2. Transfers are made using a mechanism permitted by data-protection law, including an adequacy decision, standard contractual clauses, binding corporate rules, a statutory derogation or another valid safeguard.
3. Where appropriate, we assess transfer risks and implement supplementary technical, contractual or organisational measures.
4. A copy of relevant safeguards or information about them may be requested through the privacy contact, subject to protection of confidential and security information.
5. The location of a Mentor or Client may itself result in an international disclosure when information necessary for a cross-border Session is shared with that person.
6. The Platform may restrict a provider, country or function where an appropriate transfer mechanism or security level cannot be maintained.
§ 10. Retention periods
| Data or process | Indicative retention approach |
|---|---|
| Account and profile data | for the duration of the Account and thereafter for the period needed for legal obligations, claims, security and abuse prevention |
| Orders, invoices, tax and accounting records | for the period required by tax, accounting and commercial law, including any extended period resulting from proceedings |
| Payment and settlement records | for the contract, payment-provider requirements, chargebacks, claims and legal retention duties |
| Complaints, disputes and enforcement records | until final resolution and expiry of relevant limitation periods, plus any legally justified archive period |
| Recordings and transcripts | for the period stated for the selected function or notice and no longer than necessary for service, complaints, safety, quality or claims; optional AI use follows separate terms |
| Support correspondence | for the time needed to resolve the matter and protect claims |
| Marketing data | until consent is withdrawn, an objection is upheld or the purpose ends, with limited suppression records retained to respect opt-outs |
| Cookie and analytics data | according to the Cookie Policy, consent settings and provider configuration |
| Verification and compliance data | for the period required by law, provider rules, fraud prevention, sanctions and claims |
| Backups | for a limited rolling backup cycle, after which data are overwritten or securely deleted unless preservation is legally required |
§ 11. Data-subject rights
1. Subject to applicable conditions, a person may request access to personal data and information about processing.
2. A person may request correction of inaccurate data and completion of incomplete data.
3. A person may request erasure where the legal conditions are met. Erasure may be refused or limited where retention is required by law, claims, security or another valid basis.
4. A person may request restriction of processing in the cases provided by law.
5. A person may receive data supplied to the Controller in a structured, commonly used and machine-readable format and request transmission to another controller where the portability right applies.
6. A person may object, on grounds relating to the person's situation, to processing based on legitimate interests, and may object at any time to direct marketing.
7. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
8. Where applicable, a person may request human intervention, express a position and contest a decision based solely on automated processing that produces legal or similarly significant effects.
9. Requests may be sent to [email protected]. We may request proportionate information to verify identity and protect data from unauthorised disclosure.
10. A person may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or another competent supervisory authority in the person's country where applicable.
11. Rights are exercised free of charge unless a request is manifestly unfounded or excessive and law permits a reasonable fee or refusal.
§ 12. Profiling and automated decision-making
1. The Platform may use profiling for Mentor recommendations, search ordering, personalisation, safety, fraud detection, analytics and marketing.
2. Main recommendation factors may include language, category, location, availability, Price, ratings, activity, previous interactions and stated preferences.
3. We do not generally make decisions based solely on automated processing that produce legal or similarly significant effects for a User unless a lawful basis, required information and safeguards are provided.
4. Fraud and safety systems may automatically flag, delay or route a transaction or Account for review. Material restrictions are subject to human review or appeal where required by law.
5. Where AI or algorithms materially affect Mentor ranking or visibility, the main parameters are described in the Platform Terms, Mentor Terms, panel or a specific notice.
6. Users may contact us for information on significant automated processing and applicable rights.
§ 13. Marketing and electronic communications
1. Service messages concerning Accounts, Orders, payments, security, complaints and legal updates are sent because they are necessary for contract performance, legal duties or legitimate administration.
2. Marketing by email, SMS, telephone, push notification or similar channels is conducted with the consent or other legal basis required by the law applicable to that channel and recipient.
3. A User can withdraw consent or opt out using Account settings, a message link or the relevant contact channel.
4. We may maintain a limited suppression record after opt-out so that the preference is respected.
5. Marketing analytics may use consented cookies or similar technologies as described in the Cookie Policy.
6. Separate consent is required where identifiable image, voice, private statements or Session excerpts are used publicly beyond the basic profile and Offer promotion agreed with a Mentor.
§ 14. Cookies and similar technologies
1. The Platform uses cookies, local storage, pixels, tags, SDKs and similar technologies for essential operation, preferences, analytics, security and marketing.
2. Technologies strictly necessary to provide a service requested by the User may be used without additional consent where law permits.
3. Analytics, marketing and other non-essential technologies are activated only after the required consent and in accordance with the User's choices.
4. The User can change consent through the consent-management interface and may also use browser or device settings.
5. Further details, provider information, purposes and indicative retention periods are set out in the Cookie Policy and current consent panel.
§ 15. Security and personal-data breaches
1. We use technical and organisational measures proportionate to risk, which may include access control, encryption in transit, secure authentication, logging, backups, environment separation, least-privilege access, monitoring, provider reviews and incident procedures.
2. No system is completely risk-free. Users should use strong unique passwords, protect devices, avoid sharing credentials and report suspicious activity promptly.
3. We assess suspected personal-data breaches and document the assessment and response.
4. Where required, a breach is notified to the competent supervisory authority without undue delay and, where applicable, within the statutory period.
5. Where a breach is likely to create a high risk to individuals, affected persons are informed without undue delay unless a lawful exception applies.
6. Mentors, providers and corporate customers must promptly report incidents affecting data received through MeetMentor and cooperate with investigation and mitigation.
§ 16. Third-party websites, integrations and public information
1. The Platform may contain links, embedded content, login integrations or services controlled by third parties. Their own privacy policies apply to their independent processing.
2. A Mentor may provide links to external websites or profiles. The Operator is not the controller of independent processing on those services.
3. Information made public by a User may be indexed by search engines, shared by others and remain in third-party caches after removal from the Platform.
4. Users should review third-party privacy information before sending data through an external service.
5. The Operator may disable an integration or link that creates an unacceptable security, legal or privacy risk.
§ 17. Changes and contact
1. This Policy may be updated because of legal, technical, organisational, provider or service changes.
2. Material changes are communicated through the Platform, Account or email where required and are not used to retroactively legitimise processing that required a separate legal basis.
3. The current version and effective date are published on the Platform, and archived versions may be retained for accountability.
4. Questions and rights requests should be sent to [email protected]. General enquiries may be sent to [email protected].
5. The English version is intended for Users who choose English. Where another language version is accepted, that version and any applicable mandatory law are taken into account when interpreting the information supplied to the person.