Privacy Policy

Last updated: 14 October 2026

1. Who we are and how to contact us

SellerMentor is the trading name of [Legal entity name], registered at [Registered address], company registration number [Company registration number], VAT number [VAT number]. This entity is the controller of personal data collected through our website, event landing pages and business enquiries. Privacy contact: [Privacy contact or data protection officer, if applicable]. EU representative: [EU representative details, if required]. UK representative: [UK representative details, if required].

For all privacy requests, contact info@mentoramazon.com. This policy covers our public website and client/admin access. Where we process client or marketplace data solely on a client's instructions, the applicable service agreement and data processing agreement also govern that processing.

2. Personal data we collect

  • Contact enquiries: name, email address, company, phone number where provided, message and source page.
  • Event and landing leads: full name, company, work email, optional service interest, selected language, UTM campaign parameters, referrer and device/browser user agent. We use this information to handle your request and, where appropriate, understand its business context.
  • Newsletter: email address, subscription source and records of consent or unsubscribe where a newsletter service is operational.
  • Admin and client portal accounts: email, profile name, company, optional avatar, authentication identifiers and account/access information. Passwords are handled by our authentication provider, not stored in readable form by us.
  • Technical and security information: request times, network/IP information in operational logs where collected by our providers, browser information, errors and security/rate-limit records. Our anonymous cookie-consent table does not store IP addresses.
  • Cookies and browser storage: consent choices, requested language preferences and secure sign-in storage, described in Cookie Preferences.

Do not send sensitive personal data or personal information about others unless it is necessary, lawful and agreed with us. Providing requested contact details is necessary for us to respond; optional fields may be left blank. We do not obtain personal data from data brokers.

3. Purposes and lawful bases

We process enquiries and arrange meetings to take steps at your request before entering a contract (GDPR Article 6(1)(b)) where the request concerns you personally. For corporate representatives and other B2B enquiries, we rely on our legitimate interests in answering relevant business requests and maintaining professional relationships (Article 6(1)(f)), balanced against your rights and reasonable expectations. Submitting a business enquiry does not subscribe you to a newsletter or grant cookie consent.

We administer client access and deliver agreed services on the basis of contractual necessity or our legitimate interests in managing corporate customer relationships. We secure accounts, investigate abuse and maintain proportionate technical records based on legitimate interests. We process legally required records under legal obligations (Article 6(1)(c)).

Optional analytics and marketing technologies require your prior consent (Article 6(1)(a) and applicable electronic communications rules). Newsletter communications require your separate consent; you can unsubscribe at any time. If we introduce a different purpose, we will assess its lawful basis and provide appropriate notice or obtain consent before doing so.

4. Recipients and service providers

Access is limited to authorised staff and service providers who need it for the stated purposes. Hosting, development and database/authentication providers may include Lovable and Supabase. Email providers, if configured, support business correspondence and subscriptions. Analytics or advertising providers may receive information only after the relevant consent and when those services are actually enabled. Current technologies are listed in Cookie Preferences.

Providers are subject to appropriate confidentiality, security and processing arrangements. We may disclose information to professional advisers, authorities where legally required, or parties to a genuine business restructuring with suitable safeguards. We do not sell personal data or share it for cross-context behavioural advertising. Marketplace brands displayed on the website do not automatically receive your enquiry.

5. International transfers

Our business and providers may process information outside the EEA, UK or Türkiye, including in the United States. Where required, we use recognised adequacy decisions, European Commission Standard Contractual Clauses with supplementary measures as appropriate, and the UK International Data Transfer Agreement or UK Addendum. For transfers subject to Türkiye's KVKK, we use an applicable lawful transfer mechanism. US adequacy arrangements are relied on only for recipients and processing covered by a valid certification. Contact us for details or a copy of relevant safeguards, with confidential material redacted where necessary.

6. Retention

  • Enquiries and event leads: up to 24 months after the last contact, unless a contract follows or a justified legal need requires a different period.
  • Newsletter details: until you unsubscribe or withdraw consent; a minimal suppression record may be kept where necessary to honour your opt-out.
  • Technical server logs: up to 30 days, except records needed to investigate a security incident, comply with law or defend a claim.
  • Consent decisions: up to 13 months, or longer only where required to demonstrate compliance or handle a specific legal claim. Browser choices expire after six months and are renewed when the policy version changes.
  • Account and contract data: for the active relationship, followed by [Applicable statutory accounting and contract retention period] where legally required. Inactive accounts are reviewed for deletion.

We delete or anonymise data when it is no longer needed. Backups may retain restricted copies until their normal rotation. The owner must confirm provider log, backup and operational deletion settings against these periods before finalising this policy.

7. Security

We use proportionate measures such as encrypted transport, access controls, role-based permissions, authentication, restricted administrative access and provider security safeguards. Access is limited to those with a legitimate need. No system is completely secure; please report suspected security or privacy incidents to info@mentoramazon.com and avoid sending passwords through contact forms.

8. Your rights and how to exercise them

Depending on the applicable law and processing, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may object to direct marketing at any time. You can withdraw consent without affecting processing lawfully carried out before withdrawal. Use Cookie Preferences for cookie consent and newsletter unsubscribe controls for subscriptions.

Email info@mentoramazon.com with your request and sufficient details to identify the relevant interaction or account. We may ask for proportionate identity verification and will not request excessive information. We aim to reply within 30 days; GDPR/UK GDPR requires a response within one month. If a lawful extension is necessary for a complex request, we will explain the reason and timing within the initial period. Requests are generally free, subject to lawful exceptions for manifestly unfounded or excessive requests. Some rights are subject to legal exemptions.

We do not use your website enquiries to make solely automated decisions producing legal or similarly significant effects.

9. Complaints

You can complain to the supervisory authority where you live, work or where an alleged infringement occurred. Examples include the CNIL in France, your local EU data protection authority, and the ICO in the UK. We welcome the opportunity to address concerns first, but you do not have to contact us before complaining.

10. Türkiye and California residents

For processing covered by Türkiye's Law No. 6698 (KVKK), you may have rights to learn whether your data is processed, obtain information on processing, know its purposes and recipients, request correction or deletion where conditions are met, request notification to recipients, object to certain automated outcomes, and seek compensation for unlawful processing. Apply to info@mentoramazon.com; statutory application and escalation procedures, including the Turkish Personal Data Protection Authority, remain available. Processing and transfers are subject to the lawful bases and safeguards required by KVKK.

If the CCPA/CPRA applies to our activities, California residents may request access/knowledge, correction and deletion of covered personal information and exercise rights relating to sale or sharing, without unlawful discrimination. We do not sell or share personal information for cross-context behavioural advertising and do not use sensitive personal information to infer characteristics. The categories, purposes and recipient types are described above. You may use an authorised agent with appropriate verification. We honour applicable opt-out preference signals, including Global Privacy Control where required; a signal is never treated as permission to track. California requests receive a response within applicable statutory periods (generally 45 days), subject to lawful extensions.

11. Business contacts and children

This site is intended for business representatives, but professional contact information can still be personal data and remains protected. It is not directed at children under 16 and we do not knowingly solicit their data. If you believe a child has submitted information, please contact us for review and appropriate deletion.

12. Changes to this policy

We may update this policy when our services, providers or legal requirements change. The date above identifies the latest revision. Material changes will be communicated where appropriate; a cookie-policy version change prompts a fresh consent choice.

This is a draft for owner review. Bracketed company details and operational retention/provider arrangements must be confirmed before the text is final.