This Privacy Policy explains what personal data SIA “Orbis Mentor” processes when you visit orbismentor.com, create an account, apply as a Mentor, book or conduct Sessions, make payments or contact us; why we do it; who receives the data; how long we keep it; and what rights you have. Capitalised terms have the meaning given in the Terms of Use.
1. Controller and Contact
1.1. The controller of your personal data is SIA “Orbis Mentor”, registration No. 40203722827, registered office: Māras iela 12-2, Mārupe, Mārupes novads, LV-2167, Latvia (“Orbis Mentor”, “we”).
1.2. For any question about personal data or to exercise your rights, write to info@orbismentor.com or contact Support on the Platform.
1.3. Stripe processes the identity, bank and payment data that you enter in the Stripe environment under its own privacy policy and regulatory obligations. For that processing Stripe is a separate controller.
1.4. A Mentor receives only the Mentee data needed to administer the Booking and conduct the Session. Under the Mentor Agreement, the Mentor may use it only for that mentoring relationship, to comply with legal obligations and to establish, exercise or defend legal claims, and is responsible for their own use of that data.
2. Personal Data We Process
| Category | What it includes |
|---|---|
| Account data | name, email address, password (stored only as a one-way hash), role, interface language, country, time zone, account status and email confirmation. |
| Sign-in and security data | IP address, browser and device information (user agent), time and result of sign-in attempts, active sign-in sessions and one-time sign-in codes. |
| Mentor application and profile | name, photograph, greeting video, headline, description, experience, city and country, languages, topics and tags, Offerings, prices, availability, application answers and moderation decisions. |
| Bookings and Sessions | Bookings, Packages and Session credits, dates and times, cancellations, Session status and technical participation facts, such as when a participant joined and left the room. |
| Payments, Membership and Payouts | amounts, currency, payment and refund status, chargebacks, payment documents, Stripe customer, payment and account identifiers, Membership status, Mentor earnings and Payouts. We do not receive or store full payment card details. |
| Tax reporting data (Mentors) | where required under DAC7 or other tax information-exchange rules: name, address, date of birth, tax identification number and the country that issued it, VAT number, financial account identifier, earnings, fees and number of transactions. |
| Reviews and Content | ratings, review texts and other Content you publish on the Platform. |
| Support and communication | support requests and messages, including requests sent without an account (name and email address), and a record of the emails we send you (type, time and delivery status). |
| Consents and acceptances | which version of a legal document you accepted and when, with the IP address and browser at that moment; your cookie choices; your newsletter consent. |
| Marketing and visit source | only with your consent: advertising campaign tags (UTM), the referring site and the first page of your visit; and your answer to “How did you hear about us?” if you give one. |
| Analytics | only with your consent: pages viewed, device and browser data, approximate location and pseudonymous identifiers collected by Google Analytics. |
2.2. Most of this data comes from you. Some of it is created by the Platform (for example, Booking and Session records), received from Stripe (payment and verification statuses) or received from the other participant of a Booking.
2.3. Orbis Mentor is a mentoring and experience-exchange platform, not a therapy, medical or psychological service. Please do not include health data or other special categories of personal data in your profile, reviews or support messages.
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR Article 6(1)) |
|---|---|
| Creating and running your account, sign-in and security codes | performance of a contract (b) |
| Reviewing Mentor applications, moderating and publishing Mentor profiles and Offerings | performance of a contract (b); legitimate interests in a safe and trustworthy Platform (f) |
| Bookings, Packages, video Sessions, reminders and Session status | performance of a contract (b) |
| Payments, refunds, payment documents, Membership and Payouts | performance of a contract (b); legal obligation under accounting and tax law (c) |
| Tax reporting under DAC7 and other mandatory reporting | legal obligation (c) |
| Preventing fraud and misuse, protecting accounts, sanctions and anti-money-laundering compliance under the Fraud Prevention Policy | legitimate interests (f); legal obligation where a report to the authorities is required (c) |
| Support, complaints and dispute review | performance of a contract (b); legitimate interests in establishing, exercising or defending legal claims (f) |
| Publishing reviews and ratings | performance of a contract (b); legitimate interests in reliable reviews (f) |
| Transactional and service emails | performance of a contract (b) |
| Newsletter and marketing emails | consent (a) |
| Analytics and visit-source measurement | consent (a) |
| Aggregated statistics for running and improving the Platform | legitimate interests (f) |
| Responding to lawful requests of authorities and courts | legal obligation (c) |
3.2. Where we rely on legitimate interests, we have weighed them against your interests and rights. You may object to such processing (Section 9).
3.3. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Stripe may screen payments automatically under its own terms.
4. What Other Users See
4.1. A published Mentor profile, including the name, photograph, greeting video, description, Offerings, prices and reviews, is visible to everyone, including Visitors.
4.2. Reviews are published on the Mentor’s profile with the reviewer’s shortened name (for example, “Sara M.”).
4.3. A Mentor sees the Mentee’s name and the Booking details needed for the Session. During a Session, the participants see and hear each other in real time.
5. Video Sessions
5.1. Video Sessions run on servers operated for Orbis Mentor in the European Union. Audio and video are transmitted in real time and are not recorded by the Platform.
5.2. To check attendance and review disputes, the Platform stores technical facts about a Session, such as when each participant joined and left the room, but not the content of the conversation.
5.3. A participant may not record a Session without the other participant’s prior consent (Terms of Use, Section 10).
6. Recipients of Personal Data
| Recipient | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Purposehosting of servers, databases, file storage and backups | LocationGermany and Finland (EU) |
| Stripe Payments Europe, Limited | Purposepayments, subscriptions, refunds, Payouts and Mentor identity verification | LocationIreland (EU); Stripe may also process data in the USA |
| Sendinblue SAS (Brevo) | Purposedelivery of transactional and service emails | LocationFrance (EU) |
| The Rocket Science Group LLC (Mailchimp) | Purposethe newsletter, only if you have subscribed | LocationUSA |
| Google Ireland Limited | PurposeGoogle Analytics, only with your consent | LocationIreland (EU); data may be processed in the USA |
6.2. Other Users receive data as described in Section 4.
6.3. We disclose data to the State Revenue Service of Latvia (tax and DAC7 reporting), the Financial Intelligence Unit of Latvia (suspicious transaction reports), courts, law enforcement and other authorities where the law requires it, and to our legal, accounting and audit advisers, who are bound by confidentiality.
6.4. We do not sell personal data.
7. Transfers Outside the EEA
7.1. We store your data in the European Union. Data leaves the European Economic Area only when a recipient listed in Section 6 processes it outside the EEA.
7.2. Such transfers rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified companies, or on the European Commission’s standard contractual clauses. You may request information about these safeguards at info@orbismentor.com.
8. How Long We Keep Data
| Data | Retention period |
|---|---|
| Account and profile data | while your account exists; after a deletion request, once outstanding Bookings, refunds and Payouts are settled, we erase it within 30 days, except data that we must keep by law |
| Sign-in sessions | up to 30 days |
| One-time sign-in codes | 10 minutes |
| Sign-in history (IP address, browser) | 90 days |
| Cookie consent records | 13 months |
| Bookings, payments, refunds, payment documents, Payouts and Membership payments | for the periods required by Latvian accounting and tax law; after your account is erased, without your name and contact details |
| Tax reporting data (DAC7) | for the period required by tax law |
| Support requests | while needed to handle the request and related claims; erased together with your account unless the law requires us to keep them |
| Reviews | while published; when your account is erased, the text is deleted and only the rating remains, without your name |
| Records of actions on the Platform (audit log) | at least 12 months; personal data in them is removed when your account is erased |
| Visit-source cookie | 90 days; the source recorded with your account is kept while the account exists |
| Newsletter subscription | until you unsubscribe or withdraw consent |
| Google Analytics data | no longer than 14 months |
| Backups | overwritten on a rolling basis within 30 days |
9. Your Rights
9.1. Under the GDPR you have the right to access your data and receive a copy of it; to have inaccurate data corrected; to have data erased; to restrict processing; to receive the data you provided in a machine-readable format and have it transmitted to another controller; to object to processing based on legitimate interests and, at any time, to direct marketing; and to withdraw consent at any time without affecting the lawfulness of earlier processing.
9.2. You can correct most data in your account and request account deletion there. For other requests, write to info@orbismentor.com or contact Support. We may ask you to confirm your identity.
9.3. We reply within one month. If a request is complex or there are many requests, this period may be extended by two further months; in that case we will tell you why.
9.4. Some rights are limited by law. For example, we cannot erase data that we must keep under accounting or tax law or that is needed to establish, exercise or defend legal claims.
9.5. You can withdraw cookie consent with the “Cookie settings” button at the bottom of every page, and unsubscribe from the newsletter with the link in every newsletter email.
9.6. You may lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv) or with the supervisory authority of the EU country where you live or work. We encourage you to contact us first so that we can try to resolve the matter.
10. Is Providing Data Required?
10.1. Data marked as required in forms is needed to conclude and perform the contract. Without an email address we cannot create an account, and without Stripe verification a Mentor profile cannot be published or receive Payouts.
10.2. Data processed on the basis of consent (analytics, visit source and the newsletter) is optional, and refusing it does not limit your use of the Platform.
11. Cookies
11.1. We use cookies and similar technologies as described in the Cookie Policy. Analytics and marketing cookies are used only with your consent.
12. Security
12.1. We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), passwords stored only as one-way hashes, role-based staff access, logging of staff actions, hosting in EU data centres and regular backups.
12.2. We notify the Data State Inspectorate of a personal data breach where the GDPR requires it, and inform you without undue delay if a breach is likely to result in a high risk to your rights and freedoms.
13. Age Limit
13.1. The Platform is intended for persons aged 18 or over (Terms of Use, Section 4). We do not knowingly collect data of younger persons. If you believe that such a person has given us data, contact us and we will delete it.
14. Changes to This Policy
14.1. We may update this Policy when the law, the Platform’s functions or our recipients change. The current version and its effective date are published on the Platform. We will inform you of material changes by email or on the Platform.
14.2. Where this Policy is available in several languages, the Latvian version prevails in the event of any discrepancy in interpretation, unless mandatory law provides otherwise.