Last updated: April 2026 · Effective: April 2026
This Privacy Policy explains how Mentorship.world collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).
Identity: Iron Sea
NIE: Y5050888X
Trading as: Mentorship.world
Address: Gijón, Asturias, España
Country of establishment: Kingdom of Spain
Contact: info@mentorship.world
As Data Controller, we determine the purposes and means of processing your personal data. We have not appointed a Data Protection Officer (DPO) as we do not meet the thresholds requiring mandatory appointment under Art. 37 GDPR. Privacy enquiries should be directed to info@mentorship.world.
We process personal data on the following legal bases under Art. 6 GDPR:
| Category of data | Data collected | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Account data | Name, email, role (mentor/mentee) | Art. 6(1)(b) — performance of contract | Duration of account + 30 days after deletion request |
| Mentor profile data | Professional title, bio, location, credentials, LinkedIn URL, Loom video, photo | Art. 6(1)(b) — performance of contract; Art. 6(1)(a) — consent (public display) | Duration of account |
| Booking & session data | Session date/time, duration, notes, booking status | Art. 6(1)(b) — performance of contract | 7 years (legal/financial obligation) |
| Payment data | Transaction IDs, amounts, Stripe customer/payment intent IDs (no card numbers stored) | Art. 6(1)(c) — legal obligation (tax/accounting); Art. 6(1)(b) — contract | 7 years (Art. 30 Spanish Commercial Code) |
| Credential documents | Uploaded STCW CoC, flag state letters, and supporting documents | Art. 6(1)(b) — contract (vetting process) | Duration of approved status; rejected applicants: 90 days then deleted |
| Technical/usage data | IP address, browser type, pages visited, server logs | Art. 6(1)(f) — legitimate interest (security, fraud prevention, platform improvement) | 90 days |
| Reviews | Star rating, written comment, reviewer name | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest (platform trust) | Duration of mentor account |
We do not process special categories of personal data (Art. 9 GDPR) such as health, biometric, or political data. We do not process data relating to children under 16 years of age. The Platform is not directed at persons under 18.
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR). Mentor approval decisions are made by a human reviewer.
We share personal data with the following processors who act under our instructions. Where data is transferred outside the European Economic Area (EEA), we rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission under Art. 46(2)(c) GDPR, or on adequacy decisions where applicable.
| Processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU (West EU region) | Within EEA — no transfer |
| Stripe Inc. | Payment processing, Stripe Connect payouts | USA / EU | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Brevo (Sendinblue SAS) | Transactional email delivery | USA | Standard Contractual Clauses |
| Vercel Inc. | Web hosting and infrastructure | USA / EU edge | Standard Contractual Clauses |
| Meta Platforms Ireland Ltd. (WhatsApp) | Operational communication with mentors (where WhatsApp number provided) | Ireland / USA | Standard Contractual Clauses |
We do not sell, rent, or share your personal data with any other third parties for their own purposes.
Approved mentor profiles — including name, location, professional title, bio, specializations, certifications, and profile photo — are publicly visible on the Platform and may be indexed by search engines. You may update or withdraw publicly visible information at any time from your mentor dashboard. Withdrawal of consent for public display will make your profile invisible to new mentees but will not affect historical booking records.
We use only strictly necessary session cookies required for authentication and security (ePrivacy Directive Art. 5(3) exemption). We do not use analytics cookies, advertising cookies, or any third-party tracking technologies. No cookie consent banner is required as we do not use non-essential cookies.
You have the following rights regarding your personal data. To exercise any right, email info@mentorship.world with your request. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice).
You have the right to lodge a complaint with a supervisory authority. In Spain, the competent authority is:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid
www.aepd.es
You may also lodge a complaint with the supervisory authority of your EU member state of habitual residence or place of work.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including HTTPS encryption, database access controls, and role-based permissions. In the event of a personal data breach likely to result in high risk to your rights, we will notify you without undue delay as required by Art. 34 GDPR.
We may update this policy to reflect changes in our practices or applicable law. We will publish the updated version on this page with a new effective date. For material changes affecting your rights, we will provide notice by email at least 30 days before the change takes effect. Continued use of the Platform after the effective date constitutes acceptance.
For all privacy and data protection enquiries: info@mentorship.world