Data protection
Data Protection at Mentessa
Secure, transparent, GDPR-compliant. We process all data in accordance with the EU General Data Protection Regulation (GDPR) and host it securely in Germany.
Privacy Policy
This privacy policy applies to data processing by Mentessa GmbH, (“Mentessa”/“we”/“us”/”our”). Our contact details are c/o Wayra Germany, Kaufingerstrasse 15, 80331 Munich, Germany. We provide a platform for peer-to-peer learning and knowledge exchange as further described in our Terms of Use (“Mentessa Platform”). Any processing of your data within the scope of the Mentessa Platform is carried out exclusively in accordance with the following privacy policy.
Our data protection officer is heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, datenschutz@heydata.eu.
- I. How we collect and process your Technical Data
- II. How we collect and process your Usage Data
- III. How we collect and process your Customer Data
- IV. How we collect and process your Content Data
- V. How we use “Cookies”
- VI. Your obligation to provide data
- VII. We do not transfer personal data to third countries
- VIII. The relationship between you, the Customer, and Mentessa
- IX. When we disclose your data to third parties
- X. How we process your data when you use the Social Login
- XI. Your right to object data processing
- XII. Further rights you have as a data subject
As with most technology services delivered over the Internet, our servers automatically collect information when you access or use the Mentessa Platform and store this information temporarily in so-called log files (“Technical Data”).
Technical Data include especially the IP-address and name of the access-provider, the address of the web page that you visited before using the Mentessa Platform, the operating system, the browser type and settings, information about browser configuration and plugins and language preferences. This data is processed by us to ensure a smooth connection and a comfortable use of the Mentessa Platform, to analyse the security and stability of the Mentessa Platform and for other administrative and statistical purposes.
The legal basis for processing Technical Data is our legitimate interest resulting from the need to provide a convenient and user-friendly online service. The collected data will in no case be used to draw any conclusion to your identity. The data is deleted when it is not required for the mentioned purposes anymore and no other legal grounds for processing the data apply.
We collect usage data when you use the Mentessa Platform, such as when you view or click on content, perform a search or share content or otherwise interact with the Mentessa Platform (“Usage Data”). Usage Data include especially the type of shared content, number of communities you use, number of your contacts, type of your search requests and the time and extent of your interactions.
In order to better understand how our service is used and to better tailor our service to the needs and desires of our users, we analyse pseudonymized data about our users’ use of the Mentessa Platform. The analysis allows us to understand general usage habits and derive different target and user groups. We use this information to improve the user experience of the Mentessa Platform. For example, we may improve search functionality by using this data to help determine and rank the relevance of content, communities or expertise as well as make suggestions based on historical use.
This information is processed in accordance with our legitimate interest in improving the functionality of the Mentessa Platform. The data is deleted when it is not required for the mentioned purposes anymore and no other legal grounds for processing the data apply. In some cases, we anonymize this information and use this data for statistical purposes.
When you register with and use the Mentessa Platform, we have to collect and process certain personal data as your login data and certain contact information. If you use our paid services, you will need to provide payment and billing information (collectively referred to as “Customer Data”). Customer Data includes especially first and last name, date of birth, address (e.g., street, city, zip code), telephone number, email address, password, billing information (e.g., billing period, tax numbers) and payment details (e.g., credit card information). You are required to complete certain mandatory fields during the registration. This mandatory information is essential to serve the overarching purpose of the Mentessa Platform. Your first and last name are always visible without limitation to other users. For other information, you can determine the extent to which it should be visible to other users.
We process your payment details such as credit card and bank details for the purpose of payment processing and invoicing in accordance with the method of payment you choose. Your payment details will be transferred, to the extent needed, along with other required data for processing the transaction, including invoicing and debt collection, where applicable, to providers such as credit card institutes, payment providers and debt collection providers, and processed there, or the data will be collected directly by these providers. In order to process payments, we forward the necessary payment data to our authorized payment service provider Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland (“Stripe”). We have concluded a data processing agreement with Stripe which allows Stripe to process the data solely in accordance with our instructions and not for its own purposes. For clarification purposes: Mentessa does not store credit card information of customers.
The data processing is carried out on the basis of the fulfilment of our contract with you. The data is deleted when it is not required for the mentioned purposes anymore and no other legal grounds for processing the data apply. This is generally the case for the data collected during the registration process when you cancel your user account or change or update your data. Even after termination of your user account, however, it may be necessary to continue to store personal data for as long as is necessary to fulfil contractual or legal obligations. The corresponding data will be deleted as soon as the contractual or legal obligation no longer exists.
We offer our users the opportunity to search, connect and communicate with other users in a created community for matching their skills, networking and mentoring purposes based on the information provided in their profile on the Mentessa Platform. Users can share various information either publicly on the Mentessa Platform or individually in communications with other users (“Content Data”). Content Data includes especially profile information that are not Customer Data (e.g., skills, education, company, job title, industry, educational background, photo, portfolio), posts (e.g., in communities), comments, messages and any other interaction with the Mentessa Platform.
The Mentessa Platform allows viewing and sharing information including posts, favorites, and comments. Other users of your community will be able to find and see your shared content and your interactions. You can choose which information you want to share on your profile, such as your education, work experience, skills, photo, city and endorsements. You don’t have to provide additional information on your profile. However, providing more information allows us to improve your user experience on the Mentessa platform, for example, by helping other users find you. It is your choice whether to include sensitive information on your profile and to make that sensitive information available to other users of the community. Please do not post or add personal data to your profile that you would not want to be available to other users of the community. The default setting for messages is that all other users in your community on the Mentessa Platform may send you messages. You can adjust these settings at any time so that either nobody or only selected users can send you private messages.
The data processing is carried out on the basis of the fulfilment of our contract with you. The data is deleted when it is not required for the mentioned purposes anymore and no other legal grounds for processing the data apply. This is generally the case for Content Data when you cancel your user account or change or update your data. We will erase them in full or make them anonymous when you delete your user account. The recipients of your messages will, however, not have this data erased when you delete your user account. This data is only deleted in full once it has been deleted by both the sender and the recipients.
Even after termination of your user account, however, it may be necessary to continue to store personal data for as long as is necessary to fulfil contractual or legal obligations. The corresponding data will be deleted as soon as the contractual or legal obligation no longer exists.
We use “cookies” to provide you with a variety of features and to enhance your user experience. Cookies are small text files that are temporarily stored on your device via your browser. We only use cookies that are strictly necessary for the provision of the Mentessa Platform. We use both cookies that are automatically deleted when you close the browser or log out (“transient cookies”) and cookies that are automatically deleted after a specified period of time (“persistent cookies”).
The processing of personal data associated with the use of cookies is necessary for the performance of the contract or justified by our legitimate interest in providing our service. If you do not want us to use cookies, you can change your browser settings accordingly. You can also view the cookies set and their runtimes in your browser settings at any time and delete the cookies manually. Please note that if you completely disable the use of cookies, the functionality and scope of the Mentessa platform may be impaired.
In principle, no user is obliged to provide us with data. However, failure to provide some personal data (e.g. contact details) would mean that the contract with you could not be concluded. Furthermore, certain information is collected automatically when using the service (e.g. technical data).
We do not transfer your personal data to third countries (including the United States). Personal data in connection with the use of the Mentessa Platform is processed exclusively within the European Union.
An organization or other third party that we refer to in this Policy as “Customer” has invited you to a Mentessa instance (i.e., a unique domain where a group of users may access Mentessa). If you are joining one of your employer’s Mentessa instances, for example, Customer is your employer. If you are joining a Mentessa instance created by an association, connecting experts with people, who need a mentor then the association is our Customer and it is authorizing you to join its Mentessa instance.
The Customer is a controller of your data, meaning that the Customer has administrative access over your data, and can view, download, analyze, and delete it from a Mentessa instance at their discretion.
Mentessa is a processor of your data, meaning that it provides the programs and infrastructure to process and store your data, and, among other things, keep it secure from unauthorized access.
Your personal data will not be transmitted or disclosed to third parties for purposes other than the ones mentioned in this privacy policy.
Your personal data will be shared with the organization (Controller).
Your data will only be disclosed to third parties in case you expressly consented to the disclosure, or the disclosure is necessary for compliance with a legal obligation that we are subject to. We can also disclose your data if the processing of the data is legally admissible and necessary for the performance of a contract of which you are a contracting party. Moreover, we disclosure your data if it is required for the establishment, exercise or defence of legal claims or this is required for legal representation while there is no indication to assume that you have a prevailing legitimate interest for the non-disclosure of your data.
In addition, we may provide access to your data to selected third parties. These providers perform a variety of services for us, including sales, marketing, content and feature delivery, advertising, analytics, research, data storage, security and fraud prevention. The processing of the data is done exclusively on our behalf and we have entered into a data processing agreements with all processors.
This privacy policy does not apply to any third-party applications that is integrated in the Mentessa Platform and offer their services under their own terms of use and privacy policies. You can choose to permit or restrict third-party services or whether we can receive personal data from such third-party services.
In order to make the Mentessa Platform easy to use, we use a so-called social login feature as descried in our Terms of Use (“Social Login”). This enables you to log in to our Mentessa Platform with the login data of a single sign-on provider and thus not have to maintain any further login data. The use of a Social Login requires that you have already created an existing user account with the single sign-on provider, for example a social network. In order to log in with the Social Login, you must click on the Social Login button on the Mentessa Platform login screen and, when redirected to the login screen of the single sign-on provider, enter your login data of the Social Login.
To perform the authentication, we receive certain personal data about you. Among other things, this includes a user ID together with information that you are registered with the ID with the respective single sign-on provider. We receive this ID exclusively for the purpose of authentication, i.e. any processing on our part that goes beyond authentication is not permitted. Whether additional data is transmitted to us, and if so, which, depends on the single sign-on provider used, your account settings made with this provider, and any data releases selected as part of the authentication process. Which data we receive from the respective Social Login providers can vary. As a rule, however, it is the email address and the user name. We cannot view the password entered, nor are we able to store it.
Currently, we give our users the possibility to use a Social Login provided by the business network LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland). You can find more information on how your data is being processed here: https://www.linkedin.com/help/linkedin/answer/a705937.
The legal basis for processing the above-mentioned data is our legitimate interest that follows from the need to provide our users with an uncomplicated login to use the Mentessa Platform. The data is deleted when it is not required for the mentioned purposes anymore or other legal grounds for processing the data apply.
If your personal data is processed on the basis of legitimate interest, you have the right to object to the processing of your personal data, provided that there are grounds for doing so that arise from your particular situation. If you wish to exercise your right of objection, an email to us will suffice.
As a data subject, you have various rights under the GDPR. You have especially the right to access information about your personal data. Furthermore, you have a right to rectification, deletion or restriction of processing as well as to data portability insofar as you are entitled to this by law.
If you provide us with a consent for the data processing, you can withdraw this consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on your consent before its withdrawal.
Furthermore, you also have the right to lodge a complaint about the processing of personal data by us with the competent supervisory authority.
Automated decision making in the sense of the GDPR does not take place.
Terms of Use
We, Mentessa GmbH, c/o Wayra Germany, Kaufingerstrasse 15, 80331 Munich, Germany (“Mentessa”/“we”/“us”/”our”) provide a platform for peer-to-peer learning and knowledge exchange as further described below (“Mentessa Platform”). The use of the Mentessa Platform requires that you, irrespective of your role as an (initiating) admin or other user, agree to these terms of use (“Terms of Use”), which form the basis of the agreement concluded between us and you (“Contract”). You shall read these Terms of Use carefully and familiarize with the provisions provided herein.
1. What the use of Mentessa Platform requires
You can use the Mentessa Platform if you are a natural person who has reached the age of 18. If you use the Mentessa Platform on behalf of a company or organization, you confirm to us that you are authorized to act on behalf of that company or organization and you agree to be legally bound by these Terms of Use on their behalf. Certain functionalities of the Mentessa Platform require that you contract with third-party service providers that have been integrated in the Mentessa Platform based on the terms and conditions made available by such third-party service providers. We do not take any responsibility for such terms and conditions or your compliance therewith.
The use of the Mentessa Platform requires that you have fully completed the registration process for the Mentessa Platform and created an account (“Mentessa Account”). In order to register for the Mentessa Platform and create a Mentessa Account, you register with the following details ("Login Details"):
- enter your e-mail address, first name and last name, and define a password; or
- use a profile of a (social) network operated by third parties, such as LinkedIn ("Social Login"); if you wish to register with the Mentessa Platform by means of a Social Login, you will be redirected to the login/registration mask of the (social) network and can log in there with your user name and password stored with this provider; or
- use a profile from a corporate identity management system, via a single sign-on integration.
You must ensure that the Login Details used for registration are protected against access by third parties and are stored in a safe place. If you have a reason to believe that the confidentiality of your password has been compromised or unauthorized access to your Mentessa Account is otherwise possible, you agree to promptly change the Login Details and notify us.
We have the right to request password changes from time to time. We may block access to the Mentessa Platform pursuant to Section 9 until such password change has been made.
2. How we collect and process data?
We use a Large Language Model (LLM) to make your interactions with our software more personalized. This means we collect and use information like what you type, your interaction history, and your preferences. We do this to provide better responses and improve your experience.
Our LLM uses automated processes to provide personalized responses and recommendations. It analyzes what you type and other relevant data to tailor interactions based on your behavior and preferences. You have the right to ask for human intervention, express your views, and challenge decisions made by the LLM. For more details, see Exhibit E: Automated Decision-Making and Profiling.
When you use the AI features of our software, you agree to let us collect and use your personal data as described. We ask for your permission the first time you use these features. You can change your mind and stop allowing us to use your data anytime by going to the settings and turning off the AI features. If you do this, some personalized responses may not work.
3. What the Mentessa Platform offers you
With the Mentessa Platform, we offer you the opportunity to search, connect and communicate with other users in a created community for matching skills, networking and mentoring purposes based on the information provided in the profiles on the Mentessa Platform. An overview of the features and packages of the Mentessa Platform can be found under: https://www.mentessa.com/pricing. The provision of features is determined by (i) the packages which you book as manager of the community (“Admin User”) or by (ii) the enterprise customer agreement that is concluded between us and an enterprise customer (“Enterprise Customer Agreement”) under which you are being granted access to the Mentessa Platform by such enterprise customer.
On the Mentessa Platform you (as an initiating Admin User) can create your own community and add users to your community. As Admin User you can appoint other users as Admin Users.
The Admin User manages the community and its guidelines by booking packages of the Mentessa Platform and inviting users to and removing users from the community. If you are not the Admin User of a community, you acknowledge that the community guidelines are determined by the Admin User and can only be influenced by Mentessa if the community guidelines do not comply with these Terms of Use and/or other guidelines communicated by Mentessa.
To facilitate users connecting with each other, we offer the implementation of periodic rituals on the Mentessa Platform for certain connecting purposes (“Rituals”). We provide Ritual templates for the community which you can select as Admin User for your managed community.
Upon a certain number of users in a community, Mentessa offers you as Admin User the opportunity to get an overview of the skills of all users of the community as well as the activities of the users via the Mentessa Platform (“Dashboard”).
4. What we offer with our Free Version
We may provide a free-of-charge version for the Mentessa Platform for you to try certain features of the Mentessa Platform or to use the Mentessa Platform with a reduced set of features (“Free Version”). The scope of features that can be used within the Free Version is at our discretion and we retain the right to change the scope of features or to stop providing a Free Version. You can terminate the Contract for a Free Version at any time.
5. Which fees apply and how you pay
The prices for the use of the Mentessa Platform and its features and packages are specified under https://www.mentessa.com/pricing. We may provide a non-binding price calculator on our website which indicates the estimated price for the use of the Mentessa Platform. If an Enterprise Customer Agreement has been concluded, the prices are governed by the terms of the Enterprise Customer Agreement.
If no Enterprise Customer Agreement has been concluded, you as Admin User can book the features and packages in your own name and for your own account directly on the Mentessa Platform. If you use Mentessa Platform on behalf of a company or organization and have been assigned the respective rights to do so, you can book features and packages in the company’s name and for the company’s account.
The fees are payable monthly or annually by credit card, SEPA Direct Debit, or a similar payment instrument, as indicated on the invoice; we provide further information on the Mentessa Platform as part of the payment process. All prices are net prices.
6. How we provide the Mentessa Platform to you and how we further develop it
Subject to any other agreements in the Enterprise Customer Agreement, we offer you the possibility to use the Mentessa Platform if and to the extent that the Mentessa Platform is available and functional; however, we do not guarantee the continuous availability and functionality of the Mentessa Platform.
We offer the possibility to use the Mentessa Platform only with the functionalities and the quality that the Mentessa Platform currently provides at the time, but we do not promise any functionality or quality, except that the Mentessa Platform generally provides for the scope described in Section 2. Information about the functionality and quality of the Mentessa Platform on the website or in advertising material is not part of the Contract concluded between us and you, unless explicitly referred to in these Terms of Use.
We are entitled to change the Mentessa Platform, at any time and without prior notice, including to modify functionalities (“Changes”), provided that the Mentessa Platform continues to generally provide the scope described in Section 2 and that such Changes are not unreasonable for you. However, we are not obligated to make any Changes.
7. What our intellectual property rights are
You are only allowed to use the Mentessa Platform, its features, functionalities and documentation to the extent specified in these Terms of Use. Unless otherwise explicitly provided in the Terms of Use, all rights to the Mentessa Platform, its features, functionalities and documentation in the relationship between you and us are owned by us, our affiliates or licensors.
If you create and provide us with feedback suggestions, or ideas in the context of the integration and/or use of the Mentessa Platform (“Feedback”), you assign to us all right, title, and interest (including all copyright, patent, and other intellectual property rights) in such Feedback for all current and future methods and forms of exploitation in any way. If such rights in Feedback cannot be effectively assigned under applicable law, you grant us the exclusive, worldwide, unrestricted, perpetual, irrevocable, royalty-free rights to use and exploit such Feedback for all current and future methods and forms of exploitation in any way; such rights include in particular, but are not limited to, the right to reproduce, distribute, publicly perform, publicly display, make, use, have made, sell, offer to sell, import, modify and make derivative works based on, and otherwise exploit that Feedback.
We are not required to make use of any Feedback. It is in our sole discretion whether and how we use any Feedback provided by you. If we make use of your Feedback, we are not required to credit or compensate you any way or form.
8. What your duties of care and cooperation are
You are responsible to ensure that the electronic equipment you use to access the Mentessa Platform has all the relevant technical specifications that are required for using the Mentessa Platform.
You agree to use the Mentessa Platform solely in compliance with all applicable laws. You are prohibited from using the Mentessa Platform to support activities that may cause us to violate applicable law.
You are responsible for the text and image content provided by you on the Mentessa Platform ("Content"), such as e.g. images, videos and texts provided in the context of the use of certain Mentessa Platform features. In particular, you must ensure that the Content provided does not violate personal rights, advertising, copyrights, publishing rights or any other rights of any other person; and no license or other fees are incurred through its use. You further undertake not to provide any Content that is offensive, discriminatory, glorifies violence, defamatory or misleading, promotes or supports an illegal act or otherwise violates applicable law. You grant us the worldwide, unlimited in time, non-exclusive, royalty-free, sublicensable and transferable right to use and exploit this Content as part of or in the context of the provision of the Mentessa Platform (including hosting, making available to the public, duplication, distribution, display and reproduction).
You also agree not to use the Mentessa Platform in a way that
- searches, retrieves, copies or monitors the Mentessa Platform and/or its elements using a program, algorithm, or comparable method for collecting or extracting data (such as using automated tools like bots, spiders, or scrapers),
- is designed to modify, reproduce, or otherwise make available to the public, or publicly broadcast, or create a separate service comparable to, or to replicate (any part of) the Mentessa Platform,
- damages, disrupts, or otherwise impairs the operation of the Mentessa Platform as well as the systems, infrastructure and/or applications used to operate it, which includes sending, transmitting or implementing files that contain viruses, worms, Trojan horses, or other harmful or destructive features,
- is designed to investigate, scan or test vulnerabilities of the Mentessa Platform or to circumvent or compromise security and/or authentication measures that protect the Mentessa Platform and/or its elements; or
- copies, translates, disassembles, decompiles, reverse engineers or otherwise modifies the software of the Mentessa Platform in whole or in part, or creates derivative works thereof.
We only offer support services for the Mentessa Platform if these have been explicitly agreed upon in writing. Otherwise, the Mentessa Platform is offered by us without support services.
9. How the Contract may be terminated
The Contract between us and you for your use of the Mentessa Platform runs for an indefinite period of time.
You can terminate the Contract at any time without observing a notice period and without giving a reason. This can also be done by deleting your Mentessa Account. Any fees paid prior to your termination will not be refunded by us, unless required under statutory law.
Unless otherwise expressly agreed in the Terms of Use, we can only terminate the Contract for convenience by observing a reasonable notice period.
We can extraordinarily terminate the Contract without notice if:
- We reasonably consider that you have used the Mentessa Platform in a fraudulent manner, in breach of these Terms of Use or for illegal purposes;
- We reasonably consider that you have deliberately cheated or taken unfair advantage of us or any of our other users or if your Mentessa Account is being used for the benefit of a third party;
- We are required to do so to comply with applicable law, an order of a court or other regulatory authority.
Our right to suspend your access to the Mentessa Platform pursuant to Section 9 remains unaffected.
10. When we suspend your access to the Mentessa Account
We may, at our sole discretion, suspend access to your Mentessa Account if we reasonably determine or have reasonable grounds to suspect that your use of the Mentessa Platform:
- violates these Terms of Use and/or applicable law,
- infringes the rights of third parties,
- poses a security risk to the functionality of the Mentessa Platform,
- could subject us and/or other users to liability; or
- could be fraudulent.
We also reserve the right to suspend access to your Mentessa Account if you have refused to change your password after being requested by us to do so or if you have refused to agree to a reasonable Amendment of these Terms of Use pursuant to Section 13 first sentence by the scheduled date of the Amendment coming into effect.
We will remove a suspension as soon as the reason for the suspension no longer exists. For this purpose, you are welcome to contact us at support@mentessa.com in order to obtain clarification.
Further claims against you for your non-compliant use of the Mentessa Platform remain unaffected.
11. How we are liable
We are liable – regardless of the legal basis – without limitation
- in the event of intent or gross negligence,
- in the event of intentional or negligent injury to life, body, or health,
- in the absence of a guaranteed quality or in the case of fraudulently concealed defects, and
- on the basis of mandatory liability such as under the German Product Liability Act (or other local laws).
In the event of damages to property and financial losses caused by slight negligence, our liability shall be limited to cases that constitute a breach of an essential contractual obligation and shall be limited in amount to the foreseeable damage typical of the Contract, unless unlimited liability exists in accordance with the first sentence of this Section 10. Essential contractual obligations are obligations which the Contract imposes on us in accordance with its content in order to achieve the purpose of the Contract, the fulfilment of which is essential for the proper execution of the Contract and upon fulfilment of which you may regularly rely.
In all other cases, our liability is excluded.
The above limitations of liability also apply regarding our liability for our vicarious agents, employees, and legal representatives.
Legal warranty claims are not affected by these limitations of liability.
We recommend that you make back-ups of any Content and data used in connection with the Mentessa Platform, to protect your Content.
12. When you need to indemnify us
You indemnify us at your own expense from all claims of third parties as well as any losses, damages, costs, expenses or other liabilities associated therewith, which result from your use of the Mentessa Platform in a way that culpably infringes the rights of third parties and/or violates these Terms of Use or applicable law.
If any claims are made against us which are subject to indemnification pursuant to this Section 11, we will promptly notify you of the claims, and assign to you full authority and control over the defense of such claims (to the extent permitted by applicable law) and we will, to the extent reasonably practicable, assist you in your defense.
13. How we protect personal data
Both we and you undertake to comply with all applicable data protection laws.
The processing of personal data by us in relation to the use of the Mentessa Platform is governed by our privacy policy available at: https://www.mentessa.com/privacy.
14. If you use the Mentessa Platform as a consumer
If you are a consumer within the meaning of § 13 German Civil Code, we will inform you about your right of cancellation within the scope of the respective booking process.
15. What else
Changes to the Mentessa Platform pursuant to Section 5, as well as changes to statutory requirements may make it necessary for us to amend these Terms of Use (“Amendment”). We will inform you of a planned Amendment to these Terms of Use and the content of such Amendment with at least four (4) weeks’ notice to the scheduled date of entry into force; the amended Terms of Use will only come into effect if you have agreed to the Amendment.
You are not entitled to transfer the Contract to third parties without our prior written consent.
Subject to any mandatory provisions of applicable law of your place of residence, the Contract is subject to the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods, CISG. The place of jurisdiction for pecuniary disputes arising out of or in connection with the Contract is Munich, Germany, if you, as the party to be sued, are a merchant, legal person under public law, or special asset (Sondervermögen) under public law or you have moved the domicile or usual place of residence to a place outside the Federal Republic of Germany or if your domicile or usual place of residence is not known to us at the time the action is filed.
Should any individual provision of this Contract be or become invalid or unenforceable, this shall not affect the validity of the other provisions of the Contract which shall remain in full force and effect. The invalid or unenforceable provision shall be replaced by a valid and enforceable provision which accords most closely with the presumed intention and the intended purpose of the Contract and the parties agree to provide any necessary declarations in this respect.
Frequently Asked Questions
General questions
What service do we provide?
The Mentessa app is our Software-as-a-Service offering, provided exclusively over the internet. On behalf of our customers, we collect, process and transmit personal data of voluntarily participating employees in order to provide an in-house mentoring program.
Which contracts and documents do we provide?
- Software-as-a-Service Agreement: all details of our service are set out in the main agreement.
- Data Processing Agreement: contains all content required under Art. 28 GDPR, with Exhibit 1 (sub-processor list) and Exhibit 2 (data protection policy).
What needs to be considered regarding compliance with data protection regulations?
The Mentessa app is provided as part of a data-processing arrangement. The customer remains the controller under data protection law. We process employee data strictly on the customer's instructions, in accordance with the Data Processing Agreement.
Which personal data is processed, and for what purposes?
The Mentessa app processes personal data of our customers' employees: names, contact details, individual information about their role within the organization, and their skills, knowledge and expertise. The purpose of this processing is to provide an algorithm-based mentoring program that suggests other participants to each user, from whom they can learn specific skills through one-to-one exchange.
On what legal basis is employee data processed in the Mentessa app?
Registration is voluntary. Data processing is therefore based on the participating employee's consent under Art. 7 and Art. 6(1)(a) GDPR.
Where is personal data processed?
All data processed under the Data Processing Agreement is processed exclusively within the EU/EEA.
Should the works council be informed?
Yes, the works council should be informed about the introduction of the Mentessa app because of its supervisory function.
Does the works council have co-determination rights?
No, because the Mentessa app is not designed to monitor employees' performance or conduct within the meaning of § 87(1) no. 6 of the German Works Constitution Act (BetrVG).
Technical questions
What service do we provide?
The Mentessa app is our Software-as-a-Service offering, provided exclusively over the internet. On behalf of our customers, we collect, process and transmit personal data of participating employees in order to provide an in-house network.
Physical entry control
Data processing takes place exclusively on Mentessa GmbH's own systems, in an office building secured by a staffed reception. Entry to the data-processing facility is only possible using a key.
System access control
Mentessa GmbH has implemented an authorization concept for system use. All access is logged. Password protection follows the current state of the art. Accounts are locked after repeated incorrect password entries, and automatic session timeouts round out access security.
Data access control
Data processing for the Mentessa app is logically separated for each customer; access to another customer's personal data via the Mentessa app is excluded. Differentiated role- and permission concepts ensure access is granted only to the extent necessary for the authorized person (need-to-know principle), reviewed regularly by a data protection coordinator, with immediate revocation on a change in authorization.
Separation control
Development, test and production systems are separated. Data processing is also logically separated by tenant.
Pseudonymization
Mentessa receives no data, or only pseudonymized data, from the customer for creating participant profiles as part of the mentoring program.
Integrity
Internal emails are encrypted. Secure connections (VPN) are used to protect remote access to data processing.
Availability and resilience
Regular backups are performed. Antivirus and malware protection software are kept up to date with the current state of the art.
Rapid recoverability
See above.
Procedures for regular review, assessment and evaluation, and processor oversight
Mentessa has implemented a data protection management system. A record of processing activities (Art. 30(1) and (2) GDPR) is also in place. Employees receive regular training on data protection and data security.
Information for the works council
What is the Mentessa app?
The Mentessa app is our Software-as-a-Service offering, provided exclusively over the internet. On behalf of our customers, we collect, process and transmit personal data of participating employees in order to provide an in-house mentoring program.
What types of personal data are processed?
First and last name, contact details (email or, where applicable, a work phone extension), where applicable a profile photo, the employee's position and department, and individual information the employee enters themselves about their skills, knowledge in specific areas, or expertise.
Are employees required to participate in the Mentessa app?
No, participation is entirely voluntary and is offered as an additional benefit by the employer. Choosing not to participate, or completing only part of a profile, has no effect whatsoever on the employment relationship or performance appraisal. Data processing is based on consent under Art. 7 GDPR.
For what purposes is personal data processed in the Mentessa app?
The Mentessa app is designed to simplify in-house mentoring programs. Its algorithm-based data processing suggests other participants with a certain level of knowledge to a participant, so the latter can be supported through one-to-one exchange. Example: a participant records in their profile that they rate their French language skills as average. The Mentessa app will suggest a participant whose native language is French and establish contact (a “match”) to improve language skills.
Can the employer use the Mentessa app to monitor participating employees’ performance or conduct?
No, because all data is processed anonymized.
Is the Mentessa app linked to the employer's IT systems?
No, because the Mentessa app is offered exclusively online via browser. Data processing takes place exclusively on Mentessa GmbH’s own IT systems.
What access rights exist within the employer’s sphere?
Participants' access is not limited to the data profile of the participant with whom a match exists.
What technical and organizational security measures are taken?
The Mentessa app can only be accessed over the internet using login credentials individually provided to each participant. Access is SSL-encrypted.
Security Measures
We maintain technical and organizational measures under Art. 32 GDPR across the following categories. A detailed technical and organizational measures document, including our current sub-processor list, is available to customers and partners on request.
Pseudonymization
Participant data used for skills-profile creation and matching is processed pseudonymized wherever feasible. Staff with access to personal data are trained regularly, and compliance is monitored through spot checks and ongoing audits.
Encryption
The platform is only accessible via encrypted connections (TLS). Passwords are stored using a modern, salted hashing algorithm — never in plain text.
Confidentiality & access control
Role- and permission-based access control on a strict need-to-know basis; all access is logged. Accounts lock after repeated failed logins, and sessions time out automatically. Our hosting infrastructure runs on certified, physically secured data-center facilities operated by an established European hosting provider.
Separation control
Data processing is logically separated per customer — one customer can never access another customer’s data through the platform. Development, test and production environments are kept separate.
Integrity
Access and changes to systems and data are logged in a tamper-evident, auditable way, including administrator activity, with defined retention and deletion periods for those logs. Sub-processors are contractually bound to equivalent data-protection and security obligations and are subject to review.
Availability & resilience
Regular backups, up-to-date malware protection, firewalled internal networks, and redundant power supply at the hosting facility. Backups are stored in a physically separate location from the primary systems.
Rapid restorability
Documented recovery plans and recovery routines are in place so that access to personal data can be restored promptly in the event of a physical or technical incident.
Ongoing review
We operate a data protection management system with a record of processing activities (Art. 30 GDPR), regular staff training on data protection and security, and recurring audits to test the effectiveness of these measures.