Version 1.8. Last updated: 12 October 2026.
1. Scope
1.1 These terms explain how personal data is handled between mentorhero and a Business Client. They form part of the Platform Terms and Conditions and of every Partnership Agreement.
1.2 In these terms, "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and any legislation that replaces or amends them, together with any other data protection law that applies to a party because of where it operates or where its data subjects are. That includes the EU GDPR, and privacy laws in other countries where we operate such as those in the United States, Canada and Australia. "Personal data", "controller", "processor", "processing" and "data subject" carry the meanings given in the UK GDPR.
2. Our roles
2.1 We are an independent controller for the personal data of everyone who uses the platform, including mentors, mentees and anyone who signs up through a Redirect link. We decide what data we collect, why, and how long we keep it. Our Privacy Policy explains that to the individuals concerned.
2.2 You are an independent controller for the personal data you hold about your own employees and about candidates in your hiring process, including your decision to share a Redirect link with them.
2.3 We are not your processor and you are not ours. Neither of us processes personal data on the other's instructions. Where we both hold data about the same person, each of us is responsible for our own processing.
2.4 We are joint controllers for nothing under these terms. If a future feature makes joint control necessary, we will agree a joint controller arrangement in writing before it launches.
2.5 Individual accounts on the platform belong to the individual who created them, not to you. A mentor or mentee who leaves your organisation keeps their account, their profile and their mentoring history, and may carry on using the platform in a personal capacity with a personal email address. They lose access to your program, your reporting and your branded content. You cannot require us to delete an individual's account, transfer it to you, or restrict the individual's continued use of it, because you are not the controller for it.
2.6 Redirect involves no transfer of personal data from you to us. You share a link with unsuccessful candidates. Whether to follow that link and sign up is the candidate's own decision, and they enter into an agreement with us directly at that point. We are the controller for anyone who signs up. You are told aggregate numbers only, and are never told whether a particular individual signed up or took a session.
3. What we process and why
| Whose data | What we hold | Why |
|---|---|---|
| Mentors | Name, work email, employer, job title, work history, profile photo, session records, platform messages | Running the program, matching, reporting, safeguarding, quality assurance |
| Mentees | Name, email, date of birth, background and career information they choose to give, support needs, session records, platform messages | Delivering mentoring, matching, safeguarding, welfare support |
| Redirect sign-ups | The same as mentees, plus the referring Business Client's link identifier | Delivering mentoring and producing the aggregated monthly Redirect report |
| Sponsors, ambassadors and client contacts | Name, work email, job title, phone | Running the partnership, reporting, billing |
| Session recordings | Video and audio where a session is recorded | Safeguarding, quality assurance, training, investigating concerns |
| Safeguarding records | Reports, notes, decisions, referrals | Meeting our safeguarding and legal obligations |
3.1 Our lawful bases are legitimate interests for running and improving the program, contract for delivering the Service, legal obligation for safeguarding and record keeping, and consent where we ask for it, such as marketing.
3.2 Special category data is not collected as a matter of course. Where a mentee tells us about a disability or support need so that we can help them take part, we process it on the basis of substantial public interest in safeguarding, and we hold it under section 9 of our Safeguarding Policy.
4. How Redirect works
4.1 You share a mentorhero sign-up link with candidates you have not progressed. You do not transfer candidate data to us.
4.2 Anyone who follows that link and signs up does so directly with us and becomes our data subject, covered by our Privacy Policy. We do not tell you who signed up.
4.3 You are responsible for the lawfulness of your own communication to those candidates, including your privacy notice to them and your basis for contacting them.
4.4 The monthly Redirect report is aggregated. It gives numbers and engagement rates. It does not name individuals, and you cannot ask us to identify them.
4.5 Where a Redirect sign-up later applies to you for a role, that is a separate relationship between you and that individual, and nothing in these terms carries their platform data across to you.
4A. Your warranties
4A.1 You warrant that you have a lawful basis for every communication you send that includes a Redirect link, and that your own privacy notice tells candidates what you do with their data.
4A.2 You warrant that the wording you use around the link is accurate, does not misrepresent the program, and does not suggest that signing up affects a hiring decision.
4A.3 You warrant that anyone you put forward as a mentor has been told what data we hold about them and why, and has been pointed to our Privacy Policy.
4A.4 You warrant that any DBS confirmation you give us is accurate and current, and that you have seen the certificate.
4A.5 You will not send us bulk personal data, candidate lists, CVs, or any dataset about people who have not signed up themselves. If you do, we may delete it without notice and it is your breach, not ours.
4A.6 You indemnify us against any claim, fine or cost arising from a breach of this section, including any claim by a candidate, an employee or a regulator.
4A.7 You will not describe us as your processor, name us in a processing agreement as if we acted on your instructions, or represent to a regulator or a data subject that we process data on your behalf. We are an independent controller and any document saying otherwise does not bind us.
5. Security
5.1 We keep appropriate technical and organisational measures in place, including encryption in transit and at rest, role-based access control, multi-factor authentication for administrative access, logging, regular backups, and vulnerability management.
5.2 Our staff and contractors are bound by confidentiality obligations and are trained on data protection and safeguarding.
5.3 You keep appropriate measures in place on your side, including protecting account credentials and controlling who in your business has platform access.
5.4 Neither of us is responsible for a loss caused by the other's failure to keep those measures in place.
5.5 We test our security regularly, including vulnerability scanning and periodic penetration testing. We share a summary of results on request. We do not share raw reports, and we do not permit you to test the platform yourself without our written agreement.
5.6 Where a breach is caused by your side, including shared credentials, unmanaged leavers or an unpatched system of yours, you meet the reasonable costs of our investigation, notification and remediation.
5.7 Where you ask us to complete a security questionnaire, a vendor assessment, a due diligence review or a supplier onboarding process, we will do so once a year at no charge. Beyond that, or where the request is unusually long or requires bespoke evidence, we may charge at our then current rates, having told you first. We are not obliged to agree to a third party's standard terms, to accept a unilateral policy document, or to complete an assessment that would require us to disclose security detail we consider sensitive.
6. Sub-processors and suppliers
6.1 We use suppliers to deliver parts of the Service. The current list is:
| Supplier | Purpose | Location |
|---|---|---|
| Supabase | Platform hosting, database and file storage | London, UK |
| Stripe | Payment processing | UK, EU and US |
| Daily | Session delivery, recording and transcription | US |
| Anthropic | AI used to classify what a mentee is asking for, to work with session transcripts, to read CVs our own software cannot, and to prepare session briefings | US |
| Resend | Transactional email and notifications | US |
| AttachmentScanner | Virus and malware scanning of uploaded files | EU |
| PDFShift | Turning session briefings into PDF documents | France |
| Twilio | Verification text messages | US |
| Vercel | Website and application hosting | US |
6.2 We have written contracts with each of them requiring appropriate protection for personal data.
6.2A Our suppliers engage their own sub-processors. Daily publishes its list at Daily's sub-processor list, and every sub-processor on it is located in the United States, including the transcription provider. That is why session delivery, recording and transcription is shown as US above. Where a supplier offers a regional option, that generally controls where traffic is handled rather than where data is stored; the locations above are where data is stored. Section 7 sets out the safeguards that apply to those transfers.
6.3 We keep this list current and will tell you before adding a supplier that materially changes how platform data is handled.
6.4 If you object to a new supplier on reasonable data protection grounds, tell us within 14 days and we will discuss it. Where we cannot resolve it, your remedy is to end the partnership at the next renewal date. An objection does not pause the change, reduce your fees, or create a right to terminate mid-term.
7. International transfers
7.1 Personal data is stored in the UK or the EEA wherever possible.
7.2 Where data is transferred outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, with a transfer risk assessment on file. For transfers out of the EEA we rely on adequacy decisions or the EU Standard Contractual Clauses.
7.3 mentorhero is a global platform. Mentors and mentees take part from many countries, and a session between two people means each of them sees the information the other has chosen to share, wherever they are. Taking part necessarily involves that transfer.
7.4 Where the law requires it, we appoint a representative in the UK and in the EU, and we publish their details in our Privacy Policy.
7.5 Where a participant is covered by a privacy law that gives them rights beyond the UK GDPR, we honour those rights for that person. This includes state privacy laws in the United States, PIPEDA in Canada, and the Australian Privacy Principles.
7.6 You are responsible for the lawfulness of your own processing in every country where your people take part, including any local requirement to notify, register or obtain consent that applies to you rather than to us.
8. Individual rights
8.1 Each of us handles rights requests for the data we control. We deal with requests from mentors, mentees and Redirect sign-ups about their platform data. You deal with requests from your own employees and candidates about the data you hold.
8.2 If a request reaches the wrong one of us, we pass it to the other within five working days and tell the individual we have done so.
8.3 Each of us gives the other reasonable help where a request cannot be answered without information the other holds.
8.4 Help of that kind is given free once or twice a year. Where requests become frequent or unusually demanding, we may charge at our then current professional rates, having told you first.
8.5 You may not instruct us on how to respond to a request from one of our data subjects. Each of us answers for our own processing.
9. Breaches
9.1 If either of us becomes aware of a personal data breach affecting the other's data subjects, we tell the other without undue delay and in any case within 24 hours.
9.2 The notification says what happened, what data and how many people are affected, what the likely consequences are, and what is being done about it.
9.3 Each of us is responsible for our own regulatory notifications and for telling our own data subjects. Neither of us makes a notification on the other's behalf without agreeing it first, unless the law requires it.
9.4 Neither of us makes a public statement about a breach affecting both of us without telling the other first, unless the law requires it.
10. Retention and deletion
10.1 We retain platform account data for the life of the account and for 2 years afterwards, then delete or anonymise it.
10.2 Session recordings, their transcripts, and the messages participants send each other during a session are retained for as long as we operate the Service, for the safeguarding reason set out in sections 7A and 7B of the Privacy Policy: a concern about a session can surface long after it happened, and a recording that has been deleted cannot protect anyone. Where a recording relates to a safeguarding concern or an investigation, section 9 of the Safeguarding Policy also applies. An individual who took part in a session may ask us to delete the recording of it, and we consider each request on its merits.
10.3 Safeguarding records are retained for 7 years, or longer where a statutory period applies.
10.4 Financial records are retained for 6 years as required by law.
10.5 When a partnership ends, we delete or anonymise the Business Client's own account data within 90 days of the final data export. We keep anonymised and aggregated data indefinitely, and it is no longer personal data.
10.6 Mentor and mentee accounts belong to those individuals. Ending a partnership does not delete them and does not give you the right to ask us to. Where a mentor came through your business and wants to continue independently, they may.
10.7 We may retain data beyond the periods above where it is subject to a legal hold, an ongoing investigation, a regulatory requirement, or a live or anticipated claim. We will tell you where that applies to data connected to your partnership.
10.8 A request to delete data early does not override our safeguarding or statutory retention obligations.
11. Records, audit and cooperation
11.1 Each of us keeps records of processing as required by Article 30 of the UK GDPR.
11.2 On reasonable written notice, and no more than once a year, you may ask us for information showing how we meet these terms. We will provide our security summary, our sub-processor list and any relevant certification. An on-site audit is not part of this, unless a regulator requires it.
11.3 Each of us cooperates with the Information Commissioner's Office and with any other competent authority.
11A. Liability and regulators
11A.1 Each of us is responsible for our own compliance and for our own fines. Neither of us is liable for a penalty imposed on the other because of the other's failure.
11A.2 The liability cap and excluded losses in your Partnership Agreement apply to these terms, other than where the law does not allow it.
11A.3 If a regulator or supervisory authority in any country contacts either of us about the platform or the partnership, we tell the other within two working days, unless the law prevents it. Each of us deals with our own lead authority. Neither of us names the other in a regulatory submission without telling them first, unless required to.
11A.4 Neither of us admits liability on behalf of the other, or agrees an undertaking that binds the other, without written agreement.
11B. Aggregated data and platform improvement
11B.1 We may use platform data, including session activity, matching outcomes, engagement patterns and reporting data, to operate, analyse, secure and improve the Service, and to develop new features. Where we do, the output is ours.
11B.2 Once data is anonymised or aggregated so that no individual and no Business Client can be identified, it is no longer personal data and no longer yours. We may use it indefinitely, including in benchmarks, research, impact reporting, product development and marketing, during the partnership and after it ends.
11B.3 You gain no rights in our models, our benchmarks, our aggregated datasets or anything we build using them, and you may not extract platform data to build a competing dataset or product.
12. Changes
12.1 We may update these terms to reflect changes in the law, our suppliers or the Service. We will publish the updated version and note the date. Where a change materially affects your obligations, we will tell you before it takes effect.
mentorhero Mentorhero Limited, company number 16861069, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Data protection contact: privacy@mentorhero.com. ICO registration number: ZC043248.