Privacy Statement
Last updated 27 August 2026
1. Who we are
MentoraMedic is a sole proprietorship (eenmanszaak) registered in the Netherlands. We are the controller for the personal data described here.
| Address | Burgemeester Tellegenstraat 1, 1073 KA Amsterdam, the Netherlands |
| KvK | 42043250 |
| BTW-id | NL005451837B20 |
| info@mentoramedic.eu |
This statement covers mentoramedic.eu and the client cabinet at app.mentoramedic.eu.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, telephone | Providing the service, corresponding with you, invoicing | Performance of contract, 6(1)(b) |
| Billing address | Invoicing, deciding whether Dutch VAT applies, evidence of where you are | Contract 6(1)(b); legal obligation 6(1)(c) |
| Nationality, residence status, country and year of qualification | Working out which recognition route applies and which package, if any, may be sold to you | Performance of contract, 6(1)(b) |
| Diploma and transcript copies | Verifying your qualification and preparing your application | Performance of contract, 6(1)(b) |
| Passport or residence-permit copy, redacted — see section 4 | Verifying identity and the right to live and work here, filing with authorities | Performance of contract, 6(1)(b) |
| Payment data | Taking payment. Card details are handled by Stripe and never reach us | Performance of contract, 6(1)(b) |
| Correspondence and case notes | Running your case, handling complaints, showing the service was properly performed | Legitimate interest, 6(1)(f) |
| Invoices and payment records | Accounting and tax | Legal obligation, 6(1)(c) |
We do not process special categories of personal data (article 9 GDPR), and we take no automated decisions producing legal effects concerning you.
3. Consent
Where we rely on your consent — for optional messages, or for the analytics described in section 9 — you may withdraw it at any time by emailing info@mentoramedic.eu. Withdrawing does not affect the lawfulness of what was processed before.
4. Identity documents
Before uploading a passport, identity card or residence permit, black out:
- your photograph;
- the document number;
- your BSN, if it appears;
- the machine-readable zone at the bottom.
Leave your name, date of birth, nationality and validity dates readable — those are what we need. This follows the guidance of the Autoriteit Persoonsgegevens.
If you upload an unredacted document, we delete it. We have no basis for keeping one, so the file is removed and the slot returns to empty, with a message asking you to upload a redacted copy. We do not retain unredacted identity documents.
5. Who can see your data
Within MentoraMedic, only the handler assigned to your case. Documents are encrypted at rest and every access is logged.
6. Processors
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe | Payments | United States, with EU entities | EU–US Data Privacy Framework (adequacy decision of 10 July 2023), with Standard Contractual Clauses as fallback |
| Brevo | Transactional email | EU | Data stays in the EU |
| Hetzner | Hosting | EU (Germany) | Data stays in the EU |
We have a data processing agreement (verwerkersovereenkomst) with each of them, as article 28 GDPR requires. We transfer no personal data outside the European Economic Area other than as set out above.
7. How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Case documents — diplomas, transcripts, identity copies, case notes | 90 days after your case closes | Questions after closure, complaints, showing the service was properly performed |
| Invoices and payment records | 7 years from the end of the financial year | Dutch fiscal retention obligation, article 52 AWR |
| Correspondence | 90 days after closure, unless a complaint is still open | Accountability and complaint handling |
| Account and contact data | Until you ask us to delete it, or 90 days after closure where nothing is ongoing | Running the service and following up |
After that, data is permanently deleted. You can ask us to delete your case documents sooner at any time — email us and we do it, unless the law requires us to keep something. Identity documents never enter the accounting archive.
8. Your rights
Under the GDPR you may:
- see your data and get a copy of it (article 15);
- have inaccurate or incomplete data corrected (article 16);
- have your data erased, subject to what the law obliges us to keep (article 17);
- have processing restricted in certain cases (article 18);
- receive your data in a structured, machine-readable form (article 20);
- object to processing based on legitimate interest (article 21).
Email info@mentoramedic.eu and we answer within 30 days. If the request is complex we may take up to 60 days more, and we will tell you inside the first 30 that we are doing so. Exercising your rights costs nothing, unless a request is manifestly unfounded or excessive.
9. Cookies and analytics
mentoramedic.eu and taal.mentoramedic.eu set no cookies at all and run no advertising or cross-site tracking scripts. The route quiz runs entirely in your browser and nothing you answer leaves it until you choose to continue to checkout.
Both do count visits, using Umami. It stores no cookie, keeps no identifier that follows you between sites, and does not store your IP address: what we see is the page visited, the referring site, and a coarse country, browser and device type. That is aggregate statistics, not personal data, and it is why no consent banner appears here — nothing is stored on or read from your device (article 11.7a Telecommunicatiewet). We use it to learn which pages people actually read.
app.mentoramedic.eu, the client cabinet, uses cookies that are strictly necessary to keep you signed in and to protect forms against cross-site request forgery. No consent is required for those (article 11.7a Telecommunicatiewet). It also has our own analytics — page views and scroll depth, kept on our own servers and shared with nobody — which runs only if you accept it in the banner shown on your first visit. Choosing "Essential Only" turns it off, and the site works identically either way.
10. Complaints
If you think we are handling your data unlawfully, tell us first — we would rather fix it. You also have the right to complain to the Dutch data protection authority:
Postbus 93374, 2509 AJ Den Haag
autoriteitpersoonsgegevens.nl
+31 70 888 8500
11. Changes
We may update this statement. The current version is always here, and material changes are sent to you by email where possible.