This notice explains how we collect and use your personal data when you visit mondu.ai, contact us through the website, or apply for a job with us. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply to this processing.
Buyers who use Mondu as a payment method at a merchant’s checkout are covered by a separate notice, available at https://www.mondu.ai/en-gb/gdpr-notification-for-buyers/. The individuals behind our merchant customers, and those we approach as prospective merchants, are covered by the notice at https://www.mondu.ai/en-gb/gdpr-notification-for-merchants/. If you submit an enquiry and we go on to discuss our services with you, that notice covers the rest of the relationship.
Responsible entity
Mondu GmbH (Unter den Linden 16, 10117 Berlin, Germany) is the controller for the processing described in this notice. You can contact us at contact@mondu.ai. Where you apply for a role at Mondu Financial Services B.V. (Herengracht 168, 1016 BP Amsterdam, Netherlands) or at Mondu UK Ltd (Cannon Place, 78 Cannon Street, EC4N 6AF London, United Kingdom), that company is the controller for your application.
For the LinkedIn advertising technologies on our website we are a joint controller with Linkedin Ireland ULC, as described below.
Data we process
a) When you visit our website (Art. 6(1)(f) UK GDPR)
Each time you open one of our pages, our server records the name and address of the page requested, the date and time of the request, the volume of data transferred, the access status, the browser and operating system you are using, the page you came from, and your IP address. We use this data to deliver the site, to keep it available and to detect and stop attacks on it. Our legitimate interest is the secure and reliable operation of our website.
We also set cookies that are strictly necessary to deliver the site, to keep it secure and to remember the cookie choices you have made. The exemption in regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) permits these without your consent. These cookies are not used for analysis, tracking or advertising.
b) Analytics and advertising technologies (Art. 6(1)(a) UK GDPR)
We use cookies and comparable technologies, including tags, tracking pixels and browser or device identifiers, to measure how our website is used and to deliver and measure advertising. Regulation 6 PECR requires your consent before any such technology is set, and we ask for it in the banner shown when you first visit. The banner is operated by Cookiebot, our consent management platform, which blocks these technologies until you consent to them. You can withdraw your consent at any time with effect for the future through the Cookie settings link in the footer of our website. Processing carried out before the withdrawal remains lawful.
The providers we use for this purpose are:
- Google Ireland Ltd. (Google Analytics 4, Google Tag Manager and Google Ads), for website analytics and for delivering and measuring advertising.
- Linkedin Ireland ULC (LinkedIn Insight Tag and conversion tracking), for advertising audiences and campaign measurement.
- Meta Platforms Ireland Ltd. (Meta Pixel), for advertising audiences and campaign measurement.
- HubSpot Germany GmbH, for our website forms and for measuring how visitors reach and use them.
- Semrush Inc. and Mint Position LLC, which process the resulting analytics data for search and content performance analysis.
c) Website visit measurement (Art. 6(1)(f) UK GDPR)
We use Plausible, a service of Plausible Insights OÜ (Estonia), to count visits to our website. Plausible sets no cookies and builds no profile of you. It cannot recognise you on another day or on another website. The data is held on servers in Germany. Our legitimate interest is in understanding how our website is used.
Plausible receives:
- The page you opened and the page you came from.
- Your IP address, from which it works out your country, region and city before discarding it.
- Your browser identification, from which it works out your browser, operating system and device type.
- How far down a page you scroll and how long you stay.
We do not ask for your consent for this measurement. You can switch it off at any time using the Analytics setting in the footer of our website. That setting applies only to the browser and device you are using, and it is lost if you clear your browsing data.
d) Contact, demo and enquiry forms (Art. 6(1)(f) UK GDPR)
When you use one of our forms to ask about our services or to request a demo, we process your first name, surname, e-mail address and company name, together with your position and your company’s turnover where you choose to give them. We use this data to answer your enquiry, to give you access to a demo and to follow up on your interest. Our legitimate interest is in responding to enquiries and in developing commercial relationships. Providing the data is voluntary, and without it we cannot answer you. We record your enquiry and our follow-up in our customer relationship management system.
Our website is built and hosted with the support of Elementor Ltd. and Siteground Hosting Ltd. Form submissions are processed in HubSpot Germany GmbH and Salesforce Inc.
e) Newsletter (Art. 6(1)(a) UK GDPR)
You can subscribe to our newsletter using the form in the footer of our website. We process your e-mail address to send it to you and to measure how you engage with it, including whether you open a message and which links you follow. We ask for your consent when you subscribe. We then send a confirmation e-mail to the address you gave us, and the subscription starts only once you confirm it.
You can withdraw your consent at any time and without giving reasons, by using the unsubscribe link in any newsletter or by e-mailing unsubscribe@mondu.ai. Processing carried out before the withdrawal remains lawful. The newsletter is sent through HubSpot Germany GmbH.
f) Job applications (Art. 6(1)(f) UK GDPR)
When you apply for a role with us, we process your application documents and the information you give us during the process, including your CV, covering letter, interview notes and assessment results. We use this data to assess your application and to reach a hiring decision. Our legitimate interest is in recruiting and selecting staff.
Applications are processed in Workable Software SMPC (Greece), our applicant tracking system. If we hire you, your data passes to Personio SE & Co. KG (Germany), our human resources system.
LinkedIn advertising
Mondu GmbH and Linkedin Ireland ULC (Ireland) are joint controllers for the data collected through the LinkedIn advertising technologies on our website and for the campaign reporting LinkedIn produces from it. We decide which audiences to address and receive aggregated reporting on how a campaign performed. LinkedIn carries out the collection and the measurement, and processes the data for its own purposes as well under its privacy notice, available at https://www.linkedin.com/legal/privacy-policy. You can exercise your rights against either of us.
Automated decision-making and profiling
We do not take decisions about you that are based solely on automated processing and produce legal effects concerning you or similarly significantly affect you.
The analytics and advertising technologies described above involve profiling within the meaning of Art. 4(4) UK GDPR, because they evaluate how you use our website and which advertising is likely to be relevant to you. That processing rests on your consent, and you can withdraw it at any time.
Sources of data
Most of the data we hold about you is provided by you, or by your browser when you visit our website. We also receive campaign and audience reporting from LinkedIn and Meta about how our advertising performed. Where we approach you about a role at Mondu, we may have obtained your contact details and professional profile from publicly available professional platforms.
How long we keep your data
-
Website server logs and analytics data: Three months from collection.
-
Enquiry, form, newsletter and marketing contact data: Three years from your last meaningful engagement with us, or from your withdrawal of consent, whichever is earlier.
-
Applications from candidates we do not hire: Six months from the decision. If we hire you, your data moves to your employee record and the retention periods that apply to it.
-
The record of the cookie and marketing choices you make: Three years from withdrawal, or for as long as we hold the data the record relates to plus three years, whichever is longer.
Recipients of your data
We share your data with the following categories of recipient, to the extent necessary for the purposes described above:
- Website hosting, content delivery and content management providers.
- Web analytics and search performance providers.
- Advertising platforms.
- Customer relationship management and marketing platforms.
- Applicant tracking and human resources providers.
- Customer support and ticketing providers, where you contact us about your data.
- Competent authorities, where we are required to disclose.
Service providers act on our instructions as processors under a data processing agreement. Where a recipient determines the purposes of its own processing, it acts as an independent controller under its own privacy notice.
International transfers
Some of these recipients are established outside the United Kingdom, in the European Economic Area, the United States and Israel. For the European Economic Area and for Israel we rely on UK adequacy regulations. For the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the UK Addendum to the Standard Contractual Clauses, with supplementary measures where required. You can obtain a copy of the transfer agreement from dataprotection@mondu.ai.
Your data protection rights
You have the following rights over your personal data:
-
Access: You can ask what personal data we hold about you and obtain a copy of it.
-
Rectification: You can ask us to correct data that is inaccurate and to complete data that is incomplete.
-
Erasure: You can ask us to delete your data. A legitimate reason must exist, and no rule requiring us to retain the data must apply.
-
Restriction: You can ask us to restrict our processing of your data. A legitimate ground must exist.
-
Portability: In certain cases you can receive your data in a structured, commonly used and machine-readable format, or ask us to transmit it to a third party.
-
Withdrawal of consent: Where we process your data on the basis of your consent, you can withdraw it at any time and without giving reasons. Processing carried out before the withdrawal remains lawful.
-
Objection: You can object to processing we carry out on the basis of our legitimate interests, on grounds relating to your particular situation.
You can exercise these rights by e-mailing dataprotection@mondu.ai or by using the contact form on our website and selecting a request about your personal data. We process the correspondence and identity data needed to verify and answer your request, to meet our legal obligations (Art. 6(1)(c) UK GDPR).
Every data subject has the right to file a complaint with a supervisory authority if they believe that the processing of data concerning them violates data protection law. In the United Kingdom this is the Information Commissioner’s Office.
Our Data Protection Officer
Our Data Protection Officer will be happy to provide you with more information about data protection under the following contact details:
Name: Fraser Blakeway
Email: dataprotection@mondu.ai
Address: Mondu Financial Services B.V., Attn: Fraser Blakeway, Herengracht 168, 1016 BP Amsterdam, Netherlands