Mondu, Inc. Invoice Purchase Solution
1. About this policy
This Privacy Policy describes how Mondu, Inc. (“Mondu“, “we“, “us“, or “our“) collects, uses, and shares personal information in connection with the Invoice Purchase Solution, our accounts receivable purchasing product for business merchants in the United States (the “Platform“).
This Policy applies to individuals who interact with the Platform in a business capacity, including personnel of merchant businesses (“Merchants“) and their customers (“Buyers“). Our services are directed exclusively at businesses. We do not offer consumer financial products.
2. Information we collect
We collect the following categories of personal information directly from Merchants through the Platform, and from third-party business credit agencies in connection with underwriting.
| Category | What this includes |
|---|---|
| Identifiers | Business name, registration number, business address, and the names, titles, business email addresses, and telephone numbers of Merchant and Buyer personnel. |
| Financial information | Invoices, accounts receivable aging reports, payment history, collections data, dispute summaries, credit notes, purchase order references, remittance details, and business bank account numbers and payment transfer details used for remittance. |
| Sensitive personal information | Government-issued identification numbers of Merchant representatives, collected where required for identity verification or compliance screening purposes. Where identity verification is conducted using biometric technology, biometric identifiers and biometric information (including facial geometry scans) are also collected. See Section 3 for full details. |
| Professional and employment-related information | Job titles and roles of Merchant and Buyer personnel provided in connection with Platform use. |
| Internet and network activity | Log data, device identifiers, IP addresses, browser type, and Platform usage activity. |
| Consent and signature records | Click-through acceptance records, timestamps, user identifiers, and associated metadata evidencing agreement to our terms and consents. |
3. Biometric data
During identity verification, we use Onfido, Inc. (“Onfido”) to collect and process biometric identifiers from Merchant representatives, including facial geometry scans. We obtain express consent before any biometric data is collected.
Biometric data is permanently destroyed when the purpose for which it was collected has been satisfied, or within three years of your last interaction with the Platform, whichever comes first. We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. We do not disclose biometric data to third parties except to Onfido acting as our service provider, as required by law, or with your consent.
Residents of Illinois, Texas, and Washington have additional rights regarding biometric data under applicable state law. Contact us at dataprotection@mondu.ai to exercise those rights.
4. How we use your information
We use the information described above for the following purposes.
For underwriting and credit assessment, we analyse financial information, payment history, and third-party credit data to determine whether to purchase a receivable and on what terms. This involves automated analysis described in Section 6.
For onboarding and compliance screening, we verify Merchant identity and screen Merchants, Buyers, and their representatives against OFAC sanctions lists and other watchlists as required by law.
Once receivables are purchased, we administer them by tracking payments and communicating with Merchants in their role as servicers. We also monitor transactions and Platform activity to detect and prevent fraud and misrepresentation.
We process information as required by federal and state law, including responding to lawful requests from regulators or law enforcement, and to assert, defend, or settle legal claims. We use technical and usage information to operate and maintain the Platform.
Sensitive personal information is used only for onboarding verification and compliance screening. It is not used for any other purpose.
5. How we share your information
We share personal information to various third parties, as described below. We do not sell personal information or share it for cross-context behavioural advertising.
JPMorgan Chase Bank, N.A: Where you have consented through the Platform, we share specified Merchant and Buyer information with JPMorgan Chase Bank, N.A. for underwriting, credit assessment, and administration of the Invoice Purchase Solution.
Assignees of purchased receivables: When we purchase a receivable, we may assign or pledge it to third parties, including under the JPMC Trade Facility or future financing arrangements. Assignees receive information necessary to identify and enforce the receivable.
Business credit agencies: We share the minimum information necessary to identify a Merchant or Buyer and receive a credit assessment. These agencies are independent controllers under their own privacy policies.
Service providers: We engage providers for platform hosting, identity verification, sanctions screening, payment processing, and document management. These providers act under our instructions and may not use your information for their own purposes.
Professional advisers: We share information with legal counsel, accountants, and auditors under confidentiality obligations.
Law enforcement and regulators: We disclose information where required by law or court order, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Mondu, our customers, or others.
Business transfers: Information may be transferred as part of a merger, acquisition, or sale of assets. We will provide notice where required by law.
6. Automated decision-making
Our underwriting process uses automated analysis of financial data, payment history, and third-party credit information to generate a risk assessment for each receivable submitted. This assessment may result in a purchase being declined without manual review.
If you are an individual affected by an automated decision and wish to request human review, express your view, or contest the decision, contact us at the email below.
7. Retention
We retain personal information for as long as necessary to provide our services, comply with applicable law, and exercise or defend legal claims. When information is no longer needed for these purposes, we delete or anonymise it. Biometric identifiers and biometric information are subject to the specific retention and destruction requirements set out in Section 3.
Records of sanctions screening conducted in connection with Platform transactions are retained for a minimum of 5 years, as required by applicable sanctions regulations.
8. Security
We maintain administrative, technical, and physical safeguards proportionate to the sensitivity of the information we hold. Sensitive personal information is subject to additional access controls. If you believe your information has been compromised, contact us at the email below.
9. Your privacy rights
California residents
You can ask us what personal information we hold about you, why we hold it, and which third parties we have shared it with. You can ask us to delete your information, though we may need to retain certain records for legal compliance, fraud detection, or other purposes the law permits. You can also ask us to correct inaccurate information.
Where we collect sensitive personal information, its use is limited to the specific purposes set out in Section 4. No further limitation request is required.
We do not sell personal information and do not share it for cross-context behavioural advertising. We honour Global Privacy Control signals as valid opt-out requests. You have the right not to receive discriminatory treatment for exercising any of these rights.
We do not share personal information with third parties for their own direct marketing purposes. To submit any request, contact us at the email below. We will verify your identity before processing. You may designate an authorised agent to act on your behalf.
Response timescales
We respond to verified requests within 45 days. Where necessary, we may extend by a further 45 days and will notify you of the extension.
10. Children
The Platform is directed at businesses and is not intended for individuals under the age of 13. We do not knowingly collect personal information from children. If we become aware that we have done so, we will delete it promptly.
11. Commercial email
Commercial emails from Mondu include an unsubscribe mechanism. To opt out of marketing emails, use the unsubscribe link in any email or contact us as unsubscribe@mondu.ai. Transactional messages relating to your use of the Platform are not affected by a marketing opt-out.
12. Contact Us
Mondu, Inc. | dataprotection@mondu.ai