Privacy Policy

This Privacy Policy describes how Mentilead Commerce ("we", "us", "our"), a trade name of Aggregatit, CVR 35963022, a Danish company, collects, processes, and protects personal data through the B2B Onboard application ("the App"). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Danish data protection law.

Depending on the processing activity, we act as either a data processor on behalf of Shopify merchants or as an independent data controller. For details on when each role applies, see Section 2 below.

The table below clarifies our role for each processing activity under the GDPR:

Where we act as a processor, the terms of our Data Processing Agreement apply.

The App collects the following categories of personal data from B2B customer registration form submissions:

1. Business contact information: company name, contact name, email address, phone number
2. Custom form fields: any additional fields configured by the merchant (e.g., VAT number, business license number, company size)
3. Uploaded documents: files submitted through file upload fields (e.g., trade licenses, tax certificates)
4. Technical data: IP address and user agent string, collected automatically at the time of submission
5. Anti-spam data (when enabled): when a merchant enables CAPTCHA protection, Google reCAPTCHA v3 collects a verification token, IP address, and browser behavior signals. The token is verified server-side and immediately discarded
6. Server-side analytics data: pseudonymized shop identifiers (SHA-256 hashed) and operational event types, used for service improvement. No personal data is transmitted to the analytics provider

The following table sets out the purposes for which we process personal data, the data involved, and the legal basis under the GDPR:

A Legitimate Interest Assessment (LIA) has been conducted for all processing based on Article 6(1)(f) and is available on request by contacting privacy@mentilead.com.

Automated Decision-Making

The App includes optional auto-approval rules that merchants can configure to automatically approve B2B registration applications based on criteria such as verified VAT numbers or allowed email domains. When enabled by a merchant, these rules process applications without manual review. Merchants retain full control over whether to enable or disable auto-approval and can override any automated decision at any time from the application detail page. The logic of auto-approval is transparent: applications are approved when they match the specific criteria the merchant has configured. No profiling or automated decision-making with legal or significant effects occurs without the merchant's explicit configuration.

B2B Onboard itself does not set any first-party cookies on end-user browsers.

Google reCAPTCHA (when enabled by the merchant)

If a merchant enables CAPTCHA protection on their registration form, Google reCAPTCHA v3 is loaded on the form page. Google may set third-party cookies (including _GRECAPTCHA) and collect IP addresses, browser characteristics, and interaction patterns to distinguish humans from bots. This is an optional feature that merchants can disable at any time in their form settings. For details, see Google's Privacy Policy.

Shopify and merchant cookies

Any other cookies present on pages where the registration form appears are set by the Shopify storefront, the merchant's theme, or other apps installed by the merchant — not by B2B Onboard. Within the Shopify admin, session management is handled by Shopify's own authentication system; the App does not set additional cookies in the admin.

All data is stored within the European Union, specifically in the AWS eu-central-1 region (Frankfurt, Germany).

• Application data (form submissions, application records) is stored in Amazon DynamoDB with encryption at rest
• Uploaded documents are stored in Amazon S3 with server-side encryption (AES-256) and accessed only via time-limited signed URLs
• All data in transit is encrypted using TLS 1.2 or higher
• Access to infrastructure is restricted through role-based access controls (IAM)

We retain personal data only for as long as necessary for the purposes described in this policy. Specific retention periods are as follows:

Upon App uninstallation, all merchant data (forms, applications, uploaded files) is retained for 12 months to allow for re-installation recovery, after which it is permanently deleted. Audit logs are retained for the full 7-year period regardless of uninstallation, as required by law.

We use the following sub-processors to deliver the service:

Sub-processor change notification

We will notify merchants by email at least 30 days in advance of any intended addition or replacement of sub-processors. If you object to a new sub-processor, you may terminate your use of the App before the change takes effect.

In accordance with Articles 44-49 of the GDPR, the following safeguards are in place for transfers of personal data outside the European Economic Area (EEA):

Copies of safeguard documentation, including Standard Contractual Clauses, are available on request by contacting privacy@mentilead.com.

In the event of a personal data breach, we will comply with the notification obligations under Articles 33 and 34 of the GDPR:

1. Supervisory authority (Datatilsynet): notification within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals (Article 33)
2. Affected merchants (data controllers): We will notify the merchant within 48 hours of becoming aware of a breach, enabling them to meet their obligations under Article 33. The notification will include details of the nature of the breach, likely consequences, and measures taken or proposed to mitigate the breach
3. Affected individuals: where a breach is likely to result in a high risk to individuals' rights and freedoms, we will assist the merchant (as data controller) in notifying the affected individuals without undue delay (Article 34)

Our internal breach response procedures are documented and reviewed regularly. For more information, contact privacy@mentilead.com.

If you are an individual whose data has been submitted through a B2B registration form, you have the following rights under the GDPR:

1. Right of access (Article 15) — request a copy of the personal data held about you
2. Right to rectification (Article 16) — request correction of inaccurate data
3. Right to erasure (Article 17) — request deletion of your data ("right to be forgotten")
4. Right to restriction of processing (Article 18) — request that processing of your data be limited
5. Right to data portability (Article 20) — receive your data in a structured, machine-readable format
6. Right to object (Article 21) — object to processing based on legitimate interests

Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3)).

As the merchant is the data controller, GDPR requests should first be directed to the merchant from whom you submitted your application. If the merchant is unable to assist, or if you wish to contact us directly, please email privacy@mentilead.com.

Under Article 37 of the GDPR, a Data Protection Officer (DPO) is not required for our organization. Our core activities do not involve large-scale systematic monitoring of individuals, nor large-scale processing of special categories of personal data.

For any data protection inquiries, please contact us at privacy@mentilead.com.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority. Our lead supervisory authority is:

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised.

For material changes (such as new categories of data collection, new sub-processors, or changes to legal basis), we will notify merchants by email at least 30 days in advance of the change taking effect. Notifications will include a summary of changes and a link to the updated policy.

For any questions or concerns about this Privacy Policy or our data processing practices, please contact us at: