Status: Draft for review — not ready for publication
Effective date: [Insert the date this policy is adopted]
Editorial note — remove before publication: This draft uses the company details and registration information you supplied. Payment providers, hosting locations, AI and other service providers, cookie practices, marketing practices, retention periods, minimum age, international-transfer arrangements, and operational safeguards have not been confirmed. Bracketed items must be completed and the commitments in this draft checked against actual practices before publication. This document does not certify legal compliance; obtain appropriate legal review for a global marketplace operated by a UK company.
Tech Mentor Urdu is a multi-vendor marketplace for digital downloadable products. It brings together customers who purchase digital products and vendors who offer those products through the platform.
The marketplace is operated by Tech Mentor Urdu LTD, a company registered in the United Kingdom. For the processing described in this Privacy Policy, Tech Mentor Urdu LTD is the controller where it determines the purposes and means of processing personal information.
Company address:
2nd Floor College House
17 King Edwards Road
Ruislip, London
United Kingdom
HA4 7AE
Privacy and support contact: support@techmentor.com
This Privacy Policy explains how personal information is handled in connection with the marketplace, including customer registration, vendor approval, purchases, communications, and other applicable platform activities. It also explains the rights individuals may have under applicable data protection law.
This policy applies to personal information processed by Tech Mentor Urdu LTD in connection with people who visit or use the marketplace, register as customers, apply to become vendors, or contact us.
It does not automatically govern information handled independently by vendors, payment providers, or third-party websites. Where another organisation determines its own purposes for processing information, its own privacy notice may also apply.
[Confirm before publication: the website domains covered by this policy, any related services, and any separate privacy notices.]
When a customer registers an account, we collect:
This information supports account creation, account access, and communications associated with the account.
[Confirm the authentication safeguards before publication. Passwords must be protected using an appropriate password-hashing mechanism, not stored in readable form; this draft does not confirm the current implementation.]
Vendors submit personal documents as part of the account-approval process. Depending on the applicable verification requirement, these may include a passport, national identity document, proof of address, or selfie.
These documents may contain identity details, an address, a date of birth, a photograph, a document number, and other information appearing in the submitted document. The exact information depends on the document provided.
The purpose of collecting these documents is to assess a vendor's application and verify information relevant to account approval.
[Confirm before publication: which documents are required, whether documents are reviewed internally or by a verification provider, who has access, whether unnecessary fields can be redacted, and how long each document is retained.]
A photograph or selfie is not automatically special-category biometric data. If a system technically processes facial characteristics for the purpose of uniquely identifying a person, additional legal requirements can apply.
[Confirm whether facial matching, biometric identification, automated identity scoring, or similar technology is used. If so, specify the processing, provider, applicable lawful basis and special-category condition, retention, safeguards, and individual rights.]
The following categories must be checked and included only where they are actually processed:
Do not send passwords, full payment-card details, or identity documents through ordinary support messages unless a designated secure process specifically requires them.
Under UK data protection law, processing requires an appropriate lawful basis. The basis depends on the particular purpose, not simply on the category of information.
The following schedule must be confirmed against actual processing before publication:
ActivityPurposeLawful basis to confirm
Customer registration and account access
Create and operate the account and provide requested marketplace services
Performance of a contract, or steps requested before entering a contract, where processing is necessary for that purpose
Vendor application and approval
Assess applications and verify identity relevant to vendor participation
Contractual necessity where applicable; legitimate interests for proportionate verification and fraud prevention, supported by an assessment; legal obligation only where a specific law requires processing
Orders, downloads, and customer assistance
Fulfil purchases and address account or product-related requests
Contractual necessity where applicable; legitimate interests for other proportionate support activities
Accounting and legally required records
Meet applicable tax, accounting, or regulatory duties
Legal obligation where an identified legal duty applies
Security and abuse prevention
Protect accounts, investigate misuse, and maintain platform integrity
Legitimate interests where processing is necessary and balanced against individual rights; legal obligation where applicable
Promotional communications
Send eligible recipients marketing communications
Consent where required, or a legally permitted alternative only when all applicable conditions are met
Optional cookies and tracking
Run applicable analytics, advertising, or other optional technologies
Consent where required under applicable electronic-communications rules, with an appropriate data-protection basis for related personal-data processing
[Remove activities that do not apply and confirm each remaining purpose and lawful basis. Document any legitimate-interests assessment and identify any relevant statutory duties.]
Where we rely on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you may have a right to object, as explained below.
If required information is not provided, we may be unable to create an account, assess a vendor application, or provide the relevant requested service. Information identified as optional should not be treated as mandatory.
Customers and vendors have different roles within the marketplace. A vendor's need to assist with a product does not, by itself, justify access to all customer account information.
[Confirm before publication: exactly what customer information vendors can see, when it is shared, and whether vendors act as independent controllers or processors for each activity.]
The final policy should identify any customer information made available to vendors for order fulfilment, licensing, support, or dispute handling, together with its purpose and lawful basis. It should not suggest that vendors can access passwords or identity documents unless such access actually exists and has been appropriately assessed.
Where a vendor independently collects information through its own software, website, or support channel, that vendor's privacy notice may apply to that separate processing. Our responsibilities for processing we control remain unchanged.
[Complete before publication: identify the actual providers or meaningful recipient categories, the information disclosed, the purpose of disclosure, and their role.]
Relevant categories may include hosting and storage providers, payment processors, email services, identity-verification services, support systems, AI services, analytics providers, and professional advisers. List only services actually used.
Where a provider acts as a processor, appropriate contractual and security arrangements are required. Where a provider acts as an independent controller, its own privacy notice may also apply.
Information may be disclosed to public authorities where a valid legal requirement applies, or where disclosure is otherwise lawful and necessary to address a legal claim or protect rights. Requests should be assessed for their legal basis and scope rather than treated as permission for unrestricted disclosure.
[Confirm whether information is sold, shared for targeted advertising, or disclosed in connection with a business transfer. Include the applicable explanation and rights; do not insert a “we never sell data” promise without checking.]
[Complete this section before publication using the actual live-chat configuration.]
If an AI service is used to provide assistance, the policy must explain:
Do not assume that selecting a support feature amounts to consent for unrelated AI training. Any statement about training restrictions must reflect the actual provider agreement and settings.
Customer support is available at support@techmentorurdu.com and through https://techmentorurdu.com/contact-us.
[Confirm the actual cookies and technologies before publication, including their names or categories, providers, purposes, durations, and how preferences are managed.]
Some technologies may be necessary for a service specifically requested by the user. Other technologies, including certain analytics or advertising technologies, may require prior consent under applicable law. Do not describe all cookies as necessary simply because they benefit the business.
Where consent is required, optional technologies should not operate before the required consent is obtained. Users should be able to refuse or withdraw consent through an accessible preference mechanism.
[Insert a Cookie Policy link only after that page exists and accurately describes the website's practices. Confirm any applicable exemptions rather than assuming that every analytics tool requires, or is exempt from, consent.]
The marketplace is intended for a global audience. This does not, on its own, establish where personal information is hosted or whether a restricted international transfer takes place.
[Confirm the countries in which personal information is stored, accessed, or processed, including provider and subprocessor locations.]
Where a restricted transfer from the UK takes place, the final policy must explain the applicable mechanism, such as an adequacy regulation, an appropriate contractual safeguard, or another lawful transfer route. Where required, this includes the relevant transfer assessment and supplementary protections.
If EU data protection law also applies, any relevant EU transfer arrangements and representative details must be addressed separately. Do not assume that UK incorporation alone resolves obligations arising from activities directed at other countries.
[State how individuals can request information about relevant safeguards, subject to lawful redactions.]
Information should not be kept indefinitely merely because an account once existed. Retention periods should reflect the purpose, legal requirements, security needs, and applicable claim periods.
Complete this schedule before publication:
CategoryConfirmed retention period or specific determining criteria
Customer account information
[Insert period and treatment after account closure or inactivity.]
Vendor verification documents and selfies
[Insert separate periods for approved, rejected, and withdrawn applications; explain why raw documents remain necessary, if retained.]
Orders, invoices, and accounting records
[Insert periods linked to applicable legal and accounting duties.]
Support tickets and chat records
[Insert period and any exceptions for unresolved disputes.]
Technical and security logs
[Insert period appropriate to the security purpose.]
Marketing records and suppression lists
[Insert periods and treatment after unsubscribe.]
Backups
[Insert deletion or overwrite cycle and restrictions on restored information.]
Account deletion does not necessarily require immediate deletion of every related record. Where information must remain for a lawful purpose, the final policy should explain the categories retained, reason, and duration or criteria.
Appropriate technical and organisational measures are required to protect personal information against unauthorised access, loss, alteration, and disclosure, taking account of the nature and risks of the processing.
[Confirm the safeguards actually implemented before making claims: access restrictions, password hashing, protected document storage, encryption where appropriate, staff confidentiality, logging, backup controls, and incident-response procedures.]
Vendor identity documents warrant particular care because misuse may expose individuals to identity fraud. Access and retention should be limited to what is necessary for the stated purpose.
No internet service can guarantee absolute security. This does not reduce our obligations under applicable law. Where a personal-data breach occurs, applicable notification requirements must be assessed and followed.
Depending on applicable law and the circumstances, you may have the right to:
These rights are subject to legal conditions and exceptions. For example, the right to portability does not cover every record, and erasure may not apply to information that must be retained to comply with a legal obligation.
To make a request, email support@techmentorurdu.com. Describe the request and provide enough information to identify the relevant account. We may need proportionate additional information to verify identity; do not send identity documents unless requested through an appropriate process.
Under UK data protection law, requests are generally handled without undue delay and within one month, subject to applicable rules about verification, clarification, and permitted extensions. Where a lawful extension applies, we will explain it within the required timeframe. Requests are generally free, although legally permitted exceptions may apply to manifestly unfounded or excessive requests.
[Confirm whether vendor approval, fraud controls, account restrictions, or other significant decisions are made solely by automated systems.]
If significant solely automated decisions are used, the final policy must describe the relevant processing, meaningful information about the logic involved, its significance and expected consequences, the applicable legal basis, and any required safeguards, including human intervention or review where applicable.
An AI support response is not, by itself, evidence that vendor approval or account decisions are automated. Do not claim either the presence or absence of such decisions without checking actual processes.
[Insert the confirmed minimum age for customer registration and vendor participation. State whether the website is directed at children and how any known collection of children's information is handled.]
Do not choose an age threshold solely to fill this section. The threshold must reflect the marketplace's actual access rules and the legal requirements applicable to the services and users concerned.
If you believe a child's information has been provided in breach of the applicable rules, contact support@techmentorurdu.com so the matter can be assessed.
Digital products sold by vendors may connect to external websites or services or process information when installed or used. This marketplace policy does not automatically describe the privacy practices of every vendor's product.
Review the relevant product documentation and the vendor's privacy information before providing personal information to a separate service. If concerns relate to information processed by Tech Mentor Urdu LTD, contact us directly.
Please contact support@techmentorurdu.com if you have concerns about how personal information is handled. You do not have to contact us before exercising your right to complain to a competent supervisory authority.
In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO). Information about raising a concern is available at https://ico.org.uk/make-a-complaint/.
Depending on the law applicable to you, you may also have the right to complain to a supervisory authority in your country of residence, place of work, or the place of an alleged infringement.
When this policy is updated, the effective date should be revised. Material changes should be communicated in a manner appropriate to their nature and any applicable legal requirements.
An updated privacy notice does not, by itself, authorise incompatible new uses of previously collected information or replace consent where consent is legally required.
For privacy questions, rights requests, or concerns, contact:
Tech Mentor Urdu LTD
Email: support@techmentorurdu.com
Address:
2nd Floor College House
17 King Edwards Road
Ruislip, London
United Kingdom
HA4 7AE