Privacy

We take the protection of your personal data very seriously. Below we explain how personal data is processed when you use the mention.media platform.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Alexander Noack
noack.digital | digital business solutions
Karl-Marx-Platz 11, 16225 Eberswalde, Germany
Email: info@noack.digital

2. Scope

This privacy policy applies to the mention.media website and the associated applications (registration, marketplace, booking and console areas for advertisers and publishers). It does not apply to third-party websites we link to (e.g. publishers' channels or payment service providers).

3. Principles of data processing

mention.media is a B2B marketplace that brokers content placements between advertisers and publishers. Booking payments for the media price are generally settled directly between advertiser and publisher (invoice, bank transfer, PayPal, Wero). mention.media does not handle booking money for the publisher price. For its platform service, mention.media charges one credit per confirmed booking (fixed booking fee) (paid by the advertiser). Publishers can optionally offer online payments via Mollie Connect. Voluntary donations from publishers to mention.media are a separate, optional process, independent of the credit.

4. Server log files and hosting

When you visit our website, the hosting provider automatically stores information in server log files (e.g. IP address, date and time of the request, requested URL, referrer, browser and operating system information).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the operation, security and stability of the website).
Retention period: usually no more than 14 days, unless longer retention is required for security purposes.

5. Registration and user account

When you register and use an account, we process in particular:

• first and last name, email address, password (stored encrypted)
• optional: company name, pronouns, billing address, VAT ID
• for publishers additionally: payment profile (IBAN, BIC, PayPal, Wero), billing data
• roles and usage mode (advertiser / publisher)

Purpose: providing the account, authentication, assigning bookings and communication.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and (f) GDPR (operation of the platform).
Retention period: for as long as the user account exists; after deletion, the data is deleted or anonymised unless statutory retention obligations apply.

6. Marketplace, bookings and communication

In connection with bookings, we process, among other things:

• booking reference, selected product, briefing, status and timestamps
• billing data and generated invoice PDFs
• messages between advertiser and publisher during the booking
• proof of delivery (URLs, texts, files)
• payment method (invoice or optionally Mollie); for bank transfers, the notice “payment initiated”

Purpose: carrying out and documenting bookings, communication between the parties.
Legal basis: Art. 6 (1) (b) GDPR.
Recipients: the advertisers and publishers involved see the data relevant to the booking in their accounts.

7. Payment data

7.1 Bookings (hybrid model)

For payment by invoice or bank transfer, we store payment instructions and status information on the platform. The actual payment is made directly between advertiser and publisher. As a rule, mention.media does not receive the account details of the transfer.

Publishers can store their IBAN and other payment methods in their profile. IBANs are stored encrypted and are shown on invoices and payment instructions for advertisers.

7.2 Mollie (optional)

If a publisher uses Mollie Connect or you make a voluntary donation online, payment data is processed by Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). mention.media receives transaction IDs and payment status, but no complete card data.

Legal basis: Art. 6 (1) (b) GDPR (payment processing) or (f) GDPR (technical operation).
Further information: Mollie privacy policy.

7.3 Credits (booking fee)

For its platform service, mention.media charges one credit per confirmed booking (fixed booking fee), which is paid by the advertiser. For this we process the booking reference, the credit amount, the advertiser's billing data and the payment status. The media price itself is settled between advertiser and publisher as described in 7.1.

7.4 Voluntary donations (publishers)

After a booking has been completed, publishers can make a voluntary donation to mention.media, independent of the credit. Donations can be made via Mollie or bank transfer. We process the donation amount, reference, payment method and time.

8. Cookies and local storage

We only use cookies and storage technologies that are technically necessary to operate the website. No consent is required for this, which is why we do not show a cookie banner.

• Session cookie: keeps your session alive (e.g. login, form input, selected language during your visit). It expires after 120 minutes of inactivity.
• XSRF token: protects forms against cross-site request forgery. Valid as long as the session cookie.
• Language cookie “locale”: stores the language selected with the language switcher (DE/EN) so it is kept on your next visit. Stored for up to five years.
• Session storage (sessionStorage): remembers during a visit that the waiting list notice shown when leaving the page has already been displayed, so it does not appear again. The entry is deleted when the tab is closed.
• Local storage in the customer area: remembers the selected display mode (light or dark). This value stays in your browser and is not sent to us.

We do not use analytics or marketing cookies or third-party tracking services (e.g. Google Analytics). Fonts and scripts are served from our own server.

Legal basis: Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) for storing and accessing information on your device; for the related processing Art. 6 (1) (f) GDPR (legitimate interest in a secure and functional service).

9. Email and notifications

We send transactional emails (e.g. registration, password reset, status changes of bookings) where these functions are enabled. For this we process your email address and the content of the respective message. The emails are sent on our behalf by the email service provider Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) (see section 10). Brevo processes your email address, your name, the content of the message, the time of sending and the delivery status (delivered, rejected, reported as spam).

Delivery statistics: Brevo routes links in these emails through its own addresses and embeds an invisible image. This allows Brevo to record whether emails are delivered, opened and whether links are clicked. We have anonymised this analysis: opens and clicks are not attributed to any person, we only see totals. When a link or the image is requested, Brevo technically processes your IP address and information about your email client in order to perform the redirect. You can prevent the image from loading by turning off remote images in your email client.

Legal basis: for sending, Art. 6 (1) (b) GDPR (for the waiting list, your consent, see 9.1); for the anonymous delivery statistics, our legitimate interest in reliable and abuse-free email delivery (Art. 6 (1) (f) GDPR).
Retention at Brevo: sending logs are deleted after one month; Brevo does not store a copy of the email content.

9.1 Waiting list and news (newsletter)

During the beta phase you can join our waiting list. We process your name, your email address, your optionally stated interest (advertiser, publisher or both), the selected language and the time, IP address and wording of your consent. We use this to inform you about the launch of the marketplace and to send you news about the development of mention.media as well as expert information on brand mentions, SEO and visibility in AI search.

We use the double opt-in procedure: after signing up, you receive an email with a confirmation link. We only send you further emails after you have confirmed. Unconfirmed entries are deleted after 30 days. Brevo (Sendinblue SAS, Paris) sends the emails and manages the waiting list as our processor: after you confirm, we store your name, email address, interest, language and confirmation date there in a separate contact list for mention.media; if you unsubscribe, we remove you from this list. To manage contacts, the data may additionally be stored in our self-hosted customer relationship management system (CRM). We do not pass the data on beyond this. We only analyse opens and clicks of our waiting list emails anonymously (see section 9).

Legal basis: your consent pursuant to Art. 6 (1) (a) GDPR. Logging the consent serves as proof pursuant to Art. 7 (1) GDPR (Art. 6 (1) (c) and (f) GDPR).

Withdrawal: you can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by writing to hello@mention.media. After withdrawal we will no longer send you emails. We keep proof of your earlier consent and of the unsubscription for as long as claims can be asserted on that basis (usually three years).

10. Processors and service providers

We use, among others, the following categories of service providers:

• Hosting / server: operation of the website and database (servers in the EU or EEA where possible)
• Mollie B.V.: optional online payments and donations
• Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France): sending emails, anonymous delivery statistics and managing the waiting list contact list; servers in France and Belgium

Where required, contracts pursuant to Art. 28 GDPR are in place with all processors. For Brevo, the data processing agreement is part of its terms of service (brevo.com/legal/termsofuse).

11. Transfers to third countries

Data is only transferred to third countries outside the EEA if this is necessary for operation (e.g. when using services based in the USA) and appropriate safeguards are in place (standard contractual clauses, adequacy decision or similar).

Brevo uses sub-processors, some of which are located outside the EU, such as Cloudflare and Brevo Inc. in the USA (delivery, security, support) and Brevo CRM Solutions in India (support). These transfers are safeguarded by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

12. Retention period

Personal data is deleted as soon as the purpose no longer applies and no statutory retention obligations (e.g. under commercial or tax law, up to 10 years for invoices) prevent deletion. Booking and communication data is stored for the duration of the contractual relationship and a reasonable period thereafter.

13. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent given (Art. 7 (3) GDPR) with effect for the future

To exercise your rights, please contact: info@noack.digital.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. In Brandenburg, the competent authority is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

15. Data security

We use TLS encryption (HTTPS), access controls, role-based permissions and other technical and organisational measures to protect your data against loss, misuse and unauthorised access.

16. Changes to this privacy policy

We reserve the right to amend this privacy policy if our services or the legal situation change. The current version is always available at this URL.

As of: 2026-11-06