Legal

Data Protection & GDPR

Version 1.2 · Last updated: 22 October 2026

This Data Protection statement summarises how ColdMatch Group applies the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and comparable laws to the platform. It supplements the Privacy Policy. It is not a certification or a legal opinion; open points are listed on the Privacy & Compliance page.

1. Controller and contact

ColdMatch Group is the controller of personal data processed via the platform for sourcing and marketing purposes. Privacy contact: the privacy request form. Where a supplier engages with a buyer following an introduction, that supplier acts as an independent controller for the personal data it processes to deliver the project.

2. Lawful bases

Contract / pre-contract steps — to provide the sourcing service, host your account and respond to RFQs.
Legitimate interests — to operate, secure and improve the platform, prevent fraud and misuse, and communicate about relevant services.
Consent — for optional analytics and advertising cookies where consent is required (EEA, UK, Switzerland, Brazil, Canada and unknown locations), reading-update emails and sharing with financing partners; may be withdrawn at any time, including through Cookie settings at the bottom of every page.
Legal obligation — for AML/CTF, sanctions, tax and accounting duties.

3. Categories of data

Contact and company data, RFQ content, financing assessment inputs, uploaded documents, usage and device data, and correspondence. We do not intentionally process special category data.

4. Recipients

Selected third-party suppliers, financing partners, logistics or insurance providers (only as required to prepare a quotation or fulfil a service), plus qualified subprocessors for hosting, authentication, email delivery, analytics, customer messaging and security.

5. International transfers

Personal data may be processed outside the EEA and UK. Such transfers must be covered by an adequacy decision or another recognised safeguard, such as Standard Contractual Clauses in the provider's data-processing terms; ask us which safeguard applies to a given provider.

6. Retention

We retain personal data only for as long as necessary for the purpose collected, to comply with legal obligations and to resolve disputes. Financing and AML records may be retained for the minimum period required by applicable law.

7. Data subject rights

Under GDPR you have the right to access, rectify, erase, restrict, port, object and (where processing is based on consent) withdraw consent. To exercise any of these rights, use the privacy request form. You may lodge a complaint with your local supervisory authority.

8. Security

We apply technical and organisational measures appropriate to the risk, including HTTPS encryption in transit (TLS 1.2 or higher), role-based access rules on CRM records, project rooms and files, private file storage with expiring links, and audit logging of key CRM actions. Customer, supplier, RFQ and project information is treated as confidential and is not used for marketing without separate consent (see the Privacy Policy). We make no specific claim about encryption at rest that we have not verified, and no system is completely secure. See our Cyber Security & Responsible Disclosure policy.

9. Data breach

In the unlikely event of a personal data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected data subjects, in line with GDPR Articles 33-34.