Privacy Policy

Version 3.2 · Last updated: 22 October 2026

1. Who is responsible

ColdMatch Group ("ColdMatch", "we", "us") is the industrial refrigeration and cold-chain procurement platform of Global B2B Group, operated from the Republic of Cyprus (see the Legal Notice). ColdMatch decides why and how the personal data described here is used and is the controller for it. Suppliers you are introduced to, and financing partners you choose to be introduced to, act as separate controllers for what they receive and apply their own privacy notices.

How to reach us about privacy: use the privacy request form, or email support@coldmatchgroup.com with "Privacy" in the subject line.

2. Personal data we collect

• Project requests and RFQs: your name, business email, phone/WhatsApp, company, country and site location, plus project details (capacity, temperatures, refrigerant, budget range, timeline, financing interest, preferred language, notes and any files you upload).
• Messages and calls with our team: contact-form and email messages; WhatsApp conversations with our business number; and phone calls to or from our business line, including call details and — where the call was recorded or transcribed by our telephony service — the recording or transcript.
• Accounts: sign-in email and authentication data for buyer, supplier and team accounts; supplier and partner applications (company, contact person, products, certificates and documents you provide).
• Reading updates: email, optional name, chosen topics, language and frequency — only if you subscribe and confirm.
• AI assistant and form helper: what you type into the on-site assistant or the "fill with AI" helper.
• Technical and security data: server and security logs, and on some request forms your IP address and browser type, to prevent abuse and spam.
• Optional measurement data (only as described in section 9): pages viewed, referring site, campaign parameters, approximate country, language and device type.

3. Why we use it and our legal bases

Where we rely on legitimate interests, you can object (section 10). Providing contact details is needed for us to handle a request; everything else marked optional is optional.

4. Confidentiality of customer, supplier, RFQ and project information

We treat customer, supplier, RFQ and project information — including documents you upload and content in private project rooms — as confidential. We do not publish it, and we do not use it for marketing unless you separately opt in (for example to reading-update emails).

• Access is limited to authorised ColdMatch personnel, to people you invite into a project room, and to service providers (section 6) who need it to provide the service you requested.
• Suppliers receive only the project requirements needed to prepare an offer; your contact details are shared only when we make an introduction as part of your request (section 5).
• We disclose information otherwise only where the law requires it or to establish, exercise or defend legal claims.
• Private areas of the platform (CRM, project rooms, portals and uploaded files) are not published and are marked so that search engines do not index them.

5. Who we share it with

• Suppliers: while gathering responses we share the project requirements needed to prepare an offer. Your name and contact details are shared with a supplier only when ColdMatch makes an introduction as part of handling your request.
• Financing partners: only with your separate, optional consent.
• Service providers that process data for us (section 6).
• Authorities and advisers where the law requires it or to establish, exercise or defend legal claims.

We do not sell personal data. Some privacy laws (for example in California) treat advertising measurement as "sharing"; you can opt out in Cookie settings, by sending a Global Privacy Control signal, or with the privacy request form. Using your rights never leads to less favourable treatment.

6. Service providers

We use these services to run the platform. They process data on our instructions or, where stated in their terms, as independent controllers:

• Lovable / Lovable Cloud — website hosting, database, sign-in, file storage, transactional email and AI features.
• Cloudflare — content delivery and security for the website.
• Google — Google Workspace business email; Google Fonts (font files loaded by your browser from Google servers); and, only as described in section 9, Google Analytics 4, Google Ads and Google Tag Manager.
• AI model providers reached through the Lovable AI gateway — to answer questions in the on-site assistant and suggest form entries.
• Zadarma — business telephony (call records, recordings and transcripts).
• TimelinesAI — connecting our WhatsApp business conversations to our CRM.
• VirusTotal — not currently used. Only if we enable it: checking a fingerprint (hash) of uploaded files against known malware; the file itself would not be sent. It is not enabled at the time of this version; today uploaded files are checked only on our own servers (section 12).

7. International transfers

Some providers process data outside the EEA and UK, for example in the United States. Data-protection law requires such transfers to be covered by an adequacy decision or another recognised safeguard, such as Standard Contractual Clauses in the provider's data-processing terms. You can ask us which safeguard applies to a particular provider.

8. How long we keep it

• Requests, project records and correspondence: for as long as needed to handle the project and any follow-up, and afterwards for as long as required for accounting, legal claims or legal duties.
• Records moved to the CRM Trash can be restored for 30 days before permanent deletion.
• Reading-update subscriptions: until you unsubscribe; we keep a record of the unsubscribe so you are not emailed again.
• Your cookie choice: stored in your browser for up to 12 months, after which we ask again; you can change or clear it at any time.
• Privacy requests: for as long as needed to show how we handled them.

Fixed retention periods for each record type are being defined; until then we delete data on valid request unless the law requires us to keep it.

9. Cookies, analytics and advertising

Strictly necessary storage (sign-in, security, form drafts and language) always runs. Optional tools are Google Analytics 4 and our own visit statistics (analytics), and Google Ads with Google Tag Manager (advertising measurement). In the EEA, UK, Switzerland, Brazil and Canada — and when we cannot tell where you are — these stay off unless you accept. Elsewhere they run by default and you can turn them off. If your browser sends a Global Privacy Control signal, advertising measurement stays off wherever you are. Change your choice at any time in Cookie settings (also at the bottom of every page). Details are in the Cookie Policy.

10. Your rights

Depending on where you are, you may have the right to access your data, correct it, delete it, restrict or object to its use (including objecting to processing based on legitimate interests and to direct marketing at any time), receive it in a portable format, and withdraw consent at any time without affecting earlier processing. Use the privacy request form. We may need to confirm your identity first. Under the GDPR we normally respond within one month. If we decline a request you can appeal through the same form. An overview of the laws we have considered and what still needs legal review is on the Privacy & Compliance page.

You may also complain to a data-protection supervisory authority, in particular where you live or work. In Cyprus this is the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy).

11. Automated sorting

We use automated checks to sort incoming requests, for example by completeness and by estimated project value against our USD 250,000 sourcing-review threshold. They decide what our team reviews first and which free resources we suggest; they do not make decisions with legal or similarly significant effects. You can ask for a person to review how your request was handled.

12. Security

We use technical and organisational measures appropriate to the information we handle. The measures below were checked on 22 October 2026:

• Encryption in transit: the website is served only over HTTPS. Connections use TLS 1.2 or TLS 1.3 (older versions are refused), plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS only (HSTS).
• Access control: CRM records, project rooms, transaction requests and their files are protected by database access rules. Only the signed-in owner, people invited to a project room, or authorised ColdMatch team members can read them; signed-out visitors cannot. Team access requires a personal sign-in and is limited by role, and owner-only controls protect destructive actions.
• Files: uploads are kept in private storage that cannot be listed publicly and are opened only through links that expire within minutes. Before storage, files are checked against an allowed list of file types and for executable content; suspicious files are held separately.
• Records: key CRM actions are logged. Our own backup archives are encrypted with AES-256 before they are stored.
• Encryption at rest: platform data is stored with our hosting and database provider (section 6). We have not independently verified that provider's at-rest encryption for this platform, so we make no specific claim about it here.

No system is completely secure and we cannot guarantee that unauthorised access or data loss will never happen. If you suspect unauthorised access, contact security@coldmatchgroup.com straight away. See also the Security page.

13. Children

The platform is for business buyers and suppliers and is not directed at children.

14. Changes

We will update the version and date above when this policy changes, and ask again for consent if the optional tools or their purposes change.

Translated legal pages may describe an earlier version; this English page is the current version. See also the Data Protection & GDPR page.