ColdMatch Group — industrial cooling and cold chain procurement platform
ColdMatchGroup
Sign in
Cold-chain project financing.Financing

Offline — reconnect before saving or submitting. Changes on this page have not been sent.

Privacy & Compliance

Privacy & Compliance

Last reviewed: 22 October 2026

ColdMatch Group runs a buyer-first procurement platform for industrial refrigeration and cold-chain projects. This page explains in plain language what personal data the platform handles, the choices and rights you have, and the status of our privacy and compliance work in the markets we serve.

Status of this page

This is an information page, not a certification, seal or legal opinion. No regulator or certification body has approved or audited ColdMatch's practices. Whether a law applies depends on facts such as where you are and the size of our business; the table below shows where that is still to be confirmed with qualified counsel.

Confidentiality of your information

Customer, supplier, RFQ and project information — including uploaded documents and content in private project rooms — is treated as confidential. It is not published and not used for marketing unless you separately opt in. Access is limited to authorised ColdMatch personnel, people you invite to a project room and service providers who need it to provide the service you requested; other disclosure happens only where the law requires it.

Security measures we have verified (22 October 2026)

  • Website connections use HTTPS with TLS 1.2 or 1.3; HTTP is redirected and HSTS is enabled.
  • Database access rules limit CRM records, project rooms, requests and files to their owner, invited members or authorised team members; signed-out visitors cannot read them.
  • Uploaded files are kept in private storage, opened only through links that expire within minutes, and checked for file type and executable content before storage.
  • Private areas tell search engines not to index them, key CRM actions are logged, and our backup archives are encrypted with AES-256.

We have not independently verified our hosting provider's encryption at rest, so we make no claim about it. No system is completely secure, and we cannot guarantee that unauthorised access will never occur.

What the platform handles

  • Contact and company details you enter in RFQ, lead, contact and newsletter forms, and the project details you choose to give (products, capacity, temperatures, location, budget, timeline).
  • Buyer and supplier records in our CRM, so the team can review requests, contact suitable suppliers on a buyer's behalf and follow up.
  • Messages and call records when you contact us by WhatsApp or phone: your number, the name you show, message text, and call details, with recordings or transcripts where the call service provides them.
  • Calculator inputs, used to show your result; they reach our team when you send them with a request, share them, or type them into the AI assistant.
  • Device and usage data from analytics and advertising measurement, collected only after consent where consent is required.

We do not ask for sensitive personal data such as health information. Buyer contact details are not shown to suppliers unless the ColdMatch team releases an introduction.

Your choices and rights

  • Use the privacy request form to ask for access, correction, deletion, portability, restriction or objection, to withdraw consent, to opt out of the sale or sharing of personal information, or to appeal a decision.
  • Open Cookie settings at the bottom of any page to accept, refuse or withdraw optional analytics and advertising measurement.
  • We do not sell personal data. If your browser sends a Global Privacy Control signal, advertising measurement stays off.
  • Every marketing or reading-update email has an unsubscribe link, and marketing boxes on our forms are never pre-ticked.
  • You can complain to the data-protection authority where you live or work.

Policies and request routes

What still needs legal review

  • Whether ColdMatch must appoint or publish a representative, data protection officer or local privacy officer (for example under the GDPR, UK GDPR, LGPD, POPIA or Quebec Law 25).
  • Records of processing, impact assessments, and the contracts and safeguards covering service providers and international transfers.
  • Which US state privacy laws apply, based on business thresholds that have not yet been assessed.
  • A confirmed retention period for each type of record.

Laws we have considered

  • EU GDPR and ePrivacy rules (EU/EEA)

    Applicability
    Likely. The operator is based in Cyprus (see Legal Notice) and the site serves EU buyers and suppliers.
    In place on the website
    Privacy Policy with purposes and lawful bases; optional cookies off until accepted; equal Accept / Reject / Preferences; privacy request form; notices beside forms; unticked marketing boxes.
    Open / for counsel
    Records of processing, impact assessments, processor terms and transfer safeguards to be confirmed; DPO requirement not assessed.

  • UK GDPR and PECR (United Kingdom)

    Applicability
    Possibly, where the site offers services to people in the UK.
    In place on the website
    Same consent-first cookie handling as the EU; rights through the privacy request form; right to complain to the ICO.
    Open / for counsel
    Whether a UK representative is required.

  • Swiss Federal Act on Data Protection (revFADP)

    Applicability
    Possibly, for people in Switzerland.
    In place on the website
    Consent-first cookies in Switzerland; rights through the privacy request form.
    Open / for counsel
    Whether a Swiss representative is required.

  • California CCPA/CPRA and other US state privacy laws

    Applicability
    Only if business thresholds are met; not yet assessed.
    In place on the website
    No sale of personal data; Global Privacy Control honoured as an opt-out of advertising measurement; opt-out, access and deletion requests through the privacy request form; no less favourable treatment for using rights.
    Open / for counsel
    Threshold assessment; state-specific notice wording if a law applies.

  • Brazil LGPD

    Applicability
    Likely when processing data of people in Brazil, a market the site serves.
    In place on the website
    Optional cookies off until accepted in Brazil; LGPD rights through the privacy request form; right to complain to the ANPD.
    Open / for counsel
    Appointment and publication of a data protection officer (encarregado) or applicable exemption.

  • Canada PIPEDA and Quebec Law 25

    Applicability
    Possibly, for people in Canada.
    In place on the website
    Optional cookies off until accepted across Canada (the site cannot tell provinces apart), meeting Quebec's privacy-by-default rule for tracking; rights through the privacy request form.
    Open / for counsel
    Designation and publication of the person in charge of personal information; privacy impact assessment for transfers outside Quebec.

  • South Africa POPIA

    Applicability
    Possibly, when processing data of people in South Africa.
    In place on the website
    Direct-marketing consent by unticked boxes and unsubscribe links; rights through the privacy request form; right to complain to the Information Regulator.
    Open / for counsel
    Registration of an Information Officer with the Information Regulator.

  • India Digital Personal Data Protection Act 2023

    Applicability
    Possibly, when offering services to people in India; implementing rules apply in phases.
    In place on the website
    Notice beside forms; consent for optional processing; rights through the privacy request form.
    Open / for counsel
    Applicability timeline and notice requirements under the implementing rules.

  • UAE PDPL and free-zone laws (DIFC, ADGM); Saudi PDPL

    Applicability
    To be determined for Gulf buyers and suppliers.
    In place on the website
    Rights through the privacy request form; transfers described in the Privacy Policy.
    Open / for counsel
    Applicability and any registration or transfer conditions.

  • Other markets (for example Israel, Japan APPI, Kenya, Nigeria)

    Applicability
    To be determined market by market.
    In place on the website
    The same notices, rights route and consent controls apply to all visitors.
    Open / for counsel
    Local requirements such as registration, cross-border transfer notices or local representatives.

  • Accessibility (WCAG 2.1 AA target; European Accessibility Act; US ADA)

    Applicability
    WCAG is our design target; whether the European Accessibility Act or ADA obligations apply to this business-to-business platform is not determined.
    In place on the website
    Accessibility Statement with a reporting route; keyboard-usable cookie controls and labelled form fields.
    Open / for counsel
    Independent accessibility audit; no accessibility certification is held.

  • Business transparency and marketing

    Applicability
    Applies to how we describe the service to buyers and suppliers.
    In place on the website
    Free for buyers; suppliers pay a success fee only on closed deals (excl. VAT); no direct buyer–supplier contact; financing only through independent partners and never guaranteed; regulatory register entries show sources and review dates.
    Open / for counsel
    Final legal review of the buyer, supplier and RFQ terms.