Legal · Privacy

Privacy Policy

Version 4.2 · Last updated: 22 October 2026

In short. We use the details you give us to answer your project or sourcing request, contact suppliers on your behalf, run your account and keep a record of our conversations. Optional analytics and advertising measurement stay off unless you switch them on. You can ask for a copy, correction or deletion of your data at any time through our privacy request form. This policy is published in English; a reviewed translation is not yet available.

1. Who is responsible for your data

The controller of personal data collected on hatchmatchgroup.com is the company that operates HatchMatch Group, a commercial poultry procurement platform within the Global B2B Group, operated from the Republic of Cyprus (offices are listed on our Contact page). The company's full legal name, registration number and registered office are being confirmed and will be added to this section; until then, any request can be made through the privacy request form or to privacy@hatchmatchgroup.com.

Other Global B2B Group platforms (for example FeedMatch, ColdMatch, FishMatch, SeedMatch and the Global B2B Group marketplace) are separate websites with their own policies. HatchMatch does not currently send your enquiry or contact details to them.

HatchMatch coordinates sourcing; it is not the manufacturer, seller, importer or lender. When you decide to work with a supplier, integrator or financing provider, that business processes the data it receives for its own purposes as a separate controller under its own privacy notice.

2. What we collect, why, on what legal basis and for how long

We only ask for what a request needs; optional fields are marked. The legal basis depends on the purpose:

Purposes, data, legal basis and retention
Purpose	Personal data	Legal basis	How long
Answer project, quote, RFQ, sourcing and contact requests, and contact suppliers on your behalf	Name, work email, phone/WhatsApp, company, country, the project or product details you enter (capacity, budget band, timeline, specifications, notes), page the request came from, and visit source if you allowed measurement	Steps you ask us to take before a possible contract (GDPR art. 6(1)(b)); where you act for a company, our legitimate interest in answering a business request (art. 6(1)(f))	While the request is open, then as long as needed for follow-up, disputes and legal duties. A fixed period is being set; you can ask for deletion at any time (see Your rights).
Accounts and sign-in (buyers, suppliers, staff)	Email, password hash or Google sign-in identifier, profile and company details, saved projects and documents	Contract — providing the account you asked for (art. 6(1)(b))	Until you ask us to delete the account; records we must keep by law are kept only as required.
Supplier, manufacturer and seller registration, review and trade-compliance screening	Company and contact details, operating country, products, capacity, documents and photos you upload (automatically checked before staff open them), review notes	Contract or pre-contract steps (art. 6(1)(b)); legitimate interest in checking suppliers before contact (art. 6(1)(f)); legal obligations such as sanctions and trade rules where they apply (art. 6(1)(c))	While the registration is active and for the review history needed to show how decisions were made. Submitted supply records keep an append-only audit trail.
Recording business communications in our CRM (email, WhatsApp, phone calls)	Emails exchanged with our team; WhatsApp messages with our business number; for calls through our telephone provider, call time, numbers and the transcript the provider emails to us	Legitimate interest in keeping an accurate record of business conversations and following them up (art. 6(1)(f))	Linked to the related enquiry or account and kept for the same period.
Editorial email updates you subscribe to	Email, chosen topics, language and frequency, and the record of your consent (text, version, time, page)	Consent (art. 6(1)(a)), confirmed by double opt-in; you can withdraw at any time	Until you unsubscribe; we keep a suppression record so we do not email you again.
Optional measurement: Google Analytics 4 and Google Ads conversion measurement, our own blog-reading measurement and visit-source attribution	Pages viewed, interactions, device type, approximate location derived by Google from your IP address, cookie identifiers; for Ads conversions, a hashed (scrambled) email or phone when you submit a form	Consent (art. 6(1)(a) and the ePrivacy rules on device storage) — off until you switch it on in Cookie settings	Your choice is kept on your device for 12 months (365 days), then we ask again; you can change it sooner in Cookie settings or by clearing this site's data (we may also ask again if we add a new optional tool). Google cookies: _ga up to 2 years and _gcl_au about 90 days (Google defaults). Google's retention follows its own settings.
Financing-readiness requests	As described in the financing notice below	Steps you ask us to take (art. 6(1)(b)); any sharing with a financing provider would need your separate consent and is currently disabled	As described in the financing notice below.
Security, abuse prevention and service reliability	Rate-limit counters keyed by a one-way hash of your IP address, error reports, a fingerprint (SHA-256) and the result of the automatic checks for each uploaded file	Legitimate interest in keeping the platform and its users safe (art. 6(1)(f))	Short-lived counters; error logs and backups for the provider's limited retention period.
Handling privacy requests and complaints	Name, email, request type, details you give and how we handled it	Legal obligation (art. 6(1)(c), GDPR arts. 12–22)	Kept as a record of how the request was handled, to show accountability.

Where we rely on legitimate interests, we have weighed them against your interests and rights; you can object (see section 7). Deleted records may remain in private backups until those backups are replaced.

Financing readiness data and optional disclosure

This request is stored for HatchMatch’s internal human review, including its restricted CRM and staff notifications. Data: company and contact details, country, capacity, project budget, requested amount, company history, revenue, supplier status, preferred period and notes. External financing-provider sharing is disabled: recipient identity/category, destination country, retention period, transfer safeguards and local legal review must be confirmed before a separate optional consent request. You may request withdrawal of follow-up, access or deletion at privacy@hatchmatchgroup.com, quoting your request reference. Internal records are retained only as needed for the enquiry and applicable legal obligations; a fixed schedule and hosting destinations remain under review. Do not upload financial statements or identity documents here.

No credit decision, pre-approval, offer, underwriting or guarantee. Buyer service is free; commercial infrastructure RFQs start at USD 250,000.

Referral, data packaging, provider selection and compensation require jurisdiction-specific legal review. No provider availability or regulatory exemption is confirmed.

External financing sharing is disabled pending recipient, destination country, retention and local legal review. Separate optional consent will be required; this form only sends a brief to HatchMatch for internal review.

Illustrative scenario only. Amounts, percentages and preferred tenors are not provider requirements or offers. Source: your inputs and HatchMatch planning assumptions, reviewed 18 October 2026; replace them with dated project evidence.

OECD: export credits (general framework)IFC: how to apply (provider criteria, not local availability)EU GDPR Article 7: conditions for consent · 2026-10-18

Private commodity-import applications

The commodity-import workspace is separate from infrastructure projects and general wholesale briefs. Authorized HatchMatch staff handle screening, questions and quote relay. Importers and suppliers do not receive direct access to one another’s accounts, identity, contacts, documents, bids or messages. Registration remains pending review. Supplier verification is limited to evidenced product-market scope and expiry, never a guarantee of supply or import eligibility. Buyer service is free and supplier-funded; commodity-import RFQs require at least USD 250,000. Any explicit information relay remains an authorized staff action, not account access. Private applications are used for internal review, with correction/deletion requests handled through the privacy request form. Legal wording and destination-specific import requirements require human review before release.

3. Sharing with suppliers

HatchMatch staff contact suppliers on your behalf. To get a quote we share the project details a supplier needs (for example capacity, specifications, destination and timing). We do not give suppliers direct access to you: your name and contact details are passed on only when you agree to be introduced to a specific supplier, or when you choose to contact them yourself.

Confidentiality of your information

We treat customer, supplier, RFQ and project information — including documents and content in private project rooms — as confidential. We do not publish it, sell it or use it for marketing or advertising.
Inside HatchMatch, staff see records only as their role requires: full access is limited to administrators, and the CRM assistant role sees active enquiries but not project files.
Service providers listed in section 4 process it only to run the service for us. Suppliers receive only the project details they need to prepare a quote you asked for; your name and contact details only when you agree to an introduction.
We disclose it to others only where the law requires it (for example a court order or a competent authority) or to professional advisers bound by confidentiality.

So that this statement stays accurate, these flows work differently:

A supplier's directory profile is public only when that supplier submits it for publication and our team approves it; their contact details and documents stay private.
If you allow advertising measurement, a hashed (scrambled) email or phone is sent to Google Ads to count that a form was sent. It is not used by us to send you marketing.
Staff tools send enquiry text to AI models through our hosting provider's gateway to help summarise and translate it (see section 4).

4. Service providers and other recipients

We use these providers to run the platform. They process data on our instructions (or, where stated, under their own terms):

Lovable (Lovable Cloud) — Website hosting, database, sign-in, file storage and scheduled jobs. Data: All data stored by the platform. Location: Cloud infrastructure that may be outside the EEA.
AI models used through Lovable's AI gateway — Staff tools that summarise enquiries, translate text, assist the site chat and suggest next steps; a person reviews commercially important decisions. Data: Enquiry text and project details, chat messages. Location: Providers that may be outside the EEA.
Resend (via Lovable) — Sending emails (confirmations, staff alerts, updates you asked for). Data: Email address, message content. Location: USA.
Google — Our business mailbox (Google Workspace / Gmail), Google sign-in if you choose it, and — only with your consent — Google Analytics 4 and Google Ads measurement. Data: Emails with our team; sign-in identifier; measurement data as above. Location: USA and other countries.
TimelinesAI — Syncing our business WhatsApp conversations into the CRM. Data: Names, phone numbers and messages in WhatsApp chats with our team. Location: Outside the EEA.
WhatsApp (Meta) — Messaging, only if you choose to contact us on WhatsApp. Data: Under WhatsApp's own terms. Location: Outside the EEA.
Zadarma — Business telephony: call notifications and transcripts emailed to our mailbox. Data: Phone numbers, call times, transcripts. Location: Provider's infrastructure.
VirusTotal (Google) — Optional malware lookup of uploaded files — built in but not currently switched on, so nothing is sent today. Data: If switched on: only the file's fingerprint (SHA-256 hash) — never the file, its name or your contact details. Location: USA.
Suppliers and project partners — Pricing and delivering what you asked for — see Sharing with suppliers. Data: Project details needed to quote; your identity only as described below. Location: Wherever the supplier is based.

We may also disclose data where the law requires it (for example to a court or competent authority), or to professional advisers bound by confidentiality. We do not sell personal data. If you allow advertising measurement, Google Ads receives cookie data and a hashed email or phone when you send a form; some US state laws may treat this as “sharing” for cross-context advertising. You can opt out with Reject all or Cookie settings, and a browser Global Privacy Control signal is honoured as an opt-out on that device.

5. International transfers

Several providers above are based in, or use infrastructure in, countries outside the European Economic Area, including the United States. Such transfers rely on safeguards recognised by the GDPR — an adequacy decision of the European Commission (for the US, the EU-US Data Privacy Framework for certified companies) or Standard Contractual Clauses — as offered in each provider's data-processing terms. We are confirming the specific mechanism for each provider; you can ask us for details or a copy through the privacy request form.

6. Cookies and similar technologies

Strictly necessary storage (sign-in, security, your language, form progress and chat history saved on your device, and your cookie choice) is always on. Google Analytics 4 and Google Ads measurement, our own blog-reading measurement and visit-source attribution only run after you allow them. Continuing to browse is not consent. Change or withdraw your choice at any time: . Details are in the Cookie policy.

7. Your rights

Under the GDPR you have the following rights. Which ones apply depends on the legal basis for the processing and your circumstances:

Access. Ask whether we hold personal data about you and get a copy, with information about how it is used (art. 15).
Correction. Have inaccurate data corrected and incomplete data completed (art. 16).
Erasure. Have data deleted where, for example, it is no longer needed, you withdraw consent or you successfully object — unless we must keep it, e.g. for legal claims or accounting (art. 17).
Restriction. Ask us to pause use of your data while accuracy or an objection is checked, among other cases (art. 18).
Portability. Receive data you gave us in a structured, machine-readable format, where processing is based on consent or contract and is automated (art. 20).
Objection. Object at any time to processing based on our legitimate interests, on grounds relating to your situation, and always to direct marketing (art. 21).
Withdraw consent. Withdraw any consent at any time, as easily as you gave it — for cookies use Cookie settings; for emails use the unsubscribe link. Withdrawal does not affect earlier processing (art. 7(3)).
Complain. Lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where an alleged infringement took place (art. 77).

How to exercise them: use the privacy request form (no account needed) or, if you have an account, the deletion option on your profile page. We reply without undue delay and within one month; for complex or numerous requests this can be extended by two further months, and we will tell you why. Requests are free unless manifestly unfounded or excessive. We may ask you to confirm your identity so we never disclose or delete someone else's data.

Supervisory authority in Cyprus: Office of the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia), commissioner@dataprotection.gov.cy, gov.cy/dataprotection. You may also contact the authority in the EU country where you live or work.

Rights under other privacy laws

Depending on where you are, other laws give you similar rights — for example the UK GDPR, Brazil's LGPD, Canada's PIPEDA and Quebec's Law 25, Kenya's Data Protection Act and US state laws such as California's CCPA (the right to know, delete, correct and opt out of sale or sharing); India's DPDP Act adds similar rights eighteen months after its rules were published on 13 November 2025 (around May 2027). Which laws apply depends on your location and on our activities there; our current view, what is still open and where to complain are on the Privacy & Compliance page. The request form above works for every law: someone you authorise can make a request for you (we may ask for proof), we reply sooner where a law that applies to you sets a shorter deadline for that type of request, and you can ask us to review our answer if you disagree.

United Kingdom: Information Commissioner's Office (ICO)
United States: California Privacy Protection Agency
Canada: Office of the Privacy Commissioner of Canada; Commission d'accès à l'information du Québec
Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
Cayman Islands: Office of the Ombudsman (Cayman Islands)
India: Data Protection Board of India (Ministry of Electronics and Information Technology)
Japan: Personal Information Protection Commission (PPC)
South Korea: Personal Information Protection Commission (PIPC)
China: Cyberspace Administration of China
Singapore: Personal Data Protection Commission (PDPC)
Philippines: National Privacy Commission (NPC)
Vietnam: Ministry of Public Security
Saudi Arabia: Saudi Data & AI Authority (SDAIA)
Egypt: Personal Data Protection Center
Nigeria: Nigeria Data Protection Commission (NDPC)
South Africa: Information Regulator (South Africa)
Kenya: Office of the Data Protection Commissioner (ODPC)
Uganda: Personal Data Protection Office (PDPO)
Ghana: Data Protection Commission (Ghana)

8. Automated processing and AI

Staff tools use AI models to summarise enquiries, suggest routing and translate text, and the site chat assistant is AI-assisted. These tools support people; they do not make decisions with legal or similarly significant effects on you, and commercially important decisions are made by a person. Financing readiness checks completeness, not creditworthiness. You can ask for human review through the privacy request form.

9. Security

These measures were checked in our code, database rules and live tests on 22 October 2026:

Encrypted connections: the website and our backend are reached over HTTPS. In our test both negotiated TLS 1.3, plain-HTTP requests to the website are redirected to HTTPS, and browsers are told to use HTTPS only for a year (HSTS).
Database access rules: enquiry, supplier, RFQ, project-room, file and CRM records can be read only by the signed-in account they belong to, project members or authorised staff roles. Signed-out visitors have no access to these records.
Private file storage: every storage area for uploads, project documents and backups is private. A file can be downloaded only through a link that expires within minutes and is issued after the server checks that you may see it.
Private pages: account, project-room and staff pages are marked so search engines do not index them, are left out of the sitemap, and only show content after sign-in.
Automatic file checks: files sent through request forms, supplier and seller registration, transaction requests and project rooms are checked before they are stored or shown to staff. Files with executable content, blocked file types or a known test virus signature are refused, and files whose content does not match their type are held for review. These are rule-based checks, not a full antivirus scan; a malware-database lookup is built in but not currently switched on.
Audit trails: changes to enquiries, reviews and supply records are logged with who made them.
Our own backup archives are encrypted (AES-256) with a password kept outside the archive, and each backup run checks that the archive cannot be opened without it.

Not verified by us:

Encryption of stored data (at rest), including backups, is provided by our hosting and database provider's infrastructure. We could not inspect it ourselves and do not add our own separate file encryption.
We have not commissioned an independent security audit or penetration test, and we do not hold a security certification.

No online system is completely secure, and we cannot rule out every risk of unauthorised access. If you suspect unauthorised access, or want to report a vulnerability, follow our Responsible Disclosure Policy or use the privacy request form. If a personal-data breach is likely to put your rights at risk, we notify the competent supervisory authority within 72 hours where required and tell affected people when the risk is high (GDPR arts. 33–34).

10. Marketing

We send editorial email updates only to people who subscribed and confirmed by email. Request forms never sign you up for marketing. Every update email has an unsubscribe link, and you can object to marketing at any time through the privacy request form.

11. Children

HatchMatch is a business-to-business service for adults and is not directed to children.

12. Changes

We will update this page when our processing changes, show the new date and version above, and keep a version history below.

13. Contact

Privacy requests: privacy request form or privacy@hatchmatchgroup.com. Security issues: see the Responsible Disclosure Policy.

Version History

Changelog

Current version 4.2 · Last updated 2026-10-22. Prior versions available on request from legal@hatchmatchgroup.com.

Version 4.22026-10-22
- New confidentiality section for customer, supplier, RFQ and project-room information, with the flows it does not cover.
- Security section now lists only measures we checked, and separates what our provider states (encryption at rest) from what we verified.
- India's start date described as the eighteen-month period in the official notification; reply deadlines now depend on the type of request.
- Upload checks described as rule-based (the malware-database lookup is not switched on) and now also cover project-room documents.
Version 4.12026-10-22
- Added rights under other privacy laws in our markets and a link to the Privacy & Compliance overview.
- Explained possible "sharing" for advertising under US state laws and that Global Privacy Control is honoured.
- Request routes for authorised agents and appeals; reply times shortened where a local law requires.
Version 4.02026-10-22
- Purpose-by-purpose legal bases and retention criteria based on the platform's actual data flows.
- Named service providers, transfer safeguards and GDPR rights with how to use them.
- New privacy request form; controller legal particulars pending confirmation.
Version 3.02026-01-15
- GDPR-equivalent framework under Republic of Cyprus law.
- Documented subprocessors, retention windows and international transfers.
- Added data-subject rights procedure and privacy@ contact.
Version 2.02025-06-01
- Introduced RFQ and lead-enrichment data processing categories.
Version 1.02024-11-01
- Initial publication of Privacy Policy.