Privacy & Compliance
Status as of 22 October 2026 · Privacy Policy version 4.2 (22 October 2026)
Privacidade e conformidade
Esta página explica como tratamos dados pessoais, quais leis de proteção de dados consideramos, o que ainda está sendo confirmado e como exercer seus direitos. Não é uma certificação nem aconselhamento jurídico.
Tratamos o seu pedido, os detalhes do projeto e os documentos como confidenciais: não os publicamos nem os usamos para marketing. Só podem vê-los a equipe autorizada, os prestadores de serviços que nos ajudam a operar o serviço e, para as cotações que você pedir, os fornecedores que precisam dessas informações, ou quando a lei exigir a divulgação.
Fazer uma solicitação de privacidade · Política de privacidade · Confidencialidade e segurança
A Política de Privacidade completa está atualmente disponível apenas em inglês; ainda não está disponível uma tradução revista.
1. Privacy practices in place
Checked in the website code and in live browser tests on 22 October 2026:
- Optional analytics and advertising measurement stay off until you choose; Accept all, Reject all and Preferences are equally prominent, and browsing is never treated as consent.
- Google's tag is not loaded at all before a choice or after Reject all; withdrawing consent removes Google's first-party cookies.
- A browser Global Privacy Control signal keeps advertising measurement off on that device, even after Accept all.
- Fonts are hosted on our own domain, so pages make no request to Google Fonts.
- Forms that collect personal data show a short notice with links to the Privacy Policy and the privacy request form; request forms never sign you up for marketing.
- Editorial emails need a separate, unticked opt-in confirmed by email, and every email has an unsubscribe link.
- A public privacy request form (no account needed) logs each request with a reply-by date and a handling record for staff; the date depends on the type of request and is shortened where a law we have verified sets a shorter deadline for that type, and the reason is recorded.
- Staff see records according to their role, and your contact details are passed to a supplier only when you agree to an introduction.
- Customer, supplier, RFQ and project-room information is kept confidential: signed-out visitors cannot read it, private files are reachable only through short-lived links after a permission check, and private pages are kept out of search engines.
- Files sent through request forms, supplier and seller registration, transaction requests and project rooms get automatic rule-based checks before staff open them (executable content and blocked file types are refused, doubtful files are held); this is not a full antivirus scan.
The details — what we collect, why, on what legal basis, for how long and who receives it — are in the Privacy Policy and the Cookie Policy.
2. Privacy laws we consider for our markets
HatchMatch serves business buyers and suppliers of poultry, hatchery and egg projects and products in many countries. Not every law applies to every visitor. Below is our current view of which laws may be relevant and why; a status is not a statement of compliance.
For each country we separate requirements we have read in official sources (they bind us only if the law applies) from questions that need a qualified lawyer. Sources were read on 22 October 2026; laws change, so check the linked texts for the current version.
Europe
European Union and EEA (including Germany, France, Spain and Italy)EU General Data Protection Regulation (GDPR), Cyprus Law 125(I)/2018 and the Cyprus electronic-communications law on cookies (Law 112(I)/2004, s. 99)Applies
Why it may apply: The platform is operated from the Republic of Cyprus and offered to businesses across the EU. Storing or reading information on a visitor's device needs consent unless it is strictly necessary.
Verified in official sources
- Purpose, legal basis, retention and recipient information for each use of data (Privacy Policy).
- Prior consent for non-essential cookies, with refusal as easy as acceptance.
- Replies to rights requests (access, correction, erasure, restriction, portability, objection) within one month of receipt, extendable by two further months where necessary for complex or numerous requests, with the person told why within the first month (art. 12(3)).
Questions for counsel
- Controller legal name, registration number and registered office to publish.
- Transfer mechanism (adequacy decision or Standard Contractual Clauses) for each provider outside the EEA.
- Fixed retention periods and whether a data protection officer must be appointed.
Sources: Cyprus Commissioner — Law 125(I)/2018 · Law 112(I)/2004, section 99 (CyLaw)
Where to complain: Office of the Commissioner for Personal Data Protection (Cyprus), or the authority where you live or work
United KingdomUK GDPR, Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025Likely relevant
Why it may apply: Article 3(2) UK GDPR covers controllers not established in the UK that offer goods or services to people in the UK or monitor their behaviour there. HatchMatch publishes pages for UK buyers.
Verified in official sources
- Privacy information under Articles 13–14, including any UK representative's details.
- Prior consent for non-essential cookies and similar storage under PECR.
- A non-UK controller covered by Article 3(2) must designate a UK representative in writing unless processing is occasional and low-risk (Article 27).
Questions for counsel
- Whether the London office listed on the site is an establishment, or a UK representative is needed.
- Whether the ICO data protection fee applies to HatchMatch as an extraterritorial organisation.
- How the Data (Use and Access) Act 2025 changes (in force by 19 June 2026, per the ICO) affect complaints handling and request timing.
Sources: UK GDPR Article 3 (legislation.gov.uk) · UK GDPR Article 27 · ICO — fee for extraterritorial organisations · ICO — PECR rules on storage and access
Where to complain: Information Commissioner's Office (ICO)
Americas
United StatesCalifornia Consumer Privacy Act as amended (CCPA), other US state privacy laws and the federal CAN-SPAM ActDepends on size thresholds
Why it may apply: The CCPA applies to businesses that do business in California and meet a test such as annual gross revenue above USD 26,625,000 in the preceding calendar year (the statutory USD 25,000,000 as adjusted by the CPPA from 1 January 2025; the law re-adjusts it every odd-numbered year, so the next change is due on 1 January 2027), buying, selling or sharing personal information of 100,000 or more consumers or households, or 50% of revenue from selling or sharing. Texas and Nebraska have no revenue test but exclude small businesses as defined by the US Small Business Administration and do not cover people acting in a commercial context. Whether HatchMatch meets any test has not been assessed.
Verified in official sources
- If the CCPA applies: notice at collection, and honouring opt-out preference signals such as Global Privacy Control (already in place).
- If the CCPA applies, deadlines differ by request: requests to know, delete or correct are confirmed within 10 business days and answered within 45 calendar days, extendable once by 45 days with notice (Civil Code § 1798.130; Regulations § 7021); opt-outs of sale or sharing and requests to limit sensitive data are acted on within 15 business days (§§ 7026–7027).
- CAN-SPAM has no exception for business-to-business email: commercial emails must identify the sender, include a valid postal address and an opt-out honoured within 10 business days.
Questions for counsel
- Revenue and data-volume assessment for California, and small-business status for Texas and Nebraska.
- Whether Google Ads measurement counts as "sharing" under each state law.
- A full inventory of other state laws.
Sources: California Civil Code § 1798.140 · California Civil Code § 1798.130 · CPPA — monetary thresholds effective 1 Jan 2025 · CPPA — CCPA Regulations effective 1 Jan 2026 · Texas Business & Commerce Code ch. 541 · FTC — CAN-SPAM compliance guide
Where to complain: California Privacy Protection Agency
CanadaPIPEDA (federal), Quebec's private-sector privacy Act as amended by Law 25, and Canada's Anti-Spam Legislation (CASL)Unclear — needs counsel
Why it may apply: PIPEDA reaches foreign organisations with a real and substantial connection to Canada, and section 4.01 excludes business contact information used solely to communicate about a person's work. Canada is a target market, but much of what our forms collect is business contact information, so how far PIPEDA applies needs review. Quebec's Act covers personal information handled in carrying on an enterprise.
Verified in official sources
- If PIPEDA applies: access requests answered within 30 days, with limited extensions.
- Quebec: the title and contact details of the person in charge of protecting personal information must be published on the website; by default this is the person with the highest authority in the enterprise (s. 3.1).
- Quebec: tracking, profiling or location technologies must be explained in advance and be off by default (s. 8.1) — our optional cookies are off until chosen.
- CASL: commercial electronic messages need consent, sender identification and an unsubscribe mechanism.
Questions for counsel
- Whether HatchMatch has a real and substantial connection to Canada and Quebec.
- Who is HatchMatch's person in charge for Quebec, so the title and contact can be published.
- Whether a privacy impact assessment and written agreement are needed before Quebec data goes to providers outside Quebec (s. 17).
Sources: PIPEDA s. 4.01 (Justice Laws) · Quebec Act P-39.1 (LégisQuébec) · CRTC — CASL guidance
Where to complain: Office of the Privacy Commissioner of Canada; Commission d'accès à l'information du Québec
MexicoFederal Law on the Protection of Personal Data Held by Private Parties (new LFPDPPP, published 20 March 2025)Unclear — needs counsel
Why it may apply: The new law applies throughout Mexico and gives regulatory functions to the Secretaría Anticorrupción y Buen Gobierno. How it reaches a foreign website, and whether business contact data is excluded under the new rules, has not been confirmed.
Verified in official sources
- If the law applies: a privacy notice and a way to exercise access, rectification, cancellation and objection (ARCO) rights.
Questions for counsel
- Territorial reach for a foreign controller and the status of implementing regulations under the 2025 law.
Sources: LFPDPPP (Cámara de Diputados)
Where to complain: Secretaría Anticorrupción y Buen Gobierno (as named in the 2025 law)
BrazilLei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018)Likely relevant
Why it may apply: Article 3 applies regardless of where the controller is based when processing aims to offer goods or services to individuals in Brazil or the data was collected there. HatchMatch publishes Portuguese pages for Brazilian buyers.
Verified in official sources
- Confirmation that data is processed, or access to it: a simplified reply straight away or a complete reply within 15 days of the request (art. 19). The 15-day date on our request form applies to access requests from Brazil only; for the other rights the law leaves deadlines to ANPD regulation (art. 18 §5).
- The data protection officer's (encarregado) identity and contact must be public (art. 41); qualifying small processing agents need not appoint one but must offer a communication channel (ANPD Resolution 2/2022, art. 11).
Questions for counsel
- Whether HatchMatch qualifies as a small processing agent, or must appoint and publish an encarregado.
- Transfer basis for onward processing by US providers.
Sources: LGPD consolidated text (Planalto) · ANPD Resolution CD/ANPD 2/2022
Where to complain: Autoridade Nacional de Proteção de Dados (ANPD)
Cayman IslandsData Protection Act (2021 Revision)Likely relevant
Why it may apply: The Ombudsman's guidance states the law can apply to an overseas entity that targets and collects personal data of Cayman residents; mere website access is not enough. HatchMatch has published Cayman market content.
Verified in official sources
- A covered foreign controller must nominate a representative established in the Islands and name it in its privacy notice.
Questions for counsel
- Whether HatchMatch's Cayman activity triggers the law and therefore the local-representative duty.
Sources: Ombudsman — when the law applies · Ombudsman — local representative
Where to complain: Office of the Ombudsman (Cayman Islands)
The BahamasData Protection Act 2025 (No. 74) and the earlier Data Protection (Privacy of Personal Information) Act 2003Unclear — needs counsel
Why it may apply: The 2025 Act covers foreign controllers offering goods or services to people in The Bahamas, but its commencement date has not been confirmed; the 2003 Act reaches foreign controllers using equipment in The Bahamas.
Verified in official sources
No specific requirement could be verified from an official source yet.
Questions for counsel
- Which Act is in force, and whether registration, a data protection officer or a local representative is required.
Sources: Data Protection Act 2025 (Official Gazette)
Where to complain: Office of the Data Protection Commissioner (The Bahamas)
GuyanaData Protection Act 18 of 2023Unclear — needs counsel
Why it may apply: The Act was passed and gazetted in August 2023; its commencement, territorial scope and regulator could not be confirmed from official sources.
Verified in official sources
No specific requirement could be verified from an official source yet.
Questions for counsel
- Commencement, scope for foreign controllers and the regulator's details.
Sources: Parliament of Guyana — Act 18 of 2023
Where to complain: Not yet confirmed
Asia-Pacific
IndiaDigital Personal Data Protection Act, 2023 and DPDP Rules, 2025Main duties not yet in force
Why it may apply: Section 3(b) covers processing outside India connected with offering goods or services to people in India. The commencement notification G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)), both in the Gazette of 13 November 2025, phase the law in: the definitions and the Data Protection Board took effect on publication; consent-manager provisions (section 6(9), Rule 4) take effect one year after publication; and the duties of data fiduciaries and the rights of data principals (sections 3–17 except 6(9), Rules 3 and 5–16) take effect eighteen months after publication — around 13–14 May 2027. The texts state periods, not calendar dates, and the e-Gazette copy was uploaded on 14 November 2025, so the exact day needs confirming.
Verified in official sources
- From the eighteen-month date (around 13–14 May 2027): itemised notice, consent that can be withdrawn as easily as given, published contact details for data questions, and a grievance system that responds within a period of no more than 90 days (Rule 14(3)).
Questions for counsel
- Whether B2B contact processing is "offering goods or services to Data Principals in India", and current obligations under India's existing IT law.
- Which calendar day the one-year and eighteen-month periods end on (13 or 14 November 2026 / May 2027).
Sources: DPDP Act 2023 · MeitY — G.S.R. 843(E) enforcement timeline (Gazette, 13 Nov 2025) · MeitY — DPDP Rules 2025, G.S.R. 846(E) · MeitY — corrigendum G.S.R. 892(E), 10 Dec 2025
Where to complain: Data Protection Board of India (Ministry of Electronics and Information Technology)
JapanAct on the Protection of Personal Information (APPI, Act No. 57 of 2003)Likely relevant
Why it may apply: The APPI applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them. HatchMatch publishes Japanese pages for buyers in Japan.
Verified in official sources
- Transfers abroad generally need prior consent with information about the destination country's protection system, unless the recipient maintains equivalent protection.
Questions for counsel
- Current article numbering and duties, and the transfer route for US-hosted data.
Sources: PPC — APPI English translation · Japanese Law Translation — APPI
Where to complain: Personal Information Protection Commission (PPC)
South KoreaPersonal Information Protection Act (PIPA)Likely relevant
Why it may apply: The PIPC's guidance for foreign businesses treats providing goods or services to people in Korea as a basis for applying PIPA, without needing a Korean establishment.
Verified in official sources
- PIPC guidance covers a published privacy policy, rights handling, cross-border transfer and domestic-agent duties for foreign businesses.
Questions for counsel
- Whether HatchMatch meets the domestic-representative thresholds, and the exact privacy-policy items required.
Sources: PIPC — notice to foreign businesses
Where to complain: Personal Information Protection Commission (PIPC)
ChinaPersonal Information Protection Law (PIPL, 2021)Unclear — needs counsel
Why it may apply: Article 3(2) covers processing outside China for the purpose of providing products or services to natural persons in China, or analysing their behaviour. Whether a business procurement service is provided "to natural persons" needs review.
Verified in official sources
- If PIPL applies: notice of contact details, purposes, categories, retention and rights (art. 17).
- A covered overseas processor must set up a specialised agency or designate a representative in China and report its details (art. 53).
Questions for counsel
- Whether Article 3(2) reaches HatchMatch, and if so the representative and cross-border requirements.
Sources: PIPL (National People's Congress)
Where to complain: Cyberspace Administration of China
SingaporePersonal Data Protection Act 2012 (PDPA)Depends on size thresholds
Why it may apply: The PDPA covers organisations whether or not they are formed or located in Singapore, but business contact information is excluded from most of its main obligations (s. 4(5)). Analytics identifiers and personal contact details are not covered by that exclusion.
Verified in official sources
- For covered data: a designated data protection officer with publicly available business contact details (s. 11), consent and purpose notification, and comparable protection for transfers abroad (s. 26).
Questions for counsel
- Whether everything collected from Singapore is business contact information, and whether a data protection officer must be named.
Sources: PDPA 2012 (Singapore Statutes Online)
Where to complain: Personal Data Protection Commission (PDPC)
PhilippinesData Privacy Act of 2012 (Republic Act 10173)Unclear — needs counsel
Why it may apply: Sections 4 and 6 set the Act's scope and extraterritorial reach. How they apply to a foreign B2B platform has not been confirmed.
Verified in official sources
- NPC Circular 2022-04 requires registration where an organisation employs 250 or more people, processes sensitive personal information of 1,000 or more individuals, or its processing is likely to pose a risk to individuals.
Questions for counsel
- Extraterritorial reach of sections 4 and 6, and whether any registration trigger applies.
Sources: NPC — Data Privacy Act · NPC — registration FAQ
Where to complain: National Privacy Commission (NPC)
IndonesiaPersonal Data Protection Law (Law No. 27 of 2022)Likely relevant
Why it may apply: Article 2 covers activity outside Indonesia that has legal consequences in Indonesia or for Indonesian citizens abroad. The two-year adjustment period ended on 17 October 2024.
Verified in official sources
- Transfers abroad need a country with equivalent or higher protection, otherwise adequate binding safeguards, otherwise consent (art. 56).
Questions for counsel
- Current implementing regulations, the designated authority, and whether a data protection officer is required.
Sources: Law 27/2022 (BPK)
Where to complain: Not yet confirmed (implementing authority pending)
VietnamPersonal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/NĐ-CP (in force since 1 January 2026)Likely relevant
Why it may apply: Article 1(2)(c) covers foreign organisations directly involved in, or related to, processing personal data of Vietnamese citizens.
Verified in official sources
- Impact-assessment dossiers for processing and cross-border transfer are filed within 60 days of starting (arts. 20–21); individuals sending their own data abroad are an exception.
Questions for counsel
- Whether that exception covers our web forms, small-business relief, and filing requirements for onward US processing.
Sources: Law 91/2025/QH15 (Official Gazette)
Where to complain: Ministry of Public Security
UzbekistanLaw on Personal Data (ZRU-547, 2019), as amended by ZRU-1125 (from 27 March 2026)Unclear — needs counsel
Why it may apply: The law applies regardless of the processing means, but has no explicit foreign-targeting test. Since 27 March 2026, mandatory storage in Uzbekistan covers biometric, genetic and certain telecoms data rather than all citizens' data.
Verified in official sources
- Other data may be stored abroad through a recognised adequate country, approved contractual clauses or binding rules, or approved international standards.
Questions for counsel
- Whether the law reaches HatchMatch, and which foreign-storage route applies to US providers.
Sources: ZRU-1125 (LexUZ)
Where to complain: Not yet confirmed
Middle East & Africa
Saudi ArabiaPersonal Data Protection Law (Royal Decree M/19, amended by M/148) and its regulationsUnclear — needs counsel
Why it may apply: The law's reach to processing outside the Kingdom was not confirmed from the official text in this review. SDAIA's register rules say separate registration rules for controllers outside the Kingdom will be issued.
Verified in official sources
- SDAIA's Transfer Regulation (version 2.0, August 2024) sets the safeguards for sending data outside the Kingdom, including standard contractual clauses.
Questions for counsel
- Scope for foreign controllers, any registration or representative duty, and the transfer route for US providers.
Sources: SDAIA — PDPL English text · SDAIA — Transfer Regulation
Where to complain: Saudi Data & AI Authority (SDAIA)
United Arab Emirates (DIFC and ADGM have separate laws)Federal Decree-Law No. 45 of 2021 on Personal Data Protection (in effect since 2 January 2022)Unclear — needs counsel
Why it may apply: The UAE Government describes the law as covering processing inside or outside the country of data of people in the UAE. Whether its executive regulations have been issued could not be confirmed.
Verified in official sources
- The law sets consent (with exceptions), security, correction and restriction rights and conditions for cross-border sharing.
Questions for counsel
- Status of executive regulations and operational deadlines, and whether the DIFC or ADGM laws are relevant.
Sources: UAE Legislation — Decree-Law 45/2021
Where to complain: UAE Data Office
EgyptPersonal Data Protection Law No. 151 of 2020Unclear — needs counsel
Why it may apply: The official text and the status of the executive regulations could not be verified from an official publication in this review.
Verified in official sources
No specific requirement could be verified from an official source yet.
Questions for counsel
- Official status of the executive regulations, foreign-controller licensing, representative and transfer permits.
Where to complain: Personal Data Protection Center
NigeriaNigeria Data Protection Act 2023 and the General Application and Implementation Directive (GAID) 2025Likely relevant
Why it may apply: The NDPC states the Act applies to organisations outside Nigeria that process personal data of data subjects in Nigeria. Registration applies to controllers designated "of major importance", not automatically to all.
Verified in official sources
- GAID 2025 covers notices, lawful bases and consent for cookies and other tracking tools (article 19).
Questions for counsel
- Whether HatchMatch is a controller of major importance, and current numeric thresholds.
Sources: NDPC — FAQ · NDPC — GAID 2025
Where to complain: Nigeria Data Protection Commission (NDPC)
South AfricaProtection of Personal Information Act 4 of 2013 (POPIA)Unclear — needs counsel
Why it may apply: Section 3(1)(b) applies POPIA to a responsible party domiciled in South Africa, or not domiciled there but using automated or non-automated means in South Africa (other than only to forward information). HatchMatch is not domiciled there.
Verified in official sources
No specific requirement could be verified from an official source yet.
Questions for counsel
- Whether visitors' devices or cookies count as HatchMatch "making use of means" in South Africa.
Sources: POPIA (Department of Justice)
Where to complain: Information Regulator (South Africa)
KenyaData Protection Act, 2019, the Data Protection (General) Regulations, 2021 and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021Likely relevant
Why it may apply: Section 4(b)(ii) applies the Act to controllers not established or ordinarily resident in Kenya that process personal data of data subjects located in Kenya. Kenya is a target market.
Verified in official sources
- Controllers are exempt from mandatory registration if annual revenue is below KES 5 million and they have fewer than 10 employees, unless they process for listed purposes such as direct-marketing businesses (reg. 13 and Third Schedule); exempt controllers must still comply with the Act.
- Deadlines differ by right (Data Protection (General) Regulations 2021): access within 7 days (reg. 9); restriction, objection, rectification and erasure within 14 days (regs. 7, 8, 10, 12); portability within 30 days (reg. 11). Our request form applies the shorter dates to those request types from Kenya. Regulation 18 (7 days) concerns disclosure to third parties for their direct marketing, which HatchMatch does not do.
Questions for counsel
- Whether the revenue test counts HatchMatch's worldwide revenue, and so whether registration with the ODPC is required.
Sources: Data Protection Act 2019 (Kenya Law) · Registration Regulations 2021 (Kenya Law) · General Regulations 2021, LN 263 (Kenya Law)
Where to complain: Office of the Data Protection Commissioner (ODPC)
UgandaData Protection and Privacy Act (Cap. 97, formerly 2019)Likely relevant
Why it may apply: Section 1(b) covers persons outside Uganda who collect or process personal data relating to Ugandan citizens.
Verified in official sources
- Access requests answered within 30 days (s. 24(9)); notices to stop processing that causes substantial damage or distress (s. 25(2)) and to stop direct marketing (s. 26(2)) answered within 14 days — our request form sets a 14-day reply date for objections and marketing opt-outs from Uganda.
Questions for counsel
- Registration with the Personal Data Protection Office for a foreign controller, and data protection officer duties.
Sources: Act Cap. 97 (NITA-U)
Where to complain: Personal Data Protection Office (PDPO)
GhanaData Protection Act, 2012 (Act 843)Likely relevant
Why it may apply: Section 45(1)(c) covers processing of information that originates partly or wholly from Ghana.
Verified in official sources
- Direct marketing needs the person's prior written consent (s. 40(1)); access requests answered within 40 days (s. 35(10)).
- Controllers must register with the Data Protection Commission, and a controller not incorporated in Ghana must register as an external company (s. 45(2)).
Questions for counsel
- What the registration duties mean for HatchMatch in practice, and the route for US processing.
Sources: Act 843 (Data Protection Commission) · DPC — registration
Where to complain: Data Protection Commission (Ghana)
AlgeriaLaw 18-07 of 10 June 2018, as amended by Law 25-11 of 24 July 2025Unclear — needs counsel
Why it may apply: Article 4 reaches some controllers not established in Algeria that use means located there; its operation after the 2025 amendment was not confirmed.
Verified in official sources
- Transfers of personal data to a foreign state require authorisation from the national authority (art. 44, original text).
Questions for counsel
- Current scope after the 2025 amendment, and declaration or authorisation duties.
Sources: Law 18-07 (Official Journal)
Where to complain: Autorité Nationale de Protection des Données à caractère Personnel (ANPDP)
Iraq (including the Kurdistan Region)No comprehensive data protection law identifiedUnclear — needs counsel
Why it may apply: No comprehensive enacted data protection statute was found in the official legislation databases reviewed; that is not proof that none exists.
Verified in official sources
No specific requirement could be verified from an official source yet.
Questions for counsel
- Sectoral, communications and Kurdistan Region rules that may apply.
Sources: Iraqi Legislation Database
Where to complain: Not identified
3. Your rights and how to use them
Depending on where you are, privacy laws give you rights such as access to your data, correction, deletion, portability, objecting to some uses, withdrawing consent and complaining to a regulator. We handle requests the same way wherever you are:
- Use the privacy request form — no account needed — or email privacy@hatchmatchgroup.com. You may write the details in your own language.
- We may ask you to confirm your identity so we never disclose or delete someone else's data.
- Someone you authorise (for example an authorised agent under US state laws) can make a request for you; we may ask for proof of the authorisation.
- We aim to reply within one month, or sooner where a law that applies to you sets a shorter deadline for your type of request (deadlines differ between access, correction, erasure, objection and opt-out requests). If more time is needed and the law allows it, we tell you why.
- If you disagree with our answer, reply to ask us to look at it again. You can also complain to the authority listed for your country above.
- Requests are free unless they are manifestly unfounded or excessive, and using your rights does not affect how we treat you.
4. Your privacy choices (including “Do Not Sell or Share”)
We do not sell personal data. If you allow advertising measurement, Google Ads receives cookie data and, when you send a form, a hashed (scrambled) email or phone to match enquiries to our ads; some US state laws may treat this as “sharing” for cross-context advertising. To opt out, choose Reject all or switch advertising off in . A browser Global Privacy Control signal is honoured automatically as an opt-out on that device. Our forms do not ask for sensitive data such as health, religion or government identity numbers.
5. What is still being confirmed
These points are open. We list them rather than state facts we have not verified:
- The legal name, company registration number and registered office of the company that operates HatchMatch Group (the controller).
- Which office is the place of establishment for data protection (the site lists a London headquarters and a Cyprus office).
- Fixed retention periods for enquiries, CRM records and communications.
- The transfer mechanism for each provider outside the EEA (adequacy decision / EU-US Data Privacy Framework or Standard Contractual Clauses).
- The country-by-country questions for counsel listed in section 2.
- Whether a data protection officer must be appointed under any applicable law; none is named on this site.
- Native-speaker review of the translated privacy texts; the full policies are published in English only.
6. Related policies
- Privacy Policy and Cookie Policy
- Accessibility Statement — how we test the site and how to report a barrier
- Trade and financial-crime compliance policy — sanctions, export control and anti-corruption (separate from privacy)
- Terms and the Legal Center
7. Contact
Privacy questions and requests: privacy request form or privacy@hatchmatchgroup.com. Security reports: see the Responsible Disclosure Policy.