Privacy Policy
Version v3.1 · Last updated: 23 October 2026 · Governing law: Republic of Cyprus
1. Who we are (controller)
The controller for personal data collected through fishmatchgroup.com (the “Platform”) is the operator of FishMatch Group, the aquaculture procurement platform of Global B2B Group, operated from the Republic of Cyprus.
We are completing the publication of the registered company name, registration number and registered address of the operating entity. Until they appear here, you can ask us for them through the privacy request form, and the rights in section 8 apply in full.
Other roles: suppliers, producers, financing providers or other parties you choose to deal with after an introduction act as independent controllers for the data they receive and are responsible for their own processing under their own privacy notices. The service providers in section 5 act on our instructions as processors. Requests made on FishMatch are not passed automatically to Global B2B Group or its other platforms.
2. Personal data we collect
- Request and project data: name, business email, phone / WhatsApp, company, role, country, farm or project location, species or product, equipment category, capacity or volume, project type, budget range, timing, financing needs, language and free-text notes.
- Supplier and producer data: business contact details, company details, products, capacity, certifications you declare, catalogues, references and documents you upload.
- Account data: login email and account identifiers.
- Compliance data: information used for sanctions, trade-restriction and regulatory screening of products, origins and requests (where applicable).
- Communications: messages, uploaded documents, chats with our website assistant, and records of emails, WhatsApp messages and calls about a request.
- Usage and device data: technical logs and strictly necessary storage; with your consent, visit statistics (pages viewed, referrer and campaign, language, device type).
Please do not send sensitive personal data (for example health data or identity documents) or payment card details through our forms.
2a. Confidentiality of customer, supplier, RFQ and project information
We treat customer, supplier, RFQ and project information as confidential, including documents uploaded to private project rooms and project workspaces. We do not publish it, do not disclose it publicly and do not use it for marketing.
Access is limited to authorised FishMatch personnel and to service providers (processors) who need it to provide the service you requested. We disclose it to another party only where needed for that service — for example to a party you choose to engage, as described in section 5 — or where the law requires it. Financing introductions need the separate consent described in section 5a. Supplier identities are not shown to buyers on the Platform; introductions are staff-mediated.
Private areas (project rooms, project workspaces, the buyer portal, staff screens and uploaded files) require sign-in and are marked so search engines do not index them. See section 10 for the safeguards we have verified.
3. Why we use personal data, lawful basis and how long we keep it
| Purpose | Data | Lawful basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Handle a quote, sourcing or project request (RFQ forms, seafood buyer brief, WhatsApp brief, calculators that send a request) | Name, business email, phone/WhatsApp, company, role, country, project or product details, budget range, timing, files you upload, notes | Steps you ask us to take before a contract (Art. 6(1)(b)); where you act for a company, our legitimate interest in handling the business request it made (Art. 6(1)(f)) | While the request and any resulting project are active, then for as long as needed for legal claims and record-keeping. No automatic deletion deadline is implemented yet: we delete or anonymise on request where no legal reason to keep the data applies. |
| Review supplier, manufacturer and producer/exporter applications and run approved profiles | Business and contact details, role, products, capacity, certifications you declare, documents you upload, accepted terms | Contract or steps before a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for company representatives | While the application or profile is active, then as for requests. Records of accepted producer terms cannot be edited and are kept as evidence of the agreed terms for as long as claims about them are possible. |
| Run accounts, private project rooms, the buyer portal and workspaces | Login email, account identifiers, project data and documents you add | Contract (Art. 6(1)(b)) | While the account is open; deleted or anonymised on request, subject to legal retention. |
| Answer contact messages and privacy requests | Name, email, company, message; for privacy requests the request type and how we handled it | Legitimate interests (Art. 6(1)(f)); for privacy requests, our legal obligation (Art. 6(1)(c)) | Messages: as long as needed to answer and follow up. Privacy requests: a record of the request and how it was handled is kept to demonstrate accountability. |
| Keep a record of business calls, WhatsApp messages and emails about a request | Contact details, message or call content and transcripts linked to your request | Legitimate interests in an accurate record of business communications (Art. 6(1)(f)) | As for the related request. |
| Send email updates, checklists by email and other marketing | Email, optional name/company/country, the exact consent wording, time, IP address and browser | Consent (Art. 6(1)(a)), given with a separate unticked box | Until you unsubscribe or withdraw consent; the consent record is kept as proof of consent. |
| Optional cookies and similar technologies (Analytics, Marketing) | See the cookie list below | Consent (Art. 6(1)(a) and the ePrivacy rules), via the cookie choices | Your choice is remembered for 12 months; see the cookie list for each item. |
| Security, spam prevention, fraud prevention and keeping the site working | IP address (used briefly for rate limits), technical logs, strictly necessary storage | Legitimate interests (Art. 6(1)(f)) | Short technical retention set by our hosting providers; rate-limit counters are temporary. |
| Regulatory and sanctions screening of products, origins and requests | Company, product, origin/destination and request details; staff decision and source | Legal obligation where it applies (Art. 6(1)(c)); otherwise legitimate interests (Art. 6(1)(f)) | As long as needed to show the check was made. |
| Financing preparation and possible introductions | See section 5a | Separate consent (Art. 6(1)(a)) plus steps before a contract | See section 5a. |
Where we rely on legitimate interests, we have weighed them against your rights; you can object at any time (section 8). Backups of the database are rotated so that only the three most recent daily copies are kept.
4. Content downloads & checklists
When you ask for a downloadable resource by email (for example the Commercial Aquaculture Project Checklist), we ask you to tick an unticked consent box with this exact wording:
"I agree that FishMatch Group may contact me by email about aquaculture procurement, financing, and related content. I can unsubscribe at any time. See our Privacy Policy."
If you tick the box we store your email, optional name / company / country, the page you downloaded from, the exact consent wording, timestamp, IP address and browser user-agent (GDPR Art. 7 record of consent). A “Direct PDF (no email)” link is offered next to every download, so you never need to agree to marketing to get the file. You may withdraw consent at any time via any email's unsubscribe link or the privacy request form. Withdrawal does not affect processing before it.
Ticking the box that lets us contact you about a quote request is not marketing consent: we record it as permission to answer that request only.
5. Who receives personal data
A general RFQ does not permit sharing with financing providers. Procurement requests are reviewed by the authorised FishMatch team. Your contact details are shared with a supplier or other third party only as part of the service you asked for and the staff-mediated introduction process; that party then acts as an independent controller.
These service providers process personal data for us, under each provider's data-processing terms:
| Provider | What they do for us | Where |
|---|---|---|
| Lovable (Lovable Cloud) | Website and application hosting, database, sign-in, private file storage and sending our notification emails | Database hosted in the EU (Stockholm, Sweden); the website is served through a global network |
| Cloudflare (through our hosting) | Content delivery and bot/security protection (sets the __cf_bm cookie) | Global network, including outside the EEA |
| AI models through Lovable's AI service (Google and OpenAI models) | Website assistant chat, help with drafting request briefs, translation and staff research tools | May be processed in the United States |
| Google — Analytics and Ads | Only with your Analytics or Marketing consent: visit statistics, ad conversion measurement and remarketing | United States and other countries |
| Google Workspace (Gmail) | Our team mailbox; emails about FishMatch requests are copied into our private CRM | United States and other countries |
| TimelinesAI | Copies WhatsApp conversations with our team into our private CRM | Outside the EEA may apply — to be confirmed with the provider |
| Zadarma | Business telephone line; call details, transcripts and recordings are linked to the matching request and kept in private staff-only storage | To be confirmed with the provider |
| VirusTotal | Checks uploaded files for malware using only the file's fingerprint (hash) — the file itself is not sent | No personal data is sent |
We may also disclose data where the law requires it, for example to a competent authority.
5a. Separate financing preparation and introduction consent
The financing form records a required request for private procurement preparation and a separate optional interest in discussing an introduction. Interest does not authorize sharing. We store the exact wording, version, server timestamp, signed-in user identity and source page with the private request. Data categories include company/contact details, country, project scope and figures, financing amount, operating history and buyer-submitted notes; recipients at submission are the authorized FishMatch team and service processors, not financing providers. No provider API or automatic dispatch is used, and requests are not transferred to parent or sister-platform CRMs.
Before any later transfer, FishMatch must identify the independent provider/recipient category, exact data, purpose of evaluating the requested introduction, destination countries, transfer safeguards and recipient retention terms, and collect new separate explicit consent. No provider or destination country is currently selected by this form: transfer is blocked until that disclosure, consent, provider confirmation and local legal review. Do not send unnecessary personal financial records or sensitive documents in free text.
Preparation requests and consent audit records remain with the private request for the service and applicable lawful retention. No automatic deletion deadline is currently implemented. You may withdraw introduction interest or consent, or request deletion, through the privacy request form. Withdrawal stops future consent-based sharing but does not undo lawful prior processing; any independent recipient must also be notified.
6. International transfers
Our database is hosted in the EU. Some providers in section 5 process data in the United States or other countries outside the European Economic Area. For those transfers we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses included in the provider's data-processing terms. You can ask us for more information about these safeguards through the privacy request form.
7. Retention
The table in section 3 sets out how long we keep each kind of data or the criteria we use. In general we keep data only as long as needed for the purpose it was collected for, to meet legal, tax and audit obligations, and to establish, exercise or defend legal claims. We do not yet run automatic deletion of old requests; we review and delete or anonymise data on request where no legal reason to keep it applies.
8. Your rights
Under the GDPR you have these rights. Some depend on the lawful basis we use and on your circumstances:
- Access — a copy of your personal data and information about how we use it.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — deletion where, for example, the data is no longer needed or you withdraw consent, unless we must keep it (for example for legal obligations or legal claims).
- Restriction — limiting use while, for example, accuracy or an objection is being checked.
- Portability — your data in a structured, machine-readable format where we process it by consent or contract and by automated means.
- Objection — to processing based on legitimate interests, and at any time to direct marketing.
- Withdraw consent — at any time, without affecting processing before withdrawal. For cookies use ; for emails use the unsubscribe link.
- Complaint — to the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy) or to the supervisory authority where you live or work (list of EU authorities).
How to make a request: use the privacy request form or email privacy@fishmatchgroup.com. We reply within one month of receipt; for complex or numerous requests this can be extended by up to two further months, and we will tell you within the first month. We may ask you to confirm your identity before acting. Requests are free unless they are manifestly unfounded or excessive.
8a. Users outside the EU
Users contact us from many countries, and privacy laws such as the UK GDPR, US state laws (for example California's CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA and Quebec Law 25, and South Africa's POPIA may apply depending on where you are and on how we serve you. We have not confirmed that every one of these laws applies to us. We handle access, correction, deletion, portability, objection and consent-withdrawal requests from any country through the privacy request form, and we aim to reply within the period the applicable law sets.
Sale and sharing. We do not sell personal information. Google Ads measurement and remarketing run only if you allow Marketing cookies; under some US state laws that can count as “sharing” for targeted advertising. You can opt out with “Reject all”, , or a browser Global Privacy Control signal, which this site treats as a Marketing opt-out.
Our Privacy & Compliance page lists the laws that may apply by region, the rights they give, the authorities you can complain to, and what we are still completing (such as publishing registered company details and naming privacy contacts where a law requires one).
9. Automated decision-making & AI
The Platform uses AI-assisted tools to help draft request briefs, suggest possible suppliers, translate content, prepare insights and answer questions. These tools do not make decisions with legal or similarly significant effects about you within the meaning of GDPR Art. 22: our team reviews requests and introductions. AI output is informational only — see the AI Content Disclaimer in our Terms of Service and Disclaimer.
10. Security
Safeguards we have checked on the live Platform:
- Connections to fishmatchgroup.com use HTTPS (encryption in transit), and browsers are instructed to use secure connections only (HSTS).
- Project rooms, project workspaces, the buyer portal, staff screens and uploaded files require sign-in. Database and file-storage access rules limit each record or file to the account that owns it and to authorised staff.
- File storage is private: files are not published at public addresses, and downloads use short-lived links issued after sign-in.
- Private areas are excluded from search-engine indexing.
- Automatic backups are password-protected with AES-256 encryption.
We also use logging, monitoring and least-privilege access for staff. No online system is completely secure and we cannot rule out every risk; we do not claim otherwise. Please use strong, unique passwords and contact security@fishmatchgroup.com immediately if you suspect unauthorised access. Security researchers: see the Responsible Disclosure section of our Terms.
11. Sanctions, trade-restriction and regulatory screening
Where appropriate, we process limited personal and company data to check requests, products, origins and destinations against sanctions, trade restrictions and applicable regulatory requirements. Staff decisions and their sources are recorded. Legal bases are compliance with legal obligations where they apply and our legitimate interest in not facilitating prohibited trade.
12. Cookies and similar technologies
Strictly necessary storage is always on because the site cannot work properly without it. Analytics and Marketing items are used only after you accept them in the cookie choices; until then Google's scripts are not loaded at all. Rejecting is as easy as accepting, and you can change or withdraw your choice at any time with (also in the footer of every page). If your browser sends a Global Privacy Control signal, Marketing stays off even if it was accepted earlier. When you withdraw, we delete the analytics or marketing cookies this site set; cookies set on Google's own domains (such as doubleclick.net) can only be removed in your browser or Google account settings.
| Name | Category | Purpose | Duration |
|---|---|---|---|
| fmg_cookie_consent (cookie + local storage) | Strictly necessary | Remembers your cookie choice | 12 months |
| Sign-in session (local storage) | Strictly necessary | Keeps you signed in to your account | Until you sign out |
| __cf_bm (Cloudflare) | Strictly necessary | Bot and abuse protection | About 30 minutes |
| __dpl | Strictly necessary | Set by our hosting to serve the current version of the site | Session |
| skymatch.lang, translation cache (cookie + local storage) | Strictly necessary (preference) | Remembers the language you chose | Until cleared |
| Saved drafts and calculator inputs (local/session storage, e.g. fm-*, fmg.*, fishmatch.*) | Strictly necessary (feature you use) | Keeps form drafts, calculator scenarios, planner inputs and chat history on your device so you do not lose them | Session, or until you clear them |
| fmg_session_id, fmg_attribution, fmg_last_content_page (session storage) | Analytics | Our own visit statistics and how you arrived (campaign, referrer) | Until the browser tab closes |
| _ga, _ga_* (Google Analytics) | Analytics | Distinguishes visits for statistics | Up to 2 years (set by Google) |
| _gcl_au, _gcl_ls (Google Ads) | Marketing | Measures ad conversions | Up to 90 days (set by Google) |
| IDE and similar (doubleclick.net, Google) | Marketing | Google advertising and remarketing; set on Google's own domain | Set and controlled by Google |
Links to WhatsApp (wa.me) and LinkedIn open those services only when you click them; their own privacy policies then apply.
13. Children
The Platform is a B2B service intended for professional use and is not directed at children under 16. We do not knowingly collect personal data from children.
14. Changes
We may update this Policy. Material changes will be shown on the Platform and reflected in the version number and “Last updated” date above.
15. Related policies
Terms of Service · Disclaimer · Legal Notice · Accessibility Statement · Trust Center
16. Contact
Privacy requests: privacy request form or privacy@fishmatchgroup.com · Security: security@fishmatchgroup.com · Compliance: compliance@fishmatchgroup.com.