Privacy & Compliance
Status as of 23 October 2026
FishMatch Group is a business-to-business sourcing service for aquaculture, seafood, fish and shrimp projects. Buyers, suppliers and project owners contact us from many countries. This page explains, in plain language, which privacy rules may apply to that work, what we have put in place, and what is still being completed.
Which privacy laws may apply
Whether a law applies depends on where people are, whether we offer services to them and the size and type of processing. We do not assume every law below applies to us; we list the ones that may, given where our users are.
| Where | Law | When it may apply | Our status |
|---|---|---|---|
| EU / EEA | GDPR and ePrivacy (cookie) rules | The platform is operated from Cyprus and serves EU users | Core measures in place; legal review pending |
| United Kingdom | UK GDPR, Data Protection Act 2018, PECR | When we offer services to people in the UK | Same measures as for the EU; UK representative question open |
| United States | California CCPA/CPRA and other state privacy laws | Only for businesses that meet each law's thresholds — not yet confirmed for us | No sale of personal information; marketing opt-out and Global Privacy Control honoured |
| Brazil | LGPD | When we offer services to people in Brazil or process data collected there | Rights handled through our privacy request form; data-protection officer not yet published |
| Canada | PIPEDA; Quebec Law 25 | When we collect personal information in the course of commercial activity in Canada | Rights handled on request; Quebec person in charge not yet published |
| South Africa | POPIA | When we process personal information of people in South Africa through means there | Rights handled on request; information officer registration not yet confirmed |
| Other markets | For example UAE, Saudi Arabia, India, Japan, South Korea, Türkiye, Israel, the Philippines | Depends on local rules and how we serve users there | Under review; we apply the same baseline practices |
What is in place today
- Optional analytics and marketing tags do not load until you choose. Accept, Reject and Preferences are equally easy, and “Cookie settings” in every page footer lets you change your choice.
- If your browser sends a Global Privacy Control signal, Marketing stays off on this site.
- We do not sell personal information. Google Ads measurement and remarketing run only with Marketing permission; under some US state laws that can count as “sharing” for targeted advertising, and you can opt out with Reject, Cookie settings or Global Privacy Control.
- Request and registration forms say what the information is used for, who can see it and how long it is kept. Marketing emails need a separate, unticked opt-in.
- Buyer and supplier details are shared only through our staff-reviewed process. Uploaded files are private — visible only to the account that uploaded them and to authorised staff — and open through short-lived links.
- Signed-in areas are excluded from search engines.
- A privacy request form lets you ask for access, correction, deletion, portability or objection, or withdraw consent.
Your rights by region
EU, EEA and United Kingdom
Access, correction, deletion, restriction, portability, objection (including to direct marketing) and withdrawal of consent. You can complain to your data-protection authority, for example the Cyprus Commissioner for Personal Data Protection or the UK Information Commissioner's Office.
California and other US states
Where a state law applies to us: to know what we collect, to delete and correct it, to opt out of sale or sharing for targeted advertising, and not to be treated differently for using these rights. You may use an authorised agent. We do not intend to collect sensitive personal information.
Brazil
Confirmation and access, correction, anonymisation or deletion of unnecessary data, portability, information about who we share data with, and withdrawal of consent. You can complain to the ANPD.
Canada and Quebec
Access and correction of your personal information and withdrawal of consent, subject to legal limits. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
South Africa
Access, correction and deletion, and objection to processing, including for direct marketing. You can complain to the Information Regulator.
How to make a request
Use the privacy request form or email privacy@fishmatchgroup.com. We may ask you to confirm your identity. We aim to reply within the period the applicable law sets — for example one month under the GDPR or 45 days under California law — and will tell you if we need longer.
What is still being completed
- Publishing the registered company name, registration number and registered address of the operating entity.
- Naming the people responsible for privacy where some laws require it (for example a Quebec person in charge, a POPIA information officer, an LGPD data-protection officer, or an EU or UK representative).
- Fixed retention periods with automatic deletion; today we delete or anonymise on request where no legal reason to keep the data applies.
- Confirming processing locations and transfer safeguards for some service providers, such as our WhatsApp messaging and phone-call services.
- Native-speaker review of translated privacy pages, and independent legal review.
Data-protection authorities
- Cyprus — Commissioner for Personal Data Protection
- EU — European Data Protection Board (list of authorities)
- United Kingdom — Information Commissioner's Office
- California — California Privacy Protection Agency
- Brazil — ANPD
- Canada — Office of the Privacy Commissioner
- Quebec — Commission d'accès à l'information
- South Africa — Information Regulator