Privacy Policy
Version 4.1 · Last updated:
Related: Terms · Cookies · Privacy request form · Acceptable Use · Compliance
1. Who we are
SeedMatchGroup ("SeedMatchGroup", "we", "us", "our") operates a private, human-led B2B sourcing and project-planning platform for professional buyers, agricultural project owners and institutional investors. Our sourcing specialists review project briefs and, where appropriate, approach suitable independent suppliers. We do not operate a public or automatic marketplace and do not manufacture, breed, install, warrant, insure or finance any product or project.
Controller. SeedMatchGroup, operated from the Republic of Cyprus, decides how personal data on this platform is used. SeedMatch Group is the specialised commercial agriculture platform of Global B2B Group, its parent group. The registered legal entity name, registration number and registered address will be added here once confirmed; until then, the contact routes in section 13 reach the team responsible for this platform. We have not appointed a data protection officer.
2. Categories of personal data we process
- Identification & contact: name, role, email, phone/WhatsApp, company, country, preferred language.
- Project & sourcing data: project type, crop, variety, area, location, budget range, timeline, permit status, financing needs, RFQ content, uploaded files and free-text notes.
- Business information: company registration, ownership, certifications and documents that suppliers, financing applicants or partners choose to provide.
- Account & authentication data: login identifiers, credentials (stored hashed by our sign-in provider), session tokens, security events.
- Communications: emails, WhatsApp messages, call records (time, duration, phone number) and call transcripts where our telephony provider produces one, and notes our team adds.
- Usage data (only with analytics consent): pages viewed, referrer and campaign tags, device type, language, time zone and a random per-tab session identifier.
- Technical data: IP address and browser information processed by our hosting provider and used briefly to limit abusive form submissions.
We do not ask for special-category data (such as health or political opinions). Please do not include it in free-text fields or uploads.
3. Purposes & legal bases (GDPR Art. 6)
| Purpose | Main data | Legal basis |
|---|---|---|
| Reviewing project briefs, RFQs, quote and contact requests, and replying to you | Identity, contact, company, project/RFQ details, files you upload | Steps you ask us to take before a contract (Art. 6(1)(b)); for business contacts, our legitimate interest in answering professional enquiries (Art. 6(1)(f)) |
| Creating and running buyer, supplier and partner accounts | Account identifiers, login data, profile and listing data | Contract (Art. 6(1)(b)) |
| Approaching suitable suppliers with the project details needed to assess fit (buyer identity minimised) | Project/RFQ details; contact details only when appropriate for the reviewed process | Legitimate interest in running the sourcing service you asked for (Art. 6(1)(f)); your instruction where required |
| Sharing a financing request with an independent financing provider | Company, contact, project and financing details | Your separate, optional consent (Art. 6(1)(a)) |
| Keeping records of business correspondence in our CRM (email, WhatsApp messages, call records and transcripts) | Contact details, message and call content, timestamps | Legitimate interest in managing business relationships and following up requests (Art. 6(1)(f)) |
| Intelligence updates / newsletter | Email, language, topics chosen | Consent, confirmed by email (Art. 6(1)(a)); unsubscribe link in every email |
| Website analytics and Google Ads measurement | Pages viewed, referrer and campaign tags, device type, language, cookie identifiers; hashed email/phone for ads conversions | Consent via the cookie banner (Art. 6(1)(a) and ePrivacy rules); off until you opt in |
| Security, abuse prevention and service reliability | IP address (for rate limiting), technical and error logs, account security events | Legitimate interest in keeping the service secure (Art. 6(1)(f)) |
| Accounting, tax, sanctions screening and responses to lawful requests | Business and transaction records | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests you can object at any time (section 7). Where we rely on consent you can withdraw it at any time; withdrawal does not affect processing that already took place.
Marketing. Submitting a form never signs you up for marketing. Intelligence updates are sent only after you subscribe and confirm by email. Any optional marketing choice on a form is separate and unticked by default.
4. Recipients, suppliers and RFQ disclosure
Submitting an RFQ does not publish it or send it automatically to suppliers. A sourcing specialist first reviews the request. If the project is eligible and sufficiently defined, SeedMatchGroup may share only the project information reasonably needed to assess fit and prepare a response with a limited selection of suitable suppliers. We may initially withhold or minimise buyer identity and direct contact details. Those details are disclosed only when appropriate for the reviewed process, with a lawful basis and, where required, the buyer's instruction or consent.
We use the following service providers and recipients:
| Recipient | What for | Role |
|---|---|---|
| Lovable (Lovable Cloud) | Website hosting, database, sign-in, file storage, transactional email delivery and the AI gateway used for triage, summaries and translations | Processor |
| Google Ads conversion measurement, Google Analytics and Tag Manager (only with consent); web fonts loaded from fonts.gstatic.com; the Gmail mailbox our team uses for project correspondence | Processor, and independent controller for some of its own purposes under Google's terms | |
| Resend | Delivery of intelligence-update emails to confirmed subscribers | Processor |
| Zadarma | Business telephony; call notifications and transcripts reach our mailbox and CRM | Processor |
| WhatsApp (Meta) | Messages you send us on WhatsApp | Independent controller under WhatsApp's terms |
| Global B2B Group (our parent group) | Group-level reporting of SeedMatch leads (status, owner, follow-up); contact details only where a staff member enables sharing for that lead | Group company |
| Independent suppliers and financing providers | Project details for a reviewed request; financing details only with your optional consent | Independent controllers |
We do not sell personal data. We may also disclose data where required by law or to establish, exercise or defend legal claims.
Sharing with financing providers. Submitting a financing or project request never requires consent to share it. If you tick the separate, optional box, we may share your company and contact details, country, project type, project and financing amounts, timeline and notes with an independent bank, export-credit agency, leasing or trade-finance provider relevant to your project, for the sole purpose of that provider assessing whether to discuss financing with you. We record the date and wording version of your consent; our systems block recorded sharing without it. We currently have no verified financing partnership. You can withdraw at any time through the privacy request form; withdrawal stops future sharing.
Advertising measurement. Only if you accept advertising measurement in the cookie banner: when you submit a form or use a contact link, we may send Google Ads a conversion event and, where you entered them, your email address and phone number in hashed (SHA-256) form so Google can match the conversion. Without that consent nothing is sent to Google.
5. International transfers
Some providers above (including Google, Resend, Meta and Lovable's infrastructure) may process personal data outside the European Economic Area, for example in the United States. Where that happens, the transfer relies on the safeguards in each provider's data-processing terms, such as an adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or the European Commission's Standard Contractual Clauses. You can ask us, through the contact routes in section 13, which safeguard applies to a given provider and for a copy of the relevant terms.
6. Retention
We keep personal data only as long as needed for the purpose it was collected for:
- Project requests and CRM records: while the project or business relationship is active and afterwards for as long as needed to follow up, keep accurate business records, meet accounting and tax duties, and defend legal claims.
- Accounts: until you ask us to close the account, then deleted or anonymised unless a legal duty requires us to keep part of it.
- Newsletter: until you unsubscribe; we keep a suppression record so we do not email you again.
- Consent choices: your cookie choice is stored in your own browser for 365 days from when you make it, then we ask again; you can change it sooner, and clearing browser storage removes it.
- Usage statistics: kept in aggregate-friendly form for trend and attribution reporting.
We do not yet run automatic deletion schedules. Records are reviewed and deleted manually, and always on a valid erasure request unless we must keep them by law.
7. Your rights and how to use them
Under the EU GDPR (and comparable laws elsewhere) you can ask us to: give you access to and a copy of your personal data; correct it; erase it; restrict its use; give it to you or another organisation in a portable format; and stop using it where we rely on legitimate interests or for direct marketing. You can withdraw consent at any time. These rights have legal conditions and exceptions; we will explain if one applies.
How to make a request: use the privacy request form or email support@seedmatchgroup.com. We may ask you to confirm your identity before releasing or deleting data. We aim to reply without undue delay and within one month, which the GDPR allows us to extend by up to two further months for complex requests, in which case we will tell you why. Requests are free unless they are manifestly unfounded or excessive.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where an alleged infringement took place. In Cyprus this is the Office of the Commissioner for Personal Data Protection. We would appreciate the chance to address your concern first.
8. Automated decision-making & AI
The platform uses proprietary technology and AI-assisted features for request triage, matching support, summaries, translations and calculators. These are decision-support tools. Supplier outreach, RFQ allocation and any commercial introduction remain subject to human review; the platform does not make solely automated decisions producing legal or similarly significant effects.
9. Security
We apply administrative, technical and organisational safeguards, including HTTPS for data in transit, our hosting provider's encryption of stored data, access rules on every database table, private file storage, role-based staff permissions and audit records for sensitive CRM actions. These measures reduce risk but cannot eliminate it: no system is perfectly secure. Please use strong, unique passwords and contact us immediately if you suspect unauthorised access. Security reports: see our Responsible Disclosure Policy or email support@seedmatchgroup.com.
10. Children
The platform is a B2B service intended solely for professional and business use. It is not directed to children under 16, and we do not knowingly collect personal data from children.
11. Cookies and similar technologies
We use strictly necessary browser storage (for example sign-in, language, your cookie choice and the progress of forms or calculators you fill in). Analytics (Google Analytics, Tag Manager and our own visit statistics) and Google Ads measurement run only after you opt in through the cookie banner, and you can change or withdraw your choice at any time via "Cookie settings" in the footer. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of these optional tools on that browser. Details are in the Cookie Policy; a plain-language summary of our privacy controls and open review points is on the Privacy & Compliance overview.
12. Changes
We may update this policy from time to time. The version and date above show the latest change; material changes will be highlighted on the website.
13. Contact
Privacy questions and rights requests: the privacy request form or support@seedmatchgroup.com.
This policy explains how we handle personal data. It is general information and not legal advice.