Privacy & Compliance
Privacy & Compliance overview
Last reviewed:
SeedMatch Group is a private, human-led procurement platform for commercial agriculture projects. This page summarises in plain language the privacy controls in place on this website today and the points still being reviewed with legal advisers. The Privacy Policy and Cookie Policy remain the full statements.
What is in place
- Optional analytics (Google Analytics, Tag Manager and our own visit statistics) and Google Ads measurement run only after you opt in. Until you choose, Google Consent Mode is set to “denied”, and continuing to browse is not treated as consent.
- “Reject all” is as easy as “Accept all”. You can change or withdraw your choice at any time under “Cookie settings”; withdrawing deletes the Google cookies set on this site.
- If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out: analytics and advertising measurement stay off on that browser.
- Forms that collect personal data show a short notice linking to the Privacy Policy. Sending a request is not consent to marketing, and newsletter sign-up needs a confirmation email.
- Sharing a financing request with an independent financing provider needs a separate, optional box. We record the date and wording of that consent, and our systems block recorded sharing without it.
- Buyers and suppliers are not connected automatically: requests are reviewed by our team and communication runs through SeedMatch Group.
- Security measures include HTTPS, our hosting provider's encryption of stored data, access rules on every database table, private file storage, role-based staff permissions and audit records for sensitive CRM actions. No system is perfectly secure.
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) can be sent through a dedicated form. Requests are stored with access limited to administrators, and we aim to reply within one month.
Your choices
Change your cookie choice, send a privacy request, or read the full policies:
Participant responsibilities
- Global B2B Group and its platforms, including SeedMatch Group, are committed to conducting their own activities in accordance with applicable laws and regulations.
- SeedMatch Group facilitates sourcing and reviewed requests for quotation (RFQs). It does not itself manufacture, breed, grow, pack or export the products discussed on this site.
- Each participant is responsible for the legal requirements that apply to its own role, as determined by applicable law.
- Suppliers, producers and exporters are responsible for ensuring that the products they offer and supply meet the applicable product, safety, quality, licensing, certification, labelling, traceability, sanitary or phytosanitary, export, customs and documentation requirements in the countries of origin and destination, where relevant.
- Buyers and importers remain responsible for their own import permissions, local requirements and due diligence.
- Requirements differ by product and by country. No single checklist applies everywhere.
Examples for the products on this site, where relevant
- Seeds and plant varieties: variety registration or listing, seed certification and labelling, plant variety rights, phytosanitary certificates and import permits.
- Fertilizers and other crop inputs: product registration or authorisation, labelling and safety information, and restrictions on certain substances. Pesticides are never offered without explicit official approval in the destination country.
- Greenhouses, irrigation and equipment: product-safety and conformity rules of the destination market, technical documentation and installation requirements.
- Harvested produce and other agricultural products: food-safety and residue limits, sanitary or phytosanitary certificates, registered production sites and packhouses where a protocol requires them, traceability and labelling.
We do not guarantee any supplier's compliance. Our review of requests and documents does not replace a participant's own checks, an official approval or legal advice, and no agreement between participants removes responsibilities that the law places on a party. We describe a certification or check as completed only where we have evidence of it.
Still under review
These points are open. Until they are settled we do not describe them as complete:
- The registered company name, registration number and registered address to be named in the Privacy Policy.
- Specific retention periods for each type of record (today, retention is decided by staff review).
- Whether a representative in the EU or UK, a local privacy officer or a registration with a data protection authority is required in particular countries. No data protection officer has been appointed.
- Documentation of the safeguard used for each international data transfer.
- A notice for call recording and transcription.
- Native-speaker and legal review of translated privacy texts. The Privacy Policy and Cookie Policy are currently available in English only.
Law-by-law review
Which rules apply depends on where users are, where we are established and what data is processed. For each framework most relevant to the markets we serve, this section sets out when it can apply, the controls in place on this site and the points still open for legal review.
European Union
General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679 · Regulator: The data protection authority of each EU member state
- When it can apply
- Applies to organisations established in the EU, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Article 3).
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request. It lists a legal basis for each purpose (Article 6).
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators. We aim to reply within one month.
- HTTPS, our hosting provider's encryption of stored data, access rules on every database table, private file storage, role-based staff permissions and audit records for sensitive CRM actions.
- Open points for legal review
- Naming the registered company, registration number and registered address in the Privacy Policy.
- Setting a retention period for each type of record (today retention is decided by staff review).
- Documenting the safeguard used for each international transfer, provider by provider.
- Whether an EU representative (Article 27) or a data protection officer is required. No data protection officer has been appointed.
- A notice for call recording and transcription.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
European Union
ePrivacy Directive (cookie rules)
Directive 2002/58/EC, as amended, and national laws implementing it · Regulator: National data protection or communications authorities
- When it can apply
- Storing or reading information on a user's device, such as cookies, needs consent unless it is strictly necessary for a service the user asked for (Article 5(3)).
- What is in place on this site
- Optional analytics and advertising measurement run only after opt-in; “Reject all” is as easy as “Accept all”, and Google Consent Mode defaults to “denied”.
- Only strictly necessary storage (sign-in, language, your cookie choice, form progress) runs without a choice; a choice is asked again after 365 days.
- Withdrawing consent under “Cookie settings” deletes the Google cookies set on this site.
- Open points for legal review
- Legal review of the cookie banner wording and the Cookie Policy, including translations.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
Cyprus
Cyprus data protection law
Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data · Regulator: Commissioner for Personal Data Protection
- When it can apply
- Supplements the GDPR in Cyprus. The Privacy Policy names the Cyprus Commissioner as a complaint route because the platform is operated from Cyprus.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request.
- The Privacy Policy explains the right to complain to a supervisory authority and names the Cyprus Commissioner.
- Open points for legal review
- Naming the registered company, registration number and registered address in the Privacy Policy.
- Confirming whether “operated from the Republic of Cyprus” matches the London office shown on the contact page.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
United Kingdom
UK GDPR, Data Protection Act 2018 and PECR
UK GDPR; Data Protection Act 2018; Privacy and Electronic Communications (EC Directive) Regulations 2003 · Regulator: Information Commissioner's Office (ICO)
- When it can apply
- UK GDPR applies to organisations established in the UK and to some outside the UK that offer goods or services to, or monitor, people in the UK. PECR covers cookies and electronic marketing.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request.
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Optional analytics and advertising measurement run only after opt-in; “Reject all” is as easy as “Accept all”, and Google Consent Mode defaults to “denied”.
- Newsletter sign-up needs a confirmation email, and submitting a form never signs anyone up for marketing.
- Open points for legal review
- Whether a UK representative or an ICO data protection fee is required.
- Documenting the safeguard used for each international transfer, provider by provider.
- Setting a retention period for each type of record (today retention is decided by staff review).
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
United States (California)
California Consumer Privacy Act, as amended by the CPRA
California Civil Code §1798.100 and following · Regulator: California Privacy Protection Agency and the California Attorney General
- When it can apply
- Applies to for-profit businesses that do business in California and meet thresholds set in the law (based on revenue or on the volume of consumers' personal information handled).
- What is in place on this site
- The Privacy Policy states that we do not sell personal data.
- A browser Global Privacy Control (GPC) signal is treated as an opt-out: analytics and advertising measurement stay off on that browser.
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Open points for legal review
- Whether SeedMatch Group meets the thresholds, and therefore whether California-specific notices and request methods are required.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
Brazil
Lei Geral de Proteção de Dados (LGPD)
Lei nº 13.709/2018 · Regulator: Autoridade Nacional de Proteção de Dados (ANPD)
- When it can apply
- Applies when personal data is processed in Brazil, when the processing aims to offer goods or services to people in Brazil, or when the data was collected in Brazil (Article 3).
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request. A Portuguese translation is available for reading (not yet natively or legally reviewed).
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Open points for legal review
- Whether a person in charge of data processing (encarregado) must be named.
- Documenting the safeguard used for each international transfer, provider by provider.
- Setting a retention period for each type of record (today retention is decided by staff review).
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
Canada
PIPEDA and Quebec's Law 25
Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5); Quebec Act respecting the protection of personal information in the private sector, as amended by Law 25 · Regulator: Office of the Privacy Commissioner of Canada; Commission d'accès à l'information du Québec
- When it can apply
- PIPEDA covers personal information handled in the course of commercial activity in Canada; Quebec's private-sector law covers enterprises handling personal information of people in Quebec.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request.
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Optional analytics and advertising measurement run only after opt-in; “Reject all” is as easy as “Accept all”, and Google Consent Mode defaults to “denied”.
- Open points for legal review
- Whether a person responsible for personal information must be named for Quebec.
- Documenting the safeguard used for each international transfer, provider by provider.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
South Africa
Protection of Personal Information Act (POPIA)
Act 4 of 2013 · Regulator: Information Regulator
- When it can apply
- Applies to responsible parties domiciled in South Africa, or not domiciled there but using means in South Africa to process personal information.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request.
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- HTTPS, our hosting provider's encryption of stored data, access rules on every database table, private file storage, role-based staff permissions and audit records for sensitive CRM actions.
- Open points for legal review
- Whether an Information Officer must be registered with the Information Regulator.
- Documenting the safeguard used for each international transfer, provider by provider.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
Türkiye
Personal Data Protection Law (KVKK)
Law No. 6698 · Regulator: Personal Data Protection Authority (KVKK)
- When it can apply
- Covers the processing of personal data of individuals. Certain data controllers, including some located outside Türkiye, must register in the Data Controllers' Registry (VERBİS).
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request. A Turkish translation is available for reading (not yet natively or legally reviewed).
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Open points for legal review
- Whether SeedMatch Group must register in VERBİS or appoint a representative in Türkiye.
- Whether a Turkish-language information notice in a specific form is required.
- Documenting the safeguard used for each international transfer, provider by provider.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
United Arab Emirates
Personal Data Protection Law (PDPL)
Federal Decree-Law No. 45 of 2021 · Regulator: UAE Data Office
- When it can apply
- Covers processing of personal data of people in the UAE, including by some organisations outside the UAE. Financial free zones such as DIFC and ADGM have their own data protection laws.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request. An Arabic translation is available for reading (not yet natively or legally reviewed).
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- HTTPS, our hosting provider's encryption of stored data, access rules on every database table, private file storage, role-based staff permissions and audit records for sensitive CRM actions.
- Open points for legal review
- Which obligations apply to SeedMatch Group and from when.
- Documenting the safeguard used for each international transfer, provider by provider.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
Saudi Arabia
Personal Data Protection Law (PDPL)
Issued by Royal Decree No. M/19 of 1443H, as amended · Regulator: Saudi Data & AI Authority (SDAIA)
- When it can apply
- Covers processing of personal data in Saudi Arabia, including processing by organisations outside the Kingdom of personal data of people living there.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request. An Arabic translation is available for reading (not yet natively or legally reviewed).
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Open points for legal review
- Whether registration on the national data governance platform or a representative is required.
- Documenting the safeguard used for each international transfer, provider by provider.
- Setting a retention period for each type of record (today retention is decided by staff review).
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
India
Digital Personal Data Protection Act (DPDP Act)
Act No. 22 of 2023 · Regulator: Data Protection Board of India
- When it can apply
- Covers digital personal data processed in India, and processing outside India connected with offering goods or services to people in India. Its obligations take effect through rules made by the government.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request. A Hindi translation is available for reading (not yet natively or legally reviewed).
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- Open points for legal review
- Which obligations apply under the government's rules and from when, including notice and grievance-contact requirements.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
Kenya
Data Protection Act
Act No. 24 of 2019 · Regulator: Office of the Data Protection Commissioner (ODPC)
- When it can apply
- Covers data controllers and processors established or ordinarily resident in Kenya, and those outside Kenya processing personal data of people in Kenya.
- What is in place on this site
- A Privacy Policy describing the data we collect, why, who receives it, international transfers and how to make a request.
- Privacy requests (access, correction, deletion, objection, consent withdrawal, marketing opt-out) through the privacy request form, stored with access limited to administrators.
- HTTPS, our hosting provider's encryption of stored data, access rules on every database table, private file storage, role-based staff permissions and audit records for sensitive CRM actions.
- Open points for legal review
- Whether SeedMatch Group must register with the ODPC as a data controller.
- Documenting the safeguard used for each international transfer, provider by provider.
- Status
- Whether this law applies to SeedMatch Group, and what it requires of us, is under legal review. Nothing here states that we meet it.
- Official source
Official sources checked on . Laws change; always check the official text.
This list is not a statement that we meet every requirement of these laws, and the review is not finished.
About this page
This overview describes our practices. It is not legal advice, not a certification and not an official seal. The “Privacy & Compliance” label in the footer is an information link to this page.