Privacy Policy
Version 4.3 · 24 October 2026 · English is the authoritative version
Draft 4.4 (AI buyer assistant) is awaiting counsel review and is not yet in force; text marked [counsel to confirm] will be finalised before publication.
Related: Cookie Policy · Privacy request form · Terms · Privacy & Compliance · Legal Center
1. Who is responsible for your data
FeedMatch Group ("FeedMatch", "we", "us") is the controller of the personal data described here. FeedMatch Group is a business-to-business animal-feed procurement platform operated from the Republic of Cyprus and part of the Global B2B Group. FeedMatch is not a feed manufacturer, trader or distributor and is not a party to supply contracts.
The registered company name, registration number and registered address of the operating entity are being confirmed for publication on this page. Until then, you can ask for them through the privacy request form. We have not appointed a data protection officer.
Contact for privacy matters: the privacy request form (recorded in our private request register and sent to the team that handles it) or privacy@feedmatchgroup.com.
2. What we use your data for, the legal basis and how long we keep it
Retention periods marked "target" are our policy; deletion is currently carried out by our team rather than automatically. You are not required to give us personal data, but without contact details we cannot answer a request.
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Reviewing and answering your sourcing, RFQ, project or contact request | Name, business email, phone/WhatsApp, company, country, the requirement you describe (products, volumes, budget range, timeline, files you upload), language and the page you sent it from | Steps you ask us to take before a contract (Art. 6(1)(b) GDPR); for business contacts acting for a company, our legitimate interest in answering business enquiries (Art. 6(1)(f)) | Engagement plus up to 7 years (target) |
| Contacting suppliers for you after human review | Project details needed to price your requirement; your identity and contact details only with your agreement | Steps before a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | As above |
| Managing our request register (CRM), follow-up and correspondence | The request, notes by our team, email and WhatsApp messages exchanged about that request | Legitimate interest in running and documenting our service (Art. 6(1)(f)) | Up to 36 months after last contact (target) |
| Buyer and supplier accounts | Sign-in email, password (stored by the sign-in service, not readable by us) or Google sign-in, name, company, language, account history | Contract (Art. 6(1)(b)) | While the account is active, up to 24 months after closure (target) |
| AI buyer assistant on the catalog (signed-in buyers, only when you tick the box) | Only the text you type into the assistant, after e-mail addresses, links and phone numbers are removed automatically. Your name, e-mail and account details are not sent to the AI service. | Your consent, given by ticking the box before each use (Art. 6(1)(a)) [counsel to confirm] | Not saved by FeedMatch: the text and suggestions are not written to our database; items you keep stay in your browser's shortlist until you clear it or send the request form. AI provider retention: [counsel to confirm against provider terms] |
| Center update emails you subscribe to | Email, optional name, topics, language, frequency, time and text of your consent | Consent (Art. 6(1)(a)); withdraw any time via the link in each email | Until you unsubscribe, plus a minimal suppression record |
| Optional financing information | Company, contact, country, budget, funding need, revenue and project background | Your separate consent (Art. 6(1)(a)) | Manual review; no automatic deadline yet |
| Site statistics (Google Analytics) | Pages viewed, approximate location from IP, device/browser, referrer, cookie identifiers | Consent where required, incl. the EEA, UK and Switzerland (Art. 6(1)(a) and ePrivacy rules); elsewhere legitimate interest, with opt-out in Cookie settings | Up to 14 months in identifiable form (Google setting target) |
| Advertising (Google Ads, Google Tag Manager): measuring ads and remarketing to past visitors | Ad click identifiers, pages visited, conversion events and, when you send a request, your email/phone hashed in your browser for conversion matching | Consent where required (Art. 6(1)(a)); elsewhere legitimate interest, with opt-out in Cookie settings | Per Google Ads retention; withdraw any time |
| Security, abuse prevention and backups | Technical logs, request metadata, database backups | Legitimate interest in keeping the service secure (Art. 6(1)(f)) | Short operational periods; backups on a rolling basis |
| Legal and accounting obligations, disputes | Records needed for tax, accounting, sanctions checks or to establish legal claims | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) | As the law requires |
Where we rely on legitimate interests, we have weighed them against your interests; you can object at any time (section 6). We do not use your data for decisions based solely on automated processing that have legal or similarly significant effects: lead scoring helps us sort requests, and a person reviews requests before suppliers are contacted. You can ask for human review at any time.
Optional financing information
The financing intake asks for separate consent. The consent version and time are recorded with the request. No transfer to a financier is enabled; any future introduction would need new consent naming the recipient, countries, data, purpose and retention.
The AI buyer assistant
Signed-in buyers can describe a need in their own words on the catalog and ask the assistant for a shortlist. The text is sent only after you tick the box for that request. Before it leaves our service, e-mail addresses, links and phone numbers are removed automatically; please do not type other personal or confidential details. The assistant only makes suggestions from our catalog and lists questions suppliers will ask: it does not decide anything about you, contact suppliers, submit a request or add prices, suppliers or certifications. You choose what to keep; nothing is sent to our team until you submit the request form. You can build a shortlist and request without the assistant.
3. Who receives your data
We use the following services to run the platform. They process data for us under their terms, except where noted.
- Lovable and its infrastructure providers: Website hosting, database, sign-in, file storage and transactional email delivery for this platform.
- Google: Google Workspace (our team mailbox, including copying request-related emails into our request register), Google sign-in if you choose it, and — only as described in Cookie settings — Google Analytics, Google Ads and Google Tag Manager.
- WhatsApp (Meta) and TimelinesAI: If you message us on WhatsApp, the conversation is handled in WhatsApp and copied into our request register through TimelinesAI.
- AI model providers through Lovable's AI gateway: Only when you use the site assistant, or tick the optional box to have your request notes rephrased (notes text only, without contact details). The catalog's AI buyer assistant currently uses an OpenAI model through Lovable's AI gateway; we ask the provider not to store the request. [Counsel to confirm the gateway and provider terms, their role and retention.]
- Selected suppliers: Only after our team reviews your request, and only the information needed to quote; they become independent controllers for what they receive.
We may also disclose data to professional advisers, or to authorities where the law requires it. We do not currently pass request data to other Global B2B Group platforms: if you ask about a product outside our scope, we point you to the relevant group site, where you decide whether to submit a separate request. We do not sell personal data or share it for others' own marketing.
Some US state privacy laws treat advertising cookies that let an ad platform show our ads to past visitors as "sharing" personal information for cross-context behavioural advertising. Where such a law applies to us, you can opt out at any time with "Your privacy choices" (the same control as Cookie settings) or by turning on Global Privacy Control in your browser.
4. International transfers
Some of the services above are run by companies, or use infrastructure, outside the European Economic Area, notably in the United States. Such transfers must rely on a European Commission adequacy decision (for example the EU-US Data Privacy Framework for certified companies) or on standard contractual clauses. We are still completing a provider-by-provider check of the safeguards in place; you can ask us for the current status and a copy of the relevant safeguards through the privacy request form. This includes the AI model provider used by the buyer assistant [counsel to confirm the transfer mechanism].
5. Cookies and similar technologies
Necessary storage (sign-in session, language, security, your cookie choice, form drafts) is always on. In the EEA, the UK and Switzerland — and whenever we cannot tell where you are — Google Analytics, Google Ads and Google Tag Manager load only after you choose to allow them; "Reject all" is as easy as "Accept all". Elsewhere these tools run unless you switch them off. You can change or withdraw your choice at any time with ; withdrawing does not affect measurement that took place before. Full list: Cookie Policy. If your browser sends a Global Privacy Control signal and you have not made a choice, advertising and remarketing tags stay off.
6. Your rights
Under the GDPR you may, free of charge:
- Access your data and receive a copy (Art. 15);
- Correct inaccurate or incomplete data (Art. 16);
- Delete your data where, for example, it is no longer needed or you withdraw consent (Art. 17);
- Restrict processing while a question is being resolved (Art. 18);
- Receive data you gave us in a portable format (Art. 20);
- Object to processing based on legitimate interests, and at any time to direct marketing (Art. 21);
- Withdraw consent at any time, without affecting earlier processing (Art. 7(3)).
Send requests through the privacy request form. Signed-in buyers can also request account deletion from their account page. We answer within one month; for complex or numerous requests we may extend this by two further months and will tell you why within the first month. We may ask you to confirm your identity, usually by replying from the email address you used with us. We may keep records the law requires us to keep, and will tell you if so.
Depending on where you are, other laws may give you similar rights — for example the UK GDPR, the Swiss Federal Act on Data Protection, Brazil's LGPD, Canada's PIPEDA and Quebec's Law 25, South Africa's POPIA, India's Digital Personal Data Protection Act or US state privacy laws. We handle every request through the same form, whatever your country, and do not treat you differently for using your rights. If we decline a request, we explain why, and you can ask us to reconsider by replying to our answer. Which of these laws apply to us is summarised, with open points, on Privacy & Compliance.
You also have the right to complain to a supervisory authority, in particular where you live or work, or where you think the law was broken. In Cyprus this is the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia (dataprotection.gov.cy). We would appreciate the chance to address your concern first.
7. Confidentiality and security
Confidentiality. Customer, supplier, RFQ and project information — including documents in private project rooms and files you upload — is confidential. We do not publish it and do not use it for marketing. Access is limited to authorised FeedMatch team members and the service providers listed in section 3 who need it to provide the service you asked for, or where the law requires disclosure. Selected suppliers receive only the project details they need to quote, after our team reviews the request; your contact details are passed on only with your agreement. The one advertising-related use is described in section 2: if you allow advertising cookies, your email/phone is converted into an irreversible code (hashed) in your browser so Google can measure whether an ad led to your request; the content of your request and your files are never used for this.
Controls in place today:
- Encryption in transit: connections to feedmatchgroup.com use HTTPS (TLS 1.2 or newer; older versions are refused) and browsers are instructed to use HTTPS only (HSTS). The website talks to its database and file storage over HTTPS.
- Access rules: database rules limit request, CRM, project-room and supplier records to the account holder they belong to, people that account holder invites into a project room, and authorised team roles. Signed-out visitors have no access to these records at all, and access to a request by email address works only once that address has been confirmed.
- Private files: uploaded documents are kept in private file storage with no public address. Only signed-in people with access can open them, and download links we create expire within minutes. A share link can be created only for a document that is not marked private, and it can be revoked or expire.
- Search engines: account, project-room, document and admin pages are marked so search engines do not index them and are left out of our sitemap.
- Backups: our own daily database backups are encrypted (AES-256-GCM) before they are stored.
- Uploads: some upload forms check files for executable content and blocked file types before storing them. This is a basic check, not a full antivirus scan.
We do not currently state that stored data is encrypted at rest, because we have not verified this for our hosting and storage providers; ask us through the privacy request form if you need their current documentation. No system is completely secure and we cannot guarantee that unauthorised access will never happen; this policy does not claim specific certifications. Please report suspected vulnerabilities under our Responsible Disclosure Policy. Where a personal-data breach is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, as Articles 33–34 GDPR provide.
8. Marketing
We send center update emails only to people who subscribe and confirm. Messages about a request you sent are service messages, not marketing. You can stop marketing at any time through the link in each email or the privacy request form.
9. Children
The platform is a business service for professional users aged 18 or over. We do not knowingly collect children's data.
10. Changes
We update this policy when our processing changes and show the version and date at the top. Earlier versions are listed below.
This policy describes our practices; it is not legal advice and does not claim certification or approval by any authority.
Changelog
Current version 4.4 · Last updated . Prior versions available on request from legal@feedmatchgroup.com.
- Version 4.4Draft — awaiting counsel review, not yet in force
- Added the catalog's AI buyer assistant: what is sent (your typed text, with e-mail addresses, links and phone numbers removed), that FeedMatch does not save it, the consent box, and that it only suggests and decides nothing.
- Named the model provider route for the assistant (OpenAI model via Lovable's AI gateway) and marked provider retention, role and transfer mechanism for counsel.
- Version 4.3
- Signed-out visitors no longer have any database access to request, CRM, project-room or supplier records.
- Access to a request by email address now requires a confirmed address.
- Confidentiality and form notices added in 18 more site languages (AI-drafted, pending native review).
- Version 4.2
- Global Privacy Control now switches advertising tags off when no choice was made.
- Explained US state-law "sharing" for remarketing cookies and the "Your privacy choices" control.
- Added rights under other laws (UK, Switzerland, Brazil, Canada, South Africa, India, US states) and a link to the Privacy & Compliance status page.
- Version 4.1
- Added a confidentiality statement for customer, supplier, RFQ and project information and project-room files.
- Listed the security controls in place today and those not verified (encryption at rest, full antivirus scanning).
- Version 4.0
- Named the services that process data (Lovable hosting and email, Google, WhatsApp/TimelinesAI, AI assistant).
- Added a purpose-by-purpose table of data, legal basis and retention.
- Added the online privacy request form and cookie-choice withdrawal.
- Corrected the earlier statement that no advertising measurement is used.
- Version 3.0
- GDPR-equivalent framework under Republic of Cyprus law.
- Documented subprocessors, retention windows and international transfers.
- Added data-subject rights procedure and privacy@ contact.
- Version 2.0
- Introduced RFQ and lead-enrichment data processing categories.
- Version 1.0
- Initial publication of Privacy Policy.