Legal

Privacy Policy

Effective: May 2026 | ICO Registration: ZC135347 | Company No. 16641983

TradeMatch Pro Ltd takes the protection of personal data seriously. This Privacy Policy explains how we collect, use, store, and share personal data in connection with our Export Intelligence Report services.

1. Who We Are

TradeMatch Pro Ltd — Data Controller
Company Registration: 16641983
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Contact: privacy@tradematchpro.co.uk
ICO Registration Number: ZC135347

2. Data We Collect

Data Category	What It Includes	When Collected
Contact data	Name, job title, company name, email address, phone number	On Order or via cold outreach response
Order data	Report type, payment confirmation, Order reference	At point of purchase
Questionnaire data	Exporter details, target market, product, competitive context, specific questions	After Order confirmation
Communications	Emails and replies between Client and TradeMatch Pro	Ongoing during service delivery
Website usage	Pages visited, session duration, device type — anonymised via GA4	Automatically on site visit
Prospecting data	Company name, name, job title, email — sourced via Apollo and professional B2B contact databases	During outreach campaigns

2.1 Prospecting Data Accuracy

Business contact data used for B2B outreach may originate from third-party business information providers and may not always be current or complete. Where individuals believe their data is inaccurate, they may contact us at privacy@tradematchpro.co.uk to request correction or removal.

3. Lawful Basis for Processing

Processing Activity	Lawful Basis
Delivering a Report the Client has ordered	Contract performance (Article 6(1)(b) UK GDPR)
Processing payment via Stripe	Contract performance (Article 6(1)(b) UK GDPR)
Sending Order confirmation and delivery emails	Contract performance (Article 6(1)(b) UK GDPR)
Retaining Order and Questionnaire records	Legal obligation (Article 6(1)(c) UK GDPR) — HMRC retention requirements
B2B cold email outreach to business contacts	Legitimate interests (Article 6(1)(f) UK GDPR) — see Section 4
Website analytics via GA4	Consent (Article 6(1)(a) UK GDPR) — managed via cookie consent banner
Managing complaints and disputes	Legitimate interests (Article 6(1)(f) UK GDPR)

4. Legitimate Interests Assessment — Cold Email Outreach

TradeMatch Pro conducts B2B cold email outreach to business professionals. We rely on Legitimate Interests (Article 6(1)(f) UK GDPR) as our lawful basis.

Purpose: To inform export managers and commercial directors at commodity exporting companies about relevant Export Intelligence Reports.
Necessity: Cold email is a proportionate and standard method of B2B commercial outreach.
Balancing test: Recipients are business professionals whose contact details are sourced from professional B2B contact databases. Emails are relevant to their professional role, clearly identified as commercial outreach, and contain a visible unsubscribe mechanism.
Your right to object: Recipients may object to processing at any time by clicking the unsubscribe link in any email or by emailing info@tradematchpro.co.uk. Upon receipt of a valid objection, the individual will be removed from all outreach lists within five Working Days.

5. Third-Party Data Processors

Processor	Purpose	Location / Transfer Mechanism
Stripe	Payment processing	USA — SCCs with UK Addendum
Pipedrive	CRM — client and lead management	USA — SCCs with UK Addendum
Instantly	Cold email outreach campaign management	USA — SCCs with UK Addendum
Typeform	Questionnaire delivery and response collection	USA — SCCs with UK Addendum
Apollo.io	B2B contact data sourcing and enrichment	USA — SCCs with UK Addendum
ZeroBounce	Email list verification and bounce prevention	USA — SCCs with UK Addendum
Google Analytics (GA4)	Website usage analytics — pseudonymised data only	USA — SCCs with UK Addendum
Hostinger	Website hosting	EU — adequacy decision applies
Microsoft 365 / Outlook	Business email	USA — SCCs with UK Addendum

6. International Data Transfers

Several processors listed above are based in the United States. Transfers are made in compliance with UK data transfer requirements under the UK GDPR and the Data Protection Act 2018, using the ICO’s International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) with the UK Addendum. If you have questions about specific transfer mechanisms, please contact privacy@tradematchpro.co.uk.

7. Data Retention

Data Category	Retention Period and Basis
Order records and payment data	7 years from Order date — HMRC legal requirement
Questionnaire responses	3 years from Report delivery — legitimate interest in dispute resolution
Email correspondence	3 years from last contact — legitimate interest in service continuity
Cold outreach contact data	Until objection is received or 24 months of inactivity, whichever is sooner
Website analytics (GA4)	14 months — Google Analytics default, reviewed annually
Instantly campaign logs	12 months from campaign close

8. Your Rights

Under UK GDPR you have the following rights in respect of your personal data:

Right of access — request a copy of data held about you.
Right to rectification — request correction of inaccurate data.
Right to erasure — request deletion where there is no overriding legitimate reason to retain.
Right to restriction — request that processing be limited in certain circumstances.
Right to object — object to processing based on legitimate interests, including marketing.
Right to data portability — receive your data in a structured, machine-readable format.
Right to withdraw consent — where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, email: privacy@tradematchpro.co.uk. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS/HTTPS), restricted access to client data, and two-factor authentication on all service accounts holding personal data.

10–13. Further Provisions

Automated Decision-Making: We do not use automated decision-making that produces legal or similarly significant effects. AI tools assist human analysts only in data processing and drafting. All analytical outputs are reviewed and validated by a human analyst before delivery.
Data Breach Notification: In the event of a personal data breach likely to result in risk to individuals, TradeMatch Pro will notify the ICO within 72 hours and affected individuals where legally required.
Data Protection: TradeMatch Pro does not meet the threshold for mandatory DPO appointment under Article 37 UK GDPR. Data protection queries should be directed to privacy@tradematchpro.co.uk.
Changes to This Policy: We may update this Privacy Policy periodically. Material changes will be notified by posting a revised version on the website with an updated effective date.