This notice explains how Global B2B Group complies with the EU General Data Protection Regulation (2016/679) and the UK GDPR, and how data subjects can exercise their rights. Read it together with the Privacy Policy.
1. Controller
Global B2B Group is the controller of the personal data collected through the Platform. Enquiries: legal@globalb2bgroup.com.
2. Lawful bases
- Consent — for optional marketing and non-essential cookies (Art. 6(1)(a)).
- Contract — to provide services you requested (Art. 6(1)(b)).
- Legal obligation — for compliance screening and record-keeping (Art. 6(1)(c)).
- Legitimate interest — to operate, secure and improve the Platform and to route your request (Art. 6(1)(f)).
3. Data subject rights
Subject to the conditions in the GDPR / UK GDPR you have the right to:
- Access your personal data (Art. 15);
- Rectify inaccurate data (Art. 16);
- Erasure ("right to be forgotten", Art. 17);
- Restrict processing (Art. 18);
- Data portability (Art. 20);
- Object to processing, including profiling, based on legitimate interest or direct marketing (Art. 21);
- Withdraw consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3));
- Lodge a complaint with a supervisory authority (Art. 77).
4. How to exercise your rights
Email legal@globalb2bgroup.com with the request and enough information for us to identify you. We will respond within one month (extendable by two months for complex requests) as permitted by Art. 12(3).
5. International transfers
Where personal data is transferred outside the EEA/UK, we rely on Standard Contractual Clauses, Adequacy Decisions, or equivalent lawful transfer mechanisms.
6. Automated decision-making
The Platform uses algorithms to route RFQs and rank suggestions but does not make decisions producing legal or similarly significant effects on data subjects solely by automated means without human review.
7. Retention
See section 7 of the Privacy Policy for retention periods.
8. Complaints
EU/UK data subjects have the right to lodge a complaint with their national supervisory authority. Where the lead authority is Cyprus, this is the Office of the Commissioner for Personal Data Protection.