Privacy Policy

3.1 Data you give us

Account registration. When you create a Buyer or Supplier account we collect your name, business email address, business phone number, company name, job title, country, and password.

Company and supplier profiles. Company description, product and service categories, certifications and capabilities as you report them, facility information, logos and images, contact persons, and other content you choose to publish.

Supplier verification. Business registration details, company documentation, and contact information submitted for verification, together with any certifications or audit reports you choose to upload.

Sourcing activity. Searches, saved suppliers, requests for quotation, sample requests, inquiries, and messages you send through the Platform.

Trade show participation. Registration details, sessions attended, booths visited, materials downloaded, and meetings booked.

Community content. Posts, comments, opportunities, and other content you publish to the community network.

Subscriptions and payments. Billing contact details and subscription selections. Payment card details are collected directly by Stripe — see Section 7.

Advertising. Advertiser contact details, campaign materials, targeting selections, and billing information.

Support and communications. Information you provide when you contact us, respond to a survey, or attend one of our events.

3.2 Data we collect automatically

We and our service providers use cookies, pixels, software development kits, server logs, and similar technologies to collect: IP address, browser and device type, operating system, language, referring and exit pages, pages and screens viewed, searches run, features used, booth and session attendance, dwell time, clickstream, and approximate location derived from IP address. See Section 8 and our Cookie Policy for detail and for your choices.

3.3 Data we obtain from other sources

• Business data providers. Company firmographics, industry classification, and business contact details used to build supplier coverage and improve matching.
• Publicly available sources. Company websites, public business registries, trade directories, and public professional profiles.
• Your colleagues. Where a colleague invites you to the Platform or adds you to a company account.
• Partners. Where you have consented to a co-marketing or event partner sharing your details with us.
• Advertising and analytics partners. Measurement and audience data.

Where we obtain personal data about you from a source other than you, and the GDPR or UK GDPR applies to that processing, we provide the information required by Article 14 within one month of obtaining the data, at our first communication with you, or at first disclosure to another recipient, whichever comes first.

5.1 With other Platform users

Sharing with Suppliers is driven by your action, not by browsing. Viewing a Supplier’s profile, running a search, or visiting a Supplier’s virtual booth does not disclose your identity or contact details to that Supplier. Suppliers receive aggregate booth and profile traffic statistics that do not identify individual visitors.

We share your name, business contact details, company, and the substance of your inquiry with a Supplier when you take an affirmative action to contact them — sending an inquiry or message, requesting a quote or a sample, booking a meeting, or expressly choosing to share your details.

For that sharing, IO Global and the Supplier act as joint controllers under the GDPR. The essence of our arrangement is that IO Global is responsible for providing this Policy, for the security of the Platform, and for the lawfulness of the initial disclosure; and the Supplier is responsible for its own use of your details after disclosure and for responding to your requests in relation to that use.

You may exercise your data protection rights against either IO Global or the Supplier, and neither of us will refuse a request on the basis of that allocation. Once a Supplier uses your details for its own purposes, including its own marketing, it acts as an independent controller and its own privacy notice applies.

Suppliers agree in our Supplier Terms to use Platform-sourced contacts only in connection with the Platform relationship, not to add them to general marketing lists without a lawful basis, and never to sell or transfer them. If a Supplier misuses your details, report it to support@ioglobalgroup.com and we will investigate.

Publicly visible information. Your company profile, product listings, booth content, and community posts are visible to other registered Platform users. Company profiles and listings are also visible to visitors who are not logged in, so that Suppliers can be found through search engines. Your individual contact details are never displayed publicly; they are shared only as described above. Do not publish anything you would not want visible to your competitors and customers.

5.2 With service providers

We share personal data with vendors who process it on our behalf under contract, in the following categories: cloud hosting and infrastructure; email delivery and marketing automation; product and web analytics; payment processing; customer support tooling; content moderation; virtual event infrastructure; identity verification and fraud prevention; and artificial intelligence and machine learning providers. Our current vendors are identified in our subprocessor list at ioglobalgroup.com/legal/subprocessors; those that set cookies are also identified in the cookie preference center. Our contracts require them to process personal data only on our instructions, to protect it, and to assist us in meeting our obligations to you.

5.3 With advertising partners

We use cookies, pixels, and similar technologies to deliver and measure advertising. This activity constitutes a sale or sharing of personal information under California law and targeted advertising under other U.S. state privacy laws.

The categories of personal data involved are identifiers, professional information limited to company and role, and browsing activity on our public marketing pages. The categories of recipients are advertising networks, social media platforms, and measurement and analytics providers.

We do not disclose your in-Platform sourcing activity to advertising partners. Searches, supplier and booth visits, requests for quotation, and stated requirements are excluded from all advertising and audience-building activity.

You can opt out at any time using the Your Privacy Choices link in the footer of every page, or by enabling the Global Privacy Control in your browser as described in Section 8.2.

5.4 With Ingredients Online

IO Global and Green Wave Ingredients, Inc. d/b/a Ingredients Online are separate companies operating as strategic growth partners. Each maintains its own systems, data, and data governance, and we do not transfer IO Global user data to Ingredients Online as a matter of course.

Where the two companies run a joint marketing activity, a co-hosted event, or a shared promotion, we will tell you at the point of collection who will receive your details and for what purpose, and — where consent is the applicable basis — we will ask for it before sharing. You may withdraw that consent, or object to the sharing, at any time by emailing privacy@ioglobalgroup.com.

Holding an account on one platform does not create an account on, or share your data with, the other.

5.5 For legal and safety reasons

We disclose personal data where we believe in good faith it is necessary to comply with law, legal process, or a government request; to enforce our terms; to protect the rights, property, or safety of IO Global, our users, or the public; or in connection with an investigation of suspected fraud or abuse.

5.6 Business transfers

If IO Global is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction. We will require the recipient to honor this Policy, or we will give you notice and an opportunity to object before any materially different practices take effect.

5.7 Aggregated and de-identified data

We create aggregated and de-identified data, including industry trend reporting, market insight, and benchmarking, that does not identify any individual. We may use and disclose this data for any lawful purpose. We maintain it in de-identified form, do not attempt to re-identify it, and contractually require recipients to do the same.

8.1 Cookies and similar technologies

We use strictly necessary cookies for authentication, security, and load balancing; functional cookies for preferences and language; analytics cookies to understand how the Platform is used; and advertising cookies to deliver and measure advertising. A current inventory of every cookie we set, its purpose, its provider, and its duration is maintained in the cookie preference center, reachable from the Cookie Settings link in the footer of every page. Our Cookie Policy at ioglobalgroup.com/legal/cookies explains the categories and your choices.

Where required, including in the EEA, the UK, and Switzerland, we obtain your consent before setting non-essential cookies. You may change or withdraw your choices at any time through the cookie preference center linked in the footer of every page.

8.2 Global Privacy Control and other opt-out preference signals

We detect and honor the Global Privacy Control and other opt-out preference signals that meet applicable legal requirements. When we receive such a signal from your browser or device, we treat it as a request to opt out of the sale and sharing of personal information and of targeted advertising for that browser or device, and — where you are logged in — for your account across all IO Global services.

You do not need to be logged in, submit a form, or verify your identity for us to honor an opt-out preference signal.

8.3 Do Not Track

Separately from the above, some browsers transmit a legacy “Do Not Track” signal. There is no common industry or legal standard for Do Not Track, and we do not respond to those signals. We do honor the Global Privacy Control as described in Section 8.2.

10.1 How to submit a request

• Online: ioglobalgroup.com/legal/privacy-request
• Email: privacy@ioglobalgroup.com
• Toll-free: 877.550.3600
• Opt out of sale and sharing: the Your Privacy Choices link in the footer of every page

We verify your identity before responding to a request to know, delete, or correct. We do not require identity verification to honor an opt-out request — opt-outs of sale, sharing, and targeted advertising are honored on receipt.

Authorized agents. You may use an authorized agent to submit a request. We may require the agent to provide written permission signed by you, and may require you to verify your own identity and confirm the agent’s authority, except where the agent holds a power of attorney.

Response times. We respond to verifiable requests within 45 days. Where reasonably necessary we may extend by a further 45 days, and we will tell you if we do and why.

10.2 Appeals

If we decline your request, you may appeal within 60 days by emailing privacy@ioglobalgroup.com with the subject line “Privacy Appeal,” together with your original request and the reason you believe our decision was incorrect. We will respond in writing within 60 days of receiving your appeal and explain our decision. If we deny your appeal, you may submit a complaint to your state Attorney General; contact details for each state Attorney General are available at ioglobalgroup.com/legal/state-attorneys-general.

10.3 California-specific disclosures

In the preceding 12 months we collected the categories of personal information listed in Section 2, from the sources listed in Section 3, for the purposes listed in Section 4. We sold or shared the categories marked as such in Section 2 with the categories of recipients listed in Section 5.3. We disclosed for a business purpose the categories listed in Section 2 to the categories of recipients listed in Sections 5.2 and 5.5. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Your Privacy Choices. California residents may exercise the right to opt out of the sale and sharing of personal information, and the right to limit the use and disclosure of sensitive personal information, using the Your Privacy Choices link in the footer of every page.

Shine the Light. California residents may request information about our disclosures of personal information to third parties for those third parties’ direct marketing purposes under California Civil Code section 1798.83 by contacting us at the details in Section 14.

10.4 Business contacts

Personal data about individuals acting on behalf of a business is fully protected under California law. Certain other state privacy laws apply only to individuals acting in a personal, family, or household capacity. We extend the rights described in this Section 10 to all of our users regardless of the capacity in which they act.

11.1 Controller and representatives

The controller of your personal data is IO Global Group, Inc., a Delaware corporation, 500 S Main St, #800, Orange, CA 92868, United States.

We have appointed representatives under Article 27 of the GDPR and Article 27 of the UK GDPR. Their names and contact details are published at ioglobalgroup.com/legal/representatives. You may contact either representative on any matter relating to our processing of your personal data. You may also contact us directly at the details in Section 14, and you retain the right to contact your supervisory authority.

11.2 Legal bases for processing

Where we rely on legitimate interests we have carried out an assessment balancing our interests against your interests, rights, and freedoms. You may request a summary of that assessment by emailing privacy@ioglobalgroup.com.

11.3 Your rights

You have the right to request access to, rectification of, and erasure of your personal data; to request restriction of processing; to data portability; to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and to lodge a complaint with a supervisory authority.

Your right to object. You have the right to object at any time, on grounds relating to your particular situation, to our processing of your personal data where we rely on legitimate interests. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless we need the data to establish, exercise, or defend legal claims.

Where we process your personal data for direct marketing, you have an absolute right to object. If you object, we will stop immediately.

To object, email privacy@ioglobalgroup.com or use ioglobalgroup.com/legal/privacy-request.

11.4 Complaints

Complain to us first. You may complain to us about our handling of your personal data at ioglobalgroup.com/legal/complaint, by emailing privacy@ioglobalgroup.com, or by post to the address in Section 14. We will acknowledge your complaint within 30 days, take appropriate steps without undue delay, respond in plain language, and tell you how to escalate if you are not satisfied. We aim to resolve complaints within three months.

Complain to a regulator. You also have the right to lodge a complaint with the supervisory authority in your country of habitual residence, your place of work, or the place of the alleged infringement. UK residents may complain to the Information Commissioner’s Office at ico.org.uk. As we are not established in the EU, any EU supervisory authority may act; there is no single lead authority.

11.5 International transfers

We are based in the United States, and personal data you provide is transferred to and processed in the United States and in other countries where we and our service providers operate. A current list of the countries in which our service providers process personal data is maintained at ioglobalgroup.com/legal/subprocessors.

Where we transfer personal data from the EEA, the UK, or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on the European Commission’s Standard Contractual Clauses, and on the UK International Data Transfer Addendum for transfers from the United Kingdom, together with supplementary technical and organizational measures where our transfer risk assessment identifies them as necessary. Where an adequacy decision applies to a transfer, we rely on that decision.

You may request a copy of the safeguards we use by emailing privacy@ioglobalgroup.com.