CMDT
Privacy Notice
Elvir Leonard operates CMDT in his personal capacity and is responsible for the personal information described here. Contact [email protected] about your information or to make a privacy complaint.
Information we collect
Enquiries include your name, email, optional company, topic and message. Buyer registration and agent or supplier applications include your name, email, country, language, business or sourcing details and a password stored as a hash. Agent applications may include your region, phone and experience. We keep application decisions and review notes.
Supplier and agent work can include business contacts, roles, addresses, registration details, notes and uploaded evidence. We may receive these from your organisation or another party involved in the work. Purchases can include destination and requirements, quotes, contact details, bank instructions, payment references, shipping and documents such as invoices and inspection reports.
We use session identifiers, request and security information and account activity. Where enabled, we store authenticator settings and hashed recovery codes. For the investor NDA we collect your legal name, email, notice address, optional organisation, typed signature and signing time. We keep the signed agreement and email a copy through Resend to Elvir Leonard.
How we use it
Our legal bases, where applicable, are legitimate interests in responding to enquiries, assessing applications, managing business contacts and securing the service, and contract or steps you request before entering an agreement when you are a party to it. For agreements with a company, our basis for handling its contacts is legitimate interests in managing the business relationship. We use transaction records to coordinate purchases and meet applicable legal obligations. We use the NDA details to administer the agreement and retain evidence of it. We need required form fields to process your request.
Who receives it and where
Authorised CMDT personnel and agents can access information needed for their work. Assigned or authorised sourcing agents may see supplier information and review applications. Relevant purchase details may be shared with parties involved in fulfilling the order. Cloudflare provides site delivery, analytics where enabled, and storage for hosted NDA records. Resend handles configured transactional email and says it stores message data in the United States.
CMDT hosts its marketplace directly. Authorised personnel and service providers may handle information across borders. Cloudflare and Resend publish data processing terms with standard contractual clauses and a UK addendum. Email us for information about the safeguards relevant to your data.
How long we keep it
Our usual review points are 12 months after closing an enquiry or unconverted quote, six months after an unsuccessful or withdrawn application, and 90 days after account closure for routine profile details. We keep core order records for the time needed to meet applicable recordkeeping obligations and handle disputes or claims. Security and audit records are kept according to the operational or legal need for the record.
We review signed NDAs seven years after signature and keep them for as long as needed for surviving obligations or legal claims. A legal requirement or active dispute may require keeping specific records longer. Copies in provider recovery systems may remain until the applicable recovery window ends.
Your rights and complaints
Depending on the law that applies, you can ask to access, correct, delete or restrict use of your information, object to certain uses, request a portable copy or withdraw consent where it applies. Email [email protected] to make a request or complaint. You may also complain to the relevant data protection authority. If UK data protection law applies, you may contact the Information Commissioner’s Office (ICO).