GDPR Compliance

Effective date: September 13, 2026

This page explains, specifically for individuals in the EU, UK, and EEA, how MyRetailBridge (operated by RetailMatchMaker) complies with the General Data Protection Regulation (GDPR) and the UK GDPR. It supplements our Privacy Policy, which describes what we process and why in full.

1. Legal basis for processing

We process personal data under the following legal bases:

• Contractual necessity — processing merchant account data and order line items is necessary to provide the inventory-sync service a merchant has signed up for.
• Legitimate interest — securing the service (e.g., authentication, fraud prevention) and maintaining sync history so merchants can review what happened and when.

We do not rely on consent as a legal basis for any processing described in our Privacy Policy, because we don't process any personal data beyond what's contractually necessary or covered by legitimate interest.

2. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request erasure of your personal data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, email match@retailmatchmaker.com. We respond within 30 days.

3. International data transfers

Our application servers run in the United States, and our database is hosted in Singapore, via our infrastructure providers (Vercel and Supabase respectively). If you're located in the EEA or UK, this means your data may be transferred outside your region. Our infrastructure providers maintain appropriate safeguards for these transfers, such as standard contractual clauses, as required under GDPR Chapter V.

4. Data Protection Officer

We have not appointed a formal Data Protection Officer, as our processing does not meet GDPR's mandatory-DPO threshold (we don't perform large-scale systematic monitoring or process special category data at scale). For any data protection question or request, contact match@retailmatchmaker.com.

5. Data minimization

MyRetailBridge's canonical data model has no fields for customer names, emails, phone numbers, or addresses at all — we only process order line items and totals, the minimum needed to keep inventory counts accurate. Raw webhook data that may incidentally include personal data is automatically deleted after 30 days.

6. Contact

GDPR-related questions or requests: match@retailmatchmaker.com.