GreCoM
Confidentiality
Technical data is what travels. Your identity is what you control.
This page is the detail: what each party sees at each stage, what GreCoM’s own staff can see, what is written down about them when they do, and what happens at the moment an identity is released.
Who sees what
Field by field, at the three stages that matter. “Counterparty” means the company on the other side of a published match.
| Field | Before a match | Match published, not disclosed | After disclosure |
|---|---|---|---|
| Company name, address, registration number | Not visible | Not visible | Visible |
| Contact person, e-mail, telephone | Not visible | Not visible | Visible |
| Sector, coarse region (North / East / South / West) | Not visible | On the card | Visible |
| Exact site, municipality, postcode | Not visible | Not visible | Visible |
| Material category, intended application | Not visible | On the card | Visible |
| Quantity | Not visible | As a band | Exact figure and period |
| Key properties and element concentrations | Not visible | Up to three, as bands | Measured values, with method and date |
| Hazard declaration, processing flag | Not visible | As flags | Visible in full |
| Uploaded documents | Not visible | Not visible | Those GreCoM has cleared |
| Free text and notes to GreCoM | Not visible | Not visible | Not visible |
| GreCoM’s internal notes and rationale | Never | Never | Never |
The moment itself
Both identities, or neither.
Disclosure is one step. There is no state in which one company knows the other and is not known in return — not for a moment, and not if something fails halfway. If the release of one identity cannot be completed, the other is not written either. It is a single step by design, and it is tested as one.
Either side may ask. GreCoM reviews the request. Nobody’s identity moves without both companies having expressed interest first, and an unanswered request expires after fourteen days rather than sitting open.
The buyer sees the card. Nothing else leaves the producer.
Both express interest. Neither knows who the other is.
Either may request disclosure. GreCoM checks the request before anything is released.
Both identities are released in a single step — both, or neither. From here it is between the two companies.
What GreCoM’s own staff can see
GreCoM’s reviewers and administrators can see what you submit and who you are. They have to: a company is checked against the trade register by a person, and every entry is read by a person. What limits that access is not a promise, it is the record:
- Every reveal of an identity by a member of staff is written to a log with their name, the time and the reason they gave, and that log cannot be altered afterwards — the database refuses the change even to its owner.
- Every document opened by a member of staff is recorded in the same way, and a document reaches a counterparty only after it has been scanned, stripped of metadata and reviewed.
- Internal notes and review rationale live in a separate database role. The application a participant talks to cannot read that schema; it cannot even see that it exists.
- A reviewer who publishes a card below the anonymity floor has to write why, and both the reason and the number are stored with the decision.
What this does not promise
A card is designed not to point at one company, and a reviewer checks that before it is published. It is not a mathematical guarantee of anonymity, and while the number of companies in a sector is still small, a determined reader who knows the industry may still draw a conclusion. We would rather write that down than claim otherwise.
If your stream is unusual enough that its card would identify you, the honest options are to widen a band or not to publish it. Both are available, and a reviewer will raise it with you rather than publishing and hoping.
Questions a compliance officer asks.
Retention periods and the legal basis for each kind of processing are set out in the privacy statement. Anything it does not answer, ask — you will have the answer in writing, with the date it was given.