Privacy Policy

1. Who we are

Eurabelt Fuels Ltd is the data controller for the processing described in this policy. We are a petroleum procurement compliance and verification institution registered in the United Kingdom under company number 16639303, and registered with the Information Commissioner’s Office as a data controller under reference ZC076060. That registration may be inspected directly at ico.org.uk.

Registered office

Flat 11 Clothier House, Kinveachy Gardens, London SE7 8EF, United Kingdom

Data Protection Officer

A Data Protection Officer is designated and may be reached at compliance@eurabeltfuels.com

Supervisory authority

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF

2. Scope of this policy

This policy covers this publications portal only. It does not cover the Eurabelt verification platform, which processes counterparty data under separate terms agreed with participating parties, nor our other web properties, each of which publishes its own notice.

We draw this distinction deliberately. A single privacy notice claiming to cover both a public reading site and a counterparty verification system would be describing neither accurately.

3. What we collect

We have designed this portal to collect as little as possible. Reading any page and downloading any publication requires no account, no registration and no form submission.

3.1 Publication access records

When a publication is downloaded, we record: the publication requested, the country or regional page it was requested from, the referring web address where the browser supplies one, and the date and time.

We do not record your IP address in this log, and we do not attempt to identify you. In the ordinary case these records are not personal data at all. They may become personal data in narrow circumstances — for example where a referring address itself identifies an individual — and we treat them accordingly.

3.2 Server logs

Our hosting provider maintains standard web server access logs, which include IP addresses, as is normal for any website and necessary for security and fault diagnosis. These are generated by the hosting infrastructure rather than by us, are retained for a limited period under the provider’s own retention schedule, and are not combined with the access records above.

3.3 Briefing requests

If you complete the briefing request form we collect your name, role or title, organisation, organisation website, email address, the market you are enquiring about, and any message you choose to write. Where your email domain differs from your organisation’s website you may tell us which organisation you represent, and we record that statement.

This is the only place on the site where personal data is collected directly from you, and it is collected only because you chose to submit it. No registration is required to read or download any publication, and we have deliberately kept it that way — the documents are open, and this form exists to arrange a conversation rather than to gate a download.

We check that your email domain corresponds to the website you give. That check happens in our own code at the moment of submission; nothing is sent to a third-party verification service.

3.4 Correspondence

If you write to us at any address published on this site, we process the contents of that correspondence in order to respond to it.

3.5 What we do not do

• We set no cookies. See the Cookie Policy.
• We use no analytics platform — no Google Analytics or equivalent.
• We use no CAPTCHA service on the briefing form. Every CAPTCHA is a third-party request, and we would rather absorb some spam than disclose your IP address to another company.
• We do not require registration to read or download anything published here.
• We do not add you to a mailing list. Submitting a briefing request is not a subscription, and we will not market to you on the strength of it.
• We make no third-party requests from these pages. Fonts are served from our own infrastructure rather than an external content delivery network, specifically so that visiting this site does not disclose your IP address to any other organisation. Scripts and styles are served the same way, and the share buttons are plain links: nothing is sent to any other service unless you choose to follow one.
• We operate no advertising, tracking pixels, session recording or profiling of any kind.
• We do not sell, rent or trade personal data in any circumstance.

3.6 The record and the publications bot

The records published on this site are compiled by an automated process, the publications bot, which reads public data from Eurabelt Fuels Global Statistics (stats.eurabeltfuels.com) server-to-server. That exchange takes place between our own servers. No visitor data is involved in it: nothing about you or your visit is sent to Global Statistics when you read a page here.

The RSS and JSON feeds of the record carry published records only. Reading them requires no account and sets nothing on your device.

4. Why we process it, and on what basis

Purpose	Lawful basis	Explanation
Recording which publications are accessed	Legitimate interests, UK GDPR Article 6(1)(f)	To understand which analyses are of interest to which markets, so that we direct our research effort usefully. Our interest is limited and the records are not identifying.
Server logging and site security	Legitimate interests, Article 6(1)(f)	To keep the site available and to detect abuse. Standard for any published website.
Arranging and preparing for a briefing you requested	Legitimate interests, Article 6(1)(f), and steps taken at your request prior to a possible contract, Article 6(1)(b)	To contact you, route your request to the right custodian, prepare properly for the discussion, and confirm you are writing on behalf of the organisation you name.
Responding to correspondence	Legitimate interests, Article 6(1)(f)	To answer enquiries, verification requests and meeting requests addressed to us.
Meeting legal and regulatory obligations	Legal obligation, Article 6(1)(c)	Where we are required to retain or disclose records by law or by a properly constituted request from a regulator, law enforcement body or court.

Where we rely on legitimate interests we have assessed those interests against your rights and freedoms, and we have limited our processing accordingly. You may object at any time on the grounds set out at section 8.

5. Who we share it with

We do not share the data described above with third parties for their own purposes. The only categories of recipient are:

• Our hosting provider, which operates the infrastructure this site runs on and acts as our processor under contract, including delivery of email sent from the briefing form.
• The Eurabelt custodian responsible for your market, where you submit a briefing request. Custodians are named and published at leadership.eurabeltfuels.com, and each is bound by the same confidentiality obligations described in our publications.
• Regulators, law enforcement and courts, where there is a proper legal basis for the request. As set out in our publications, our obligations under anti-money-laundering and sanctions regimes take precedence over any confidentiality undertaking.
• Professional advisers, where necessary and under a duty of confidence.

6. International transfers

The infrastructure serving this portal is located within the United Kingdom and the European Economic Area. Eurabelt operates in four jurisdictions, and where correspondence you send us is handled by a custodian resident outside the UK or EEA, that transfer is made under appropriate safeguards, being the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses as applicable. Details are available on request.

7. How long we keep it

Publication access records

24 months, after which they are aggregated into non-identifying counts and the underlying rows deleted.

Server logs

As set by our hosting provider’s retention schedule; typically a short period measured in weeks.

Briefing requests

36 months from your last contact with us, so that a custodian picking up a relationship later has the context. You may ask us to delete the record sooner and we will do so.

Correspondence

For as long as needed to deal with the matter, and then for a further period where a record is required for legal, regulatory or audit purposes.

8. Your rights

Under the UK GDPR you have the right to request access to your personal data; to have inaccurate data corrected; to have data erased; to restrict processing; to object to processing carried out on the basis of legitimate interests; and to receive data you provided in a portable format. Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, write to compliance@eurabeltfuels.com. We will respond within one month. There is no charge, and we will not ask you to justify the request.

If you have submitted a briefing request, we hold your details and can act on any of these rights straightforwardly. Please note that because we do not record identifying information against publication access records, we may be unable to locate data relating to you from a site visit alone. Where that is the case we will say so plainly rather than ask you to supply identifying information solely to enable a search.

If you are dissatisfied with how we have handled your data you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would ask that you raise the matter with us first, but you are not required to.

9. Security

Records are held on infrastructure secured against unauthorised access, with access restricted to those who require it. Our publications describe the cryptographic architecture applied to material held in our verification systems — AES-256 encryption, SHA-256 integrity hashing and Argon2ID key derivation. The portal itself holds no counterparty material and is deliberately kept simple, on the principle that data not collected cannot be compromised.

10. Changes

Material changes to this policy will be reflected in the version number and effective date above. Superseded versions are retained and available on request, so that any party who relied on an earlier version can establish what it said.