Privacy and Cookie Notice

1Who we are and what this notice covers

This notice explains how Eurabelt Fuels Ltd (“Eurabelt”, “we”, “us”) collects, uses, shares and protects personal information when you use eurabeltfuels.uk, the master site of the Eurabelt Custodial Order.

Eurabelt Fuels Ltd is the controller of that information. It is registered in England and Wales under company number 16639303, its registered office is at Flat 11 Clothier House, Kinveachy Gardens, London SE7 8EF, United Kingdom, and it is registered with the Information Commissioner’s Office as a data controller under registration number ZC076060.

Each other Eurabelt site has its own privacy notice, which applies when you use that site — for example the Privacy and Cookie Notice of Eurabelt Fuels Global Statistics (EBF-DOC-102). All of them are listed in the Master Document Register. Our group companies in Canada, Trinidad and Tobago and South Africa handle information about business conducted in their jurisdictions under the regional provisions in section 15.

2In short

• The public pages of this site set no cookies, run no analytics and carry no advertising or third-party tracking scripts. Fonts and images are served from Eurabelt’s own sites.
• We collect personal information only when you choose to use a form: the contact and enquiry form, the “Email this to me” service or the newsletter sign-up.
• The “Email this to me” service uses your address once, to send the message, and does not keep it.
• The newsletter is held by Eurabelt Fuels Global Statistics, not by this site.
• We do not sell, rent or trade personal information.

3Information we collect

3.1 When you visit the site

Like any web server, the server that hosts the site automatically records technical information about each request: your network (IP) address, the browser and operating system you use and the type of device, the page requested, the referring page, and the date and time. These server logs are used to keep the site secure and working. We do not use them to build profiles of visitors.

3.2 When you send an enquiry

If you use the contact and enquiry form, we collect what you enter: the company name, its registration number, country and website; your name, job title, e-mail address and telephone number; whether you write as a buyer or a seller; the product, quantity, delivery port and timeline of interest; the listed member of the team to whom you ask that the enquiry be sent; and your message. With it we record the date and time, your network address and your browser’s identification string.

The enquiry is sent by e-mail to the listed team member you chose, and a confirmation with your reference number is sent to you from inquiries@eurabeltfuels.com. A record of the enquiry — its reference, the team member, the company, your e-mail address, the product, the quantity, the time and whether the e-mail was delivered — is kept on the server. This site does not ask you for compliance documents; those are provided only on the Eurabelt platforms, under their own notices.

3.3 When you use “Email this to me”

You enter your e-mail address and choose what to receive. The address is used once, to send that single message, and is not stored. To prevent misuse, the server keeps a one-way hash of the address and of your network address, with the times of the requests, so that it can apply the limits of the service; these records are used for nothing else and are disregarded after 24 hours. No mailing list is created. The service is described in full in the Email Information Service Notice (EBF-DOC-009).

3.4 When you subscribe to the newsletter

The newsletter, Eurabelt Publications, is held by Eurabelt Fuels Global Statistics. When you sign up on this site, your e-mail address, and your name and organisation if you give them, are passed securely to Global Statistics together with your network address and the time, so that it can send you a confirmation e-mail from stats@eurabeltfuels.com. Nothing is kept on this site apart from a one-way hash of your network address, used for one hour to limit repeated attempts. From then on the subscription is governed by the Global Statistics Privacy and Cookie Notice (EBF-DOC-102), and every edition carries a one-click unsubscribe link.

3.5 Information from third parties

When you contact us on behalf of a company, we may check the company and the people acting for it in public and official sources, including:

• sanctions lists and compliance screening services;
• company registers and registration-verification services;
• credit reference agencies, for business verification only;
• government registers such as the NATO NCAGE system, SAM.gov and EORI systems.

4How we use information

4.1 Institutional verification

• Answering compliance-related enquiries and routing them to the listed team member you chose.
• Conducting structured verification of entities seeking custodial alignment, and confirming their eligibility and readiness for verified engagement.
• Maintaining verified institutional relationships within our compliance framework.

4.2 Compliance and security

• Sanctions screening and due-diligence verification.
• Meeting anti-money-laundering (AML) and know-your-customer (KYC) requirements.
• Verifying company registration and legitimacy.
• Detecting and preventing fraud, impersonation, unauthorised access and unlawful activity.
• Meeting our legal and regulatory obligations in each jurisdiction.

4.3 Communication

• Sending the confirmation of your enquiry and replying to it.
• Sending the single message you ask for through “Email this to me”.
• Providing information about verification status, compliance requirements and custodial alignment, with your consent where it is required.

4.4 Running the site

Keeping the site secure and finding faults, using the server logs.

5Legal bases for processing

Under the UK GDPR, the EU GDPR and other laws that require a lawful basis, we rely on:

• Contractual necessity — processing needed to perform a contract with you or to take steps you ask for before entering into one, such as answering an enquiry about verified engagement;
• Legal obligation — processing required by law, including sanctions compliance, anti-money-laundering requirements and regulatory reporting;
• Legitimate interests — our interest in keeping the site and the system secure, preventing fraud and impersonation, and answering business enquiries, where those interests are not overridden by your rights;
• Consent — where you have given it for a specific purpose, such as receiving a message through “Email this to me” or subscribing to the newsletter. You may withdraw consent at any time.

6Cookies and similar technologies

6.1 Public pages

The public pages of eurabeltfuels.uk set no cookies and use no local storage for tracking. The “Email this to me” and newsletter forms work without cookies: each form carries a signed time stamp instead.

6.2 The one cookie

Only the contact and enquiry page uses a cookie — a single session cookie:

The cookie is strictly necessary for the form to work securely, so it is set without asking for consent. It is marked HttpOnly and SameSite=Lax, and is sent only over secure connections when the site is visited over HTTPS.

6.3 Content from other Eurabelt sites

• The live items from Global Statistics are fetched by our server; your browser does not contact Global Statistics to show them.
• When you check a certificate at the Verification Centre, the result page of the issuing site is shown in a frame. That site receives your request and may set cookies under its own notice.
• Some pages show photographs served by leadership.eurabeltfuels.com, which receives the technical information any web server receives.

6.4 Sharing buttons

The sharing buttons are plain links. Nothing from LinkedIn, X, Facebook or any other network is loaded until you choose one; that network then receives the address of the page you share and applies its own policy. The WeChat code is drawn in your browser.

6.5 Managing cookies

You can block or delete cookies in your browser settings. If you block the session cookie, the contact form cannot be sent; the rest of the site is unaffected.

7Sharing and disclosure

We do not sell, rent or trade personal information. We share it only as follows.

7.1 Within the Eurabelt group

Between the Eurabelt companies in the United Kingdom, Canada, Trinidad and Tobago and South Africa, where needed to answer an enquiry or carry out verification across jurisdictions. A newsletter sign-up is passed to Eurabelt Fuels Global Statistics as described in section 3.4.

7.2 Service providers

Trusted providers that process information on our behalf and under our instructions, including web hosting and infrastructure providers, e-mail and communication providers, sanctions-screening and compliance-verification services, and professional advisers such as lawyers, accountants and auditors.

7.3 Legal requirements

Where required by law, or where we believe disclosure is necessary to comply with legal obligations, court orders or regulatory requests; to protect our rights, property or safety; to prevent or investigate unlawful activity, including impersonation of Eurabelt; or to respond to government authorities.

7.4 Business transactions

If Eurabelt is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

8International transfers

Because the Eurabelt group operates in the United Kingdom, Canada, Trinidad and Tobago and South Africa, your information may be transferred to and processed in a country other than your own. When we transfer personal information out of the United Kingdom or the European Economic Area we use appropriate safeguards:

• adequacy regulations or decisions, where the destination is recognised as providing adequate protection;
• standard data protection clauses — the UK International Data Transfer Agreement or Addendum, or the European Commission’s Standard Contractual Clauses;
• contractual commitments from recipients to protect the information.

In particular: transfers between the United Kingdom and the EU rely on adequacy; Canada is recognised as adequate for commercial organisations subject to PIPEDA; transfers to South Africa are made with standard clauses and in line with POPIA; transfers to Trinidad and Tobago are made with standard clauses and contractual protections.

9How long we keep information

We keep personal information only for as long as the purpose requires, unless the law requires longer.

10Your rights

Depending on where you are, you have rights over your personal information.

10.1 Rights everywhere

• Access — to ask for a copy of your personal information;
• Correction — to have inaccurate or incomplete information corrected;
• Withdrawal of consent — where processing is based on consent;
• Complaint — to complain to a supervisory authority.

10.2 United Kingdom and European Economic Area

You also have the right to erasure in certain circumstances, to restriction of processing, to portability (to receive your information in a structured, machine-readable format) and to object to processing based on legitimate interests.

10.3 Canada

Under PIPEDA you may access and correct your personal information and challenge our compliance with the Act.

10.4 South Africa

Under POPIA you may ask for your personal information to be corrected, deleted or destroyed, and object to its processing.

10.5 Trinidad and Tobago

You have the rights given by the Data Protection Act, 2011 of Trinidad and Tobago, as they are in force.

10.6 How to exercise your rights

Write to us at the addresses in section 18. We respond within the time the law requires — within one month under the UK GDPR. Because the “Email this to me” service does not keep your address, we will usually hold nothing about you from that service.

11Security

We use technical and organisational measures appropriate to the information we hold, including:

• encryption of information in transit (HTTPS) and protection of stored records;
• collecting as little as possible — public pages collect nothing beyond server logs;
• restricted access to records and secure authentication;
• signed forms, hidden trap fields and rate limits against automated abuse;
• incident response procedures.

No system is completely secure, and we cannot guarantee the absolute security of information sent over the internet.

12Links to other websites

The site links to websites run by others, including the NATO NCAGE verification tool, SAM.gov, the GOV.UK EORI checker, Companies House, the ICO register and other official and reference websites. Those sites have their own privacy policies, and we are not responsible for their privacy practices or content.

13Children

The site and the Eurabelt services are intended for businesses, public bodies and their adult representatives. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly.

14Sanctions screening and compliance

14.1 Purpose of screening

To meet our regulatory obligations and our own standards, every individual and company seeking to do business through Eurabelt is screened. Screening checks against:

• the sanctions lists of the US Office of Foreign Assets Control (OFAC);
• the EU consolidated sanctions list;
• United Nations Security Council sanctions;
• the UK sanctions list;
• databases of politically exposed persons (PEPs);
• other relevant national and international sanctions lists.

14.2 Screening is free

14.3 Screening results

Whether screening is passed is determined solely by verification of documents and compliance with international sanctions regulations. Custodians and representatives of Eurabelt do not make subjective approval decisions; every determination is based on objective compliance criteria.

15Regional provisions

15.1 United Kingdom

Controller: Eurabelt Fuels Ltd, Flat 11 Clothier House, Kinveachy Gardens, London SE7 8EF, United Kingdom (ICO registration ZC076060).
Supervisory authority: Information Commissioner’s Office, ico.org.uk.
Law: UK GDPR and the Data Protection Act 2018.

15.2 European Union

Law: the General Data Protection Regulation (GDPR). Residents of the EU may contact Eurabelt Fuels Ltd in the United Kingdom, or their local data protection authority.

15.3 Canada

Controller: Eurabelt Fuels Ltd., 13741 Humber Station Rd, Caledon, ON L7E 0Z8, Canada.
Supervisory authority: Office of the Privacy Commissioner of Canada, priv.gc.ca.
Law: Personal Information Protection and Electronic Documents Act (PIPEDA).

15.4 South Africa

Responsible party: Eurabelt Fuels (Pty) Ltd, 8 Uit Oos Street, Pacaltsdorp, George, Western Cape 6529, South Africa.
Regulator: Information Regulator, inforegulator.org.za.
Law: Protection of Personal Information Act (POPIA).

15.5 Trinidad and Tobago

Controller: Eurabelt Fuels Ltd, 72 Blue Basin Road, Diego Martin, Port of Spain, Trinidad and Tobago.
Law: Data Protection Act, 2011 (Trinidad and Tobago).

16Complaints

If you are unhappy with how we have handled your personal information, please tell us first, at the addresses in section 18, so that we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint, or by post to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are elsewhere, you may complain to the authority named for your region in section 15.

17Changes to this notice

We may update this notice to reflect changes in our practices, technology or legal requirements. When we make a material change we will publish the new version here with a new version number and effective date, record it in the Master Document Register and, where appropriate, announce it in the Newsroom. Please review the notice from time to time.

18Contact

For questions, concerns or requests about this notice or about how we handle personal information:

• Data protection enquiries: privacy@eurabeltfuels.com
• Compliance: compliance@eurabeltfuels.com
• By post: Eurabelt Fuels Ltd, Flat 11 Clothier House, Kinveachy Gardens, London SE7 8EF, United Kingdom

We aim to answer every legitimate request within 30 days, or sooner where the law requires.