Privacy Notice

1Who we are

1.1Eurabelt Fuels Ltd is the controller of the personal data described in this notice. We are registered in England and Wales under company number 16639303, our registered office is at Flat 11 Clothier House, Kinveachy Gardens, London SE7 8EF, and we are registered with the Information Commissioner’s Office under registration number ZC076060.

1.2This notice explains how we use personal data received through csr.eurabeltfuels.com (the “portal”), in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2The personal data we collect

2.1NGO partnership applications. When an organisation applies through the portal, we collect:

• organisation details: name, registration number, country, year of establishment, website, mission, activities and the pillar with which its work is aligned;
• details of the person submitting the application: name, title or role, email address and telephone number;
• the organisation’s logo and any other files uploaded with the application;
• registration, governance and financial documents, including audited financial statements, provided with the application or requested during due diligence, which may name trustees, directors, officers and beneficial owners;
• the confirmations given in the application and the IP address from which it was sent.

2.2Contact form. When you write to us through the contact form, we collect your name, email address, organisation (if given), the subject and the content of your message.

2.3Due diligence. When we assess an application, we may also obtain information about the organisation and the individuals connected with it from public sources, including company and charity registers, sanctions lists and published media.

2.4Technical data. Our hosting records standard technical information, such as IP addresses, browser type and the pages requested, in security logs. We do not use analytics, advertising or tracking technologies, as explained in the Cookie Notice (EBF-CSR-POL-03).

3Purposes and lawful bases

3.1We use personal data only for the following purposes and on the following lawful bases:

• assessing and answering NGO partnership applications — legitimate interests in operating a structured and auditable CSR programme;
• due diligence, including sanctions screening of the organisation, its officers and its beneficial owners — legitimate interests in not dealing with sanctioned persons, and legal obligation where sanctions law requires it;
• managing an approved partnership, including publishing the partner’s name, logo and profile, reporting and audit — legitimate interests;
• answering messages sent through the contact form, and keeping the portal secure — legitimate interests;
• meeting legal, regulatory and record-keeping obligations — legal obligation;
• any purpose for which we ask for your consent, such as publishing a named individual’s photograph — consent, which may be withdrawn at any time.

3.2If due diligence reveals information about criminal convictions or offences, we process it only where permitted by Schedule 1 to the Data Protection Act 2018 and with appropriate safeguards.

3.3We do not make decisions based solely on automated processing that have legal or similarly significant effects. Every screening result is reviewed by a person.

4Who receives personal data

4.1We do not sell personal data and we do not share it for marketing. We share it only where necessary, with:

• processors such as providers of hosting, email and secure storage, under written contracts that require them to protect the data and act only on our instructions;
• providers of screening and verification services, and our professional advisers, under duties of confidentiality;
• regulators, law enforcement agencies, courts and other public authorities, where the law requires it.

4.2The name, logo, description and public contact details of an approved partner organisation are published on the portal. Personal data of individuals is not published without their agreement.

5International transfers

5.1Eurabelt is registered in the United Kingdom, Canada, Trinidad and Tobago and South Africa, and some service providers operate outside the United Kingdom. Any transfer of personal data outside the United Kingdom is protected by an appropriate safeguard: UK adequacy regulations, the International Data Transfer Agreement or Addendum issued by the Information Commissioner, or another safeguard permitted by the UK GDPR. You may ask us for details.

6How long we keep personal data

6.1We keep personal data only for as long as it is needed for the purposes described above:

• unsuccessful or withdrawn applications: 24 months from the decision or withdrawal;
• approved partners: for the duration of the partnership and six years after it ends, to meet audit, accounting and legal requirements;
• messages sent through the contact form: 24 months from the last correspondence;
• security logs: no longer than 12 months, unless needed to investigate an incident.

6.2Records may be kept for longer where the law requires it or where they are needed for legal claims. At the end of the period, data is securely deleted or anonymised.

6.3We protect personal data with appropriate technical and organisational measures, including encrypted connections, access restricted to authorised personnel, a password-protected administration area and protection of forms against cross-site request forgery.

7Your rights

7.1Under the UK GDPR you have the right:

• of access to the personal data we hold about you;
• to rectification of inaccurate or incomplete data;
• to erasure, where there is no good reason for us to keep the data;
• to restriction of processing in certain circumstances;
• to object to processing based on our legitimate interests;
• to data portability, where processing is based on consent or contract and carried out by automated means;
• to withdraw consent at any time, where processing is based on consent.

7.2To exercise any of these rights, write to compliance@eurabeltfuels.com. We may need to confirm your identity. We respond within one month, extended by up to two further months for complex requests as the law permits. Some rights are limited by law; if we cannot meet a request, we will explain why.

8Complaints

8.1If you have a concern about the way we handle personal data, please contact us first at compliance@eurabeltfuels.com so that we can try to resolve it.

8.2You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk.

9Contact and changes

9.1CSR enquiries: csr@eurabeltfuels.com. Data protection and compliance: compliance@eurabeltfuels.com.

9.2We review this notice at least once a year. The version number and effective date shown on this document identify the version in force.