Privacy Policy
How Eurabelt Fuels Ltd collects, uses and protects personal data through the agreements portal.
1. Who is the controller
Eurabelt Fuels Ltd, registered number 16639303, of Flat 11 Clothier House, Kinveachy Gardens, SE7 8EF, London, United Kingdom, is the controller of the personal data described here. The Office of Compliance is responsible for data protection matters and is reachable at compliance@eurabeltfuels.eu.
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and, where applicable, Regulation (EU) 2016/679 (GDPR).
2. What we collect
Only what the portal actually needs. Every category below corresponds to a real record.
| Category | What it includes |
|---|---|
| Identity | Full legal name; entity name and registration number where a corporate counterparty; country of residence or establishment; the capacity in which a person acts. |
| Contact | Email address of record. We do not collect or publish telephone numbers. |
| Representatives | Name, title, territory, company email address, LinkedIn profile URL, languages, a short public note, a portrait photograph, and a permanent Eurabelt Identification Number. |
| Attestation evidence | The name declared, the capacity claimed, the UTC timestamp, the originating IP address, the browser user-agent string, and the specific affirmations ticked. See section 4. |
| Introductions | The counterparty named, their jurisdiction and class, the fuel product, and the narrative you provide describing your relationship with them. |
| Documents | Files uploaded to an introducer's record — executed counterparts, due diligence and identity evidence, beneficial ownership records, tax residency, addenda, correspondence. |
| Compliance screening | Sanctions and adverse-media screening results, and the outcome of due diligence. |
| Technical and audit | IP address, user-agent and timestamp for issuance, downloads, verifications, logins and failed login attempts, held in an append-only compliance log. |
We do not seek special category data. Where an identity document you upload happens to reveal something of that kind, we process it only so far as necessary to meet our legal obligations under money-laundering law, and we do not use it for any other purpose.
3. Why, and on what lawful basis
| Purpose | Lawful basis | Note |
|---|---|---|
| Issuing, sealing and transmitting instruments | Contract; legitimate interests | Necessary to perform, or take steps toward, the Agreement. |
| Recording an attestation and its audit trail | Contract; legitimate interests | Evidence that a person accepted the terms, and when. |
| Sanctions, AML and financial-crime screening | Legal obligation | Money Laundering Regulations 2017, Proceeds of Crime Act 2002, Sanctions and Anti-Money Laundering Act 2018. |
| Publishing the register of representatives | Legitimate interests | Preventing impersonation and protecting counterparties from fraud. See section 5. |
| Record-keeping and audit | Legal obligation; legitimate interests | Accounting, tax and AML retention requirements. |
| Security, rate limiting and abuse prevention | Legitimate interests | Keeping a system that issues legal instruments trustworthy. |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You may object at any time — see section 11.
4. Attestation audit data — stated plainly
When you record an attestation, we deliberately capture and retain:
- the name you type as your declaration;
- the exact UTC time of the act;
- your IP address at that moment;
- your browser user-agent string;
- the specific affirmations you ticked.
These are then bound cryptographically to the sealed instrument. We do this because an electronic attestation stands in place of a wet signature, and a signature with no evidence of who made it, when, and from where is worth very little if it is ever challenged. This data exists to protect you as much as us.
It is retained for the life of the instrument plus the limitation and retention periods in section 9, and it is not used for analytics, profiling, marketing or location tracking.
5. Data published deliberately
Two things are public by design, and you should know exactly what they are:
The register of representatives. For each designated representative we publish their name, title, territory, portrait, company email address, LinkedIn profile, permanent identification number and current standing. This is published so that a counterparty approached by someone claiming to act for us can verify the claim, and can see immediately if that person has been withdrawn. Representatives are told this at appointment. Portraits are re-encoded on upload, which strips embedded metadata including any GPS coordinates.
The verification register. Confirming an instrument reference discloses the instrument's status, the fuel product, and the names of the introducer and the presenting representative. It discloses no contact details, no scope narrative, no counterparty, no commercial terms and no internal records.
Nothing else is public. Introducers, counterparties and introductions are never published.
6. Where the data comes from
- directly from you, when you attest, register an introduction or correspond with us;
- from our own staff, when an instrument is issued;
- from your device, automatically, in the form of IP address and user-agent;
- from screening and due-diligence providers, and from public registers and sanctions lists.
7. Who we share it with
- Our hosting and email providers, as processors, to run the portal and deliver messages;
- Screening and due-diligence providers, for sanctions and adverse-media checks;
- Professional advisers — lawyers, auditors, accountants — bound by confidentiality;
- Competent authorities, where we are required or permitted by law to report, including where reporting is made without notice to you;
- A successor, on any reorganisation or transfer of the business.
We do not sell personal data. We do not share it with advertisers, data brokers or social networks, and there are no third-party tracking scripts on this portal.
8. International transfers
Where personal data is transferred outside the UK or EEA, we rely on an adequacy decision or on appropriate safeguards — normally the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses — together with a transfer risk assessment. Write to compliance@eurabeltfuels.eu for details of the safeguards applying to a particular transfer.
9. How long we keep it
| Record | Retention |
|---|---|
| Sealed instruments, schedules and attestations | Life of the relationship, then the longer of six years and any period required by AML, tax and accounting law. These are evidential records. |
| Compliance and due diligence records | At least five years from the end of the business relationship, per the Money Laundering Regulations 2017. |
| Registered introductions | Life of the relationship plus the tail period and applicable limitation periods. |
| Representative records | Retained after withdrawal, so the public page can continue to warn that the person is no longer authorised. The identification number is permanent and is never reissued. |
| Append-only compliance log | Retained for the life of the register. It is not edited or pruned — that is the point of it. |
| Rate-limiting records | Rolling, short-term. |
10. Security
- the portal is served over HTTPS, with strict transport security;
- outbound mail uses authenticated SMTP with certificate validation enforced — we would rather fail to send than send over an unverified connection;
- uploaded files are stored outside the web root under opaque names, type-checked on intake and fingerprinted with SHA-256; a file whose bytes stop matching its fingerprint is withheld;
- portrait images are re-encoded, stripping embedded metadata;
- forms are protected against cross-site request forgery, and sensitive actions are rate-limited;
- staff access is credentialed and every action is logged with IP address and timestamp;
- instruments are sealed with a keyed cryptographic digest, so alteration is detectable.
No system is perfectly secure. If you believe your data has been compromised, tell us at compliance@eurabeltfuels.eu immediately. We assess every reported incident and notify the Information Commissioner's Office and affected individuals where the law requires.
11. Your rights
Subject to the conditions and exemptions in the UK GDPR and the Data Protection Act 2018, you may ask us to:
- Access the personal data we hold about you, and receive a copy;
- Rectify data that is inaccurate or incomplete;
- Erase data, where there is no overriding basis for keeping it;
- Restrict processing while a dispute about accuracy or basis is resolved;
- Object to processing based on legitimate interests;
- Port data you gave us, in a machine-readable form;
- Withdraw consent, where we relied on consent — which does not affect processing already carried out.
Two honest limits. Sealed instruments and the append-only compliance log cannot be altered or deleted on request: they are evidential records, retained under legal obligation and needed to establish and defend legal claims. And the fact that a representative was designated, and later withdrawn, remains published — removing it would defeat the fraud-prevention purpose it serves. We will always explain which exemption we are relying on.
To exercise a right, write to compliance@eurabeltfuels.eu. We respond within one month, and will tell you if we need longer. We may ask you to verify your identity first — sensibly, given what this portal holds.
12. Automated decisions
We do not make decisions producing legal or similarly significant effects about you by automated means alone. Sanctions and adverse-media screening may be automated, but any match is reviewed by a person before any decision is taken. Compensation decisions are made by the Company's governance and are never automated.
13. Cookies
This portal sets only strictly necessary cookies. There is no analytics, advertising or third-party tracking. The full detail is in the Cookie Policy, published in accordance with the Privacy and Electronic Communications Regulations 2003.
14. Changes and complaints
We may update this policy. The date above records when it last changed, and material changes are notified by email to parties holding an instrument.
If you are unhappy with how we have handled your data, tell us first at compliance@eurabeltfuels.eu — we would rather put it right. You also have the right to complain to the Information Commissioner's Office at any time: see ICO — make a complaint. If you are in the EEA, you may complain to your local supervisory authority instead.