Privacy and Cookie Notice
1. Who we are
Eurabelt Fuels Ltd is the controller of personal data processed through Eurabelt Fuels Global Statistics.
| Registered office | 11 Clothier House, Kinveachy Gardens, London, SE7 8EF |
|---|---|
| Company number | 16639303 (England and Wales) |
| UK ICO registration | ZC076060 |
| Data protection lead | H. E. Amb Jeannie Steele — info@eurabeltfuels.com |
2. What this notice covers
This notice covers:
- the Eurabelt Fuels Global Statistics website and its data API;
- data blocks embedded on Eurabelt websites;
- data feeds;
- member accounts and member spaces;
- Eurabelt Publications, including its newsletters, email sign-up and mailing lists;
- communications with us.
Other Eurabelt websites have their own notices. Publishers' websites that we link to are governed by their own privacy policies.
3. Personal data we collect
| Who | Data | Source |
|---|---|---|
| All visitors (T0) | Technical request data recorded by our hosting infrastructure: IP address, browser user agent, page requested, time, and referring page. | Your browser |
| Applicants for membership (all tiers) | Company name, website, country, registration number and organisation type; your full name, job title and company email address; the intended use you describe; your declarations; the date, time and network address of the request; and the results of the verification checks carried out (email domain, company register, website, sanctions screening). | You, public company registers, official sanctions lists, the public DNS |
| Members (T0 Public, T1 Registered, T2 Institutional, T3 Sovereign/Enterprise) | Everything listed for applicants, plus: tier; account status; authenticator enrolment data (stored encrypted, never shown again); sign-in records (time and network address); security events; and the emails we have sent you (recipient, type, time — not their content). For organisations with Institutional or Sovereign/Enterprise access also: the organisational contact and address details given for that access, and its records. | You, your organisation, our systems |
| Newsletter recipients (members) | Your name and company email address, your newsletter preference (on or off), and a record of each newsletter sent to you (recipient, publication, time and delivery status). | Your account, our systems |
| Media and publications contacts | Organisation, contact name, business email address, media category and country, whether you have unsubscribed, and a record of each newsletter sent to you. | You, or the published editorial contact details of your organisation |
| People who sign up for Eurabelt Publications by email | Your email address, and your name and organisation if you give them; the time and network address of your sign-up and of your confirmation; whether you have unsubscribed; and a record of each edition sent to you. | You |
| Professional contacts on Eurabelt mailing lists (for example directors, board members and business contacts) | Name, email address, organisation, position and country as provided to us, the list or lists you are on, the basis on which we may email you, whether you have unsubscribed, and a record of each edition sent to you. | You, or Eurabelt Fuels Ltd's own business and professional records |
| People who contact us | Name, contact details and the content of your message. | You |
| Administrators | Username, password hash, sign-in times and IP addresses, and administrative actions (audit trail). | System |
We do not collect special-category data (such as health, religion or political opinions). We do not collect or store passwords for members, because member sign-in uses an authenticator app.
4. Why we use it and our lawful bases
For users in the UK and EU, we rely on the following lawful bases under Article 6 of the UK GDPR and EU GDPR:
| Purpose | Lawful basis |
|---|---|
| Delivering the Service, accounts, API access and alerts you request | Contract |
| Assessing membership requests (company, domain and applicant verification, and the automatic refusal of free or personal email services under our published eligibility rules) | Legitimate interests in admitting only verified organisations, and taking steps at your request before entering a contract |
| Sending transactional emails (confirmation, approval, setup, security notices) | Contract / legitimate interests |
| Verifying organisations and screening against sanctions lists | Legal obligation, and our legitimate interest in preventing unlawful use |
| Security, fraud prevention, rate limiting and licence enforcement (including watermarking of premium exports) | Legitimate interests |
| Accounting and tax records | Contract and legal obligation |
| Service notices (changes, incidents, suspensions) | Contract / legitimate interests |
| Sending Eurabelt Publications newsletters to members who have not opted out | Legitimate interests, and the membership contract. Every newsletter includes a one-click opt-out, and you can also opt out in your member space. |
| Sending Eurabelt Publications to people who signed up on the website and confirmed their address | Consent, which you can withdraw at any time with the unsubscribe link in every message |
| Sending Eurabelt Publications to professional contacts on our mailing lists | Legitimate interests in informing our existing business and professional contacts about official energy information, or consent where the law requires it. New contacts receive a notice with a one-click opt-out, and every message carries an unsubscribe link |
| Sending public Eurabelt Publications to media and publications contacts | Legitimate interests in distributing official statistical information to the business contacts of news and trade publications, with a one-click unsubscribe in every message (or consent where the law requires it) |
| Information about our services sent to business contacts | Legitimate interests, with an opt-out in every message (or consent where the law requires it) |
| Responding to enquiries and complaints | Legitimate interests |
| Website analytics (only if introduced) | Consent, obtained before any non-essential cookie is set |
No decision with legal or similarly significant effects is made about you solely by automated means. Requests that do not meet the published eligibility rules (for example a free email service, or an email domain that does not match the company website) are refused automatically. Every approval, rejection of an eligible request and possible sanctions match is decided by a person.
5. Cookies and similar technologies
| Cookie | Where | Purpose | Duration | Type |
|---|---|---|---|---|
EBS_ADMIN | Administration console only (/admin/) | Keeps an administrator signed in; protects forms against forgery | Browser session | Strictly necessary |
EBS_MEMBER | Member area only (/account/) | Keeps a member signed in; protects sign-in and enrolment forms against forgery | Browser session, maximum 12 hours | Strictly necessary |
Public pages, the access-request form, the data API and embedded data blocks set no cookies. Embedded data blocks request data without credentials. We use no advertising, social-media or cross-site tracking technologies. If we ever introduce analytics that require consent, we will ask for your consent first and update this table.
6. Who we share it with
- Service providers acting on our instructions: our hosting and email provider (transactional email is sent from our own mailbox, stats@eurabeltfuels.com), and any identity-verification or sanctions-screening provider we use. Each is bound by a written data-processing agreement.
- Writing-assistant provider: Eurabelt Publications drafts may be prepared with an automated writing assistant (the Claude API of Anthropic PBC), which acts as a processor. It receives only the official source documents selected for a publication and the custodian's instructions. No member, applicant or media-contact personal data is sent to it. Every draft is checked and approved by a custodian before publication.
- Professional advisers (lawyers, auditors, insurers), under confidentiality.
- Authorities, where the law requires it — for example regulators, law enforcement or sanctions authorities.
- Your organisation's account owner, who can see seat assignments and usage for their organisation.
- A successor to the Service, in the event of a reorganisation or transfer, subject to this notice.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
7. International transfers
Eurabelt operates in the United Kingdom, Canada, Trinidad and Tobago and South Africa, and uses service providers that may process data in other countries. Personal data from the UK or EU is transferred outside those regions only:
- to a country with an adequacy decision; or
- under appropriate safeguards — the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses — supported by a transfer risk assessment.
Transfers under Canadian and South African law meet the equivalent requirements of PIPEDA and POPIA.
8. How long we keep it
| Data | Retention |
|---|---|
| Hosting request logs | Up to 90 days, unless needed to investigate a security incident |
| Membership requests that are not approved (rejected, expired or withdrawn) | Deleted 180 days after the request |
| Account data of members | While the account is active, plus 24 months |
| Authenticator enrolment data | Until re-enrolment or account closure, then deleted |
| Email delivery records (no content) | 24 months |
| Access, export and audit logs | 24 months, or longer if the law or an active investigation requires it |
| Verification and sanctions-screening records | For the duration of the relationship, plus the period required by applicable law |
| Accounting and tax records | 6 years after the end of the financial year (UK requirement), or longer where local law requires |
| Newsletter delivery records | 24 months |
| Email sign-ups that are never confirmed | Deleted after 30 days |
| Media and publications contacts, email sign-ups and professional contacts on mailing lists | Until you unsubscribe or ask us to remove you. After that, only your email address and the fact that you unsubscribed are kept, so that you are not contacted again. |
| Enquiries and complaints | 24 months after closure |
9. How we protect it
Our safeguards include:
- encryption in transit (TLS);
- encryption of secrets at rest;
- passwords stored only as strong one-way hashes;
- device-based multi-factor authentication for every member and administrator account, with no member passwords;
- least-privilege access;
- an audit trail of administrative and data-processing actions;
- a documented incident-response procedure.
See Security and Responsible Disclosure.
10. Your rights
Depending on where you are, you may have the right to:
- access your data;
- have it corrected;
- have it erased;
- restrict or object to its processing;
- receive it in a portable format;
- withdraw consent;
- complain to a supervisory authority.
To exercise any right, contact info@eurabeltfuels.com. We may need to verify your identity. We respond within the statutory deadline, which is one month under UK and EU GDPR (extendable where the law allows).
| Where you are | Law | Supervisory authority |
|---|---|---|
| United Kingdom | UK GDPR, Data Protection Act 2018, PECR (as amended, including by the Data (Use and Access) Act 2025) | Information Commissioner's Office — ico.org.uk |
| European Union / EEA | Regulation (EU) 2016/679 (GDPR) | The data protection authority of your Member State |
| Canada | PIPEDA and applicable provincial laws | Office of the Privacy Commissioner of Canada — priv.gc.ca |
| South Africa | Protection of Personal Information Act 2013 (POPIA) | Information Regulator — inforegulator.org.za |
| Trinidad and Tobago | Data Protection Act 2011, to the extent in force | The competent authority under that Act |
| California, USA | CCPA as amended by the CPRA, where applicable | California Privacy Protection Agency |
California residents: we do not sell or share personal information, and we will not treat you differently for exercising your rights.
11. Personal data breaches
If a breach occurs, we will notify the relevant supervisory authority within the statutory time limit (for the UK and EU, within 72 hours of becoming aware, where notification is required), and notify affected individuals where the law requires.
12. Children
The Service is intended for professional users and is not directed at anyone under 18. We do not knowingly collect children's data.
13. Changes to this notice
We will post any changes here with a new effective date, and notify account holders of material changes.
14. Contact
Privacy enquiries: info@eurabeltfuels.com · Post: Eurabelt Fuels Ltd, 11 Clothier House, Kinveachy Gardens, London, SE7 8EF.
Issued under the seal of the Eurabelt Custodial Order · Unity · Secrecy · Custodianship