Privacy Notice
What personal data the EBRICS Registry collects, why, the legal basis, who sees it, how long it is kept, how it is protected, and the rights of individuals in the UK, Canada, South Africa, Trinidad and Tobago and elsewhere.
1. Who we are
The EBRICS Registry is operated by Eurabelt Fuels Ltd (company number 16639303, registered office Flat 11 Clothier House, Kinveachy Gardens, London SE7 8EF, United Kingdom), which is the controller of the personal data described in this notice. Where Registry services are delivered in Canada, Trinidad and Tobago or South Africa, 17303785, 10017296 and K2025/850330/07 respectively act as joint or local controllers for that processing.
Contact our data protection lead at privacy@eurabeltfuels.com. Our ICO registration number is ZC076060. In Canada, our Privacy Officer is NA. In South Africa, our Information Officer is NA.
2. Whose data we process
The Registry deals mainly with organisations. It also processes personal data about:
- authorised contacts, directors, signatories and beneficial owners of applicants and code holders;
- individual principals who apply in their own name;
- contact persons named in Authorizations to Verify (ATVs);
- visitors to the Registry website and users of the verification tools;
- Registry staff who use the console.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Identity & role | Name, position, authority level, signatory status | Applicant; official registers; supporting documents |
| Contact | Business email, telephone | Applicant; code holder (for ATV counterparties) |
| Due-diligence records | Beneficial ownership information; screening results and references; identity documents where required | Applicant; sanctions lists and screening providers |
| Registry records | Application reference, sealed profile, code status, ATVs, seal records, verification references | Generated by the Registry |
| Technical | IP address and browser identifier, stored only as keyed hashes; timestamps of actions; a session cookie | Your device |
The Registry does not collect special-category data unless it appears incidentally in documents submitted for verification. It does not store documents uploaded for sealing: only their SHA-256 fingerprint is kept.
4. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR / equivalents) |
|---|---|
| Verifying applicants, their authority and their beneficial ownership | Legitimate interests in preventing fraud and impersonation in fuel procurement; legal obligation where AML or sanctions law applies |
| Sanctions screening and ongoing monitoring | Legal obligation; legitimate interests |
| Issuing and maintaining codes and the Reserve Ledger | Performance of our agreement with the code holder; legitimate interests |
| Disclosing a verified profile to a counterparty named in an ATV | The code holder's instruction and consent; legitimate interests of the counterparty in due diligence |
| Notifying holders of ATVs, verifications and status changes | Performance of contract; legitimate interests |
| Security, fraud prevention, rate limiting and audit logs | Legitimate interests, including network and information security |
| Complaints, appeals, legal claims and regulatory requests | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests, and those of the industry in preventing fraud, are not overridden by your rights, particularly given the business context and the safeguards described below. You may ask for a copy of that assessment.
5. Automated decisions
Codes are issued, suspended and revoked by compliance officers, not by automated decision-making. Automated controls such as rate limits and integrity checks protect the system; they do not make decisions about individuals.
6. Who receives personal data
- Counterparties authorised by the code holder receive the verified profile, which includes the authorised contact's name and title. They never receive email addresses, telephone numbers, identity documents or screening details.
- Service providers acting on our instructions: hosting (data centres in EU-USA-UK-AU), email delivery and sanctions-screening data providers, under contracts that require confidentiality and security.
- Authorities: regulators, law enforcement, financial intelligence units and sanctions authorities, where the law requires or permits disclosure.
- Professional advisers and auditors, under duties of confidentiality.
- A successor custodian of the Reserve Ledger, as provided by the Registry Charter.
We do not sell personal data or use it for advertising.
7. International transfers
The Registry operates across the United Kingdom, Canada, Trinidad and Tobago and South Africa, so personal data may be transferred between them. Where a transfer is not covered by an adequacy decision or regulation, we use appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum and contractual clauses meeting POPIA section 72. Contact us for details of the safeguards that apply.
8. How long we keep it
See the Data Retention Schedule. In summary: Ledger and due-diligence records are kept for the life of the registration plus the anti-money-laundering record-keeping period; verification logs are kept for 7 years; unconfirmed holder requests expire within 30 minutes to 14 days.
9. Security
Personal data in the Reserve Ledger, including sealed profiles, codes and staff authentication secrets, is encrypted with AES-256-GCM. Tokens, references and technical identifiers are stored as keyed hashes. Access is restricted by role, protected by two-factor authentication and recorded in an audit log. See the Security Overview.
10. Your rights
Depending on where you are, you may have the right to access your personal data, have it corrected, have it erased, restrict or object to its processing, and receive a copy in a portable format. You may also withdraw consent where we rely on it. See Your Data Rights for how to make a request and the limits that apply. For example, we cannot erase records that the law requires us to keep, or that past verifications depend on.
11. Complaints
Please contact us first at privacy@eurabeltfuels.com; we will acknowledge and investigate your complaint. You also have the right to complain to a supervisory authority:
- United Kingdom: Information Commissioner's Office
- Canada: Office of the Privacy Commissioner of Canada
- South Africa: Information Regulator
- Trinidad and Tobago: the Office of the Information Commissioner under the Data Protection Act, 2011, to the extent that its provisions are in force.
12. Laws that apply
This notice is written to meet the UK GDPR and the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025); the Personal Information Protection and Electronic Documents Act (Canada) and any successor legislation; the Protection of Personal Information Act 2013 (South Africa); and the Data Protection Act, 2011 (Trinidad and Tobago), to the extent in force.
13. Changes
We will publish any changes in the Legal Centre and, if they are significant, notify code holders by email.