Legal
Privacy policy
Who we are
Oil Trans BV. buys, stores and delivers fuel for businesses across North-West Europe. To do that, we handle personal data about the people we work with: contacts at our customers and suppliers, people who get in touch through this website, and job applicants. This policy explains what we collect, why, and what rights you have.
Oil Trans BV. is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).
| Company | Oil Trans BV. |
| Chamber of Commerce | 13030139 |
| Establishment number | 000016936264 |
| Contact & Address | Available on our contact page and footer |
What this policy covers
This policy applies to personal data we process when you:
- visit this website or use one of its forms;
- contact us by email, telephone or WhatsApp;
- work for a company that is, or wants to become, our customer, supplier or business partner;
- apply for a job with us.
It does not cover websites run by others that we link to, such as WhatsApp or the websites of terminals and inspection companies. Those organisations have their own privacy policies.
Personal data we collect
Information you give us
- Contact and storage enquiry forms: your name, company, email address, telephone number if you give one, the subject and content of your enquiry, and details such as product, volume, location and storage period.
- Email, telephone and WhatsApp: your name, contact details and whatever you choose to tell us.
- Job applications: your CV, covering note and anything else you send, plus our notes from interviews.
Information we collect for business relationships
Before we trade with a company, we are required to verify who we are dealing with. For directors, authorised signatories and ultimate beneficial owners of our customers and suppliers, this can include names, dates of birth, nationality, positions held, copies of identity documents where required, and the results of sanctions, politically-exposed-person and adverse-media screening.
Information collected automatically
- Technical data: when you send a form, we record the IP address it was sent from to help detect misuse. Our web server also keeps standard logs containing IP addresses, browser type and the pages requested.
- Cookies: see section 8. We do not use analytics, advertising or tracking cookies.
We do not knowingly collect special categories of personal data, such as health information, and we ask you not to send it to us.
Why we use it and on what legal basis
We only use personal data where the GDPR gives us a legal basis to do so.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing a quotation or offer | Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Performing contracts: deliveries, storage, transport, invoicing and payments | Performance of a contract (Art. 6(1)(b)); our legitimate interest in managing relationships with business contacts (Art. 6(1)(f)) |
| Know-your-customer checks, sanctions screening and fraud prevention | Compliance with legal obligations (Art. 6(1)(c)); our legitimate interest in preventing fraud and financial crime (Art. 6(1)(f)) |
| Keeping accounting and tax records | Compliance with legal obligations (Art. 6(1)(c)) |
| Keeping the website secure and working | Our legitimate interest in protecting our systems (Art. 6(1)(f)) |
| Assessing job applications | Steps taken at your request before entering into an employment contract (Art. 6(1)(b)) |
| Establishing or defending legal claims | Our legitimate interest in protecting our legal position (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and are satisfied they are not overridden. You can ask us for details of that assessment.
We do not sell personal data. We do not use it for profiling or for decisions made solely by automated means that have legal or similarly significant effects on you.
Transfers outside the EEA
We aim to keep personal data within the European Economic Area. Some transfers outside it are unavoidable, for example when we deal with a customer, vessel or inspection company based elsewhere, or when you use a service operated by a company based in the United States.
When we transfer personal data outside the EEA, we make sure it is protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the recipient is certified), by the European Commission's standard contractual clauses, or by another safeguard the GDPR allows. You can ask us for a copy of the relevant safeguard.
Third-party content on this website
- Google Fonts: our typefaces are loaded from Google's servers, which means your browser sends your IP address to Google when you view a page.
- Unsplash: some photographs are loaded from Unsplash's image servers, which also receive your IP address.
- WhatsApp: if you start a conversation using our WhatsApp button, the conversation takes place on WhatsApp, a service of Meta, and is subject to WhatsApp's own privacy policy.
How long we keep it
We keep personal data no longer than we need it. Our standard retention periods are:
| Data | How long |
|---|---|
| Enquiries that do not lead to a business relationship | 24 months after our last contact |
| Business contact details of customers and suppliers | For the duration of the relationship and 24 months after it ends |
| Due diligence and sanctions screening records | Five years after the business relationship ends |
| Contracts, invoices and accounting records | Seven years, as required by Dutch tax law |
| Job applications | Four weeks after the vacancy is filled, or one year with your consent |
| Web server logs | Up to 90 days |
We may keep data longer where it is needed to deal with a dispute or legal claim, or where the law requires it.
How we protect it
We use technical and organisational measures appropriate to the risk, including encrypted connections to this website, access controls that limit personal data to the people who need it, and confidentiality obligations for our staff and service providers.
If a personal data breach occurs that is likely to put your rights at risk, we will report it to the Dutch Data Protection Authority within 72 hours and, where the risk is high, inform you without undue delay.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data where we no longer have a reason to keep it;
- restrict our use of your data while a question about it is resolved;
- object to our use of your data where we rely on legitimate interests;
- data portability: receive data you gave us in a structured, machine-readable format;
- withdraw consent at any time, where we rely on your consent.
To use any of these rights, please contact us via our contact page or using the contact details in the footer. We may ask you to confirm your identity before we act on the request. We will respond within one month, and will tell you if we need more time for a complex request. Exercising your rights is free of charge.
Some rights are limited by law. For example, we cannot delete due diligence records or invoices while we are legally required to keep them.
Questions and complaints
If you have a question or concern about how we handle your personal data, please contact us via our contact page or write to us using the address published in the footer. We will try to resolve it quickly.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the supervisory authority in the EU country where you live or work.
Changes to this policy
We review this policy regularly and will update it when our processing changes. The effective date at the top of the page shows when it was last revised. Where a change materially affects you, we will tell you directly if we have your contact details.