Privacy policy

1. Controller

The controller of the personal data described here is the legal entity operating under the trading name ETC — Energy Trade Company.

TODO — registered legal name, registered address and, where appointed, the data protection officer or privacy contact address. Until then, privacy requests can be sent to sales@energytradecompany.com and will be routed to the responsible person.

2. What we collect and why

We collect only what a business enquiry needs. There is no user account, no profiling and no automated decision-making on the public website.

• Request-for-quotation and contact forms: your name, business e-mail address, company name, optional telephone number and VAT identification number, plus the commercial details you type in (product, quantity, delivery country, destination, postcode, Incoterms, requested delivery date, free-text message). Purpose: to prepare and send you a quotation and to correspond about it. Legal basis: performance of, or steps preparatory to, a contract, and our legitimate interest in responding to a business enquiry.
• Technical submission context: the page the form was submitted from, the referring page, the campaign parameters in the link you followed, the interface language and the delivery market you selected. Purpose: to route the enquiry to the right salesperson and to understand which channels generate genuine demand. Legal basis: legitimate interest.
• Abuse protection: a truncated request identifier derived from your IP address is stored briefly so the same source cannot flood the forms or the internal login screen. Purpose: security. Legal basis: legitimate interest.
• Server logs kept by our hosting provider: IP address, timestamp, requested URL, user agent, response status. Purpose: operating and securing the site. Legal basis: legitimate interest.

3. Storage in our sales system (CRM)

Every enquiry is stored in our internal sales system so we can answer it, quote it and follow it up. The record contains the contact and commercial details you submitted, the resulting deal, quotations and orders, the messages we exchanged and internal notes written by our sales staff.

Access is restricted to authorised ETC sales personnel who authenticate individually. Access rules are enforced by the database itself, not only by the user interface, and every status change is written to an audit trail.

The sales system is not publicly reachable, is excluded from search-engine indexing and is not measured by any analytics tool.

4. Processors and recipients

We do not sell personal data and we do not share it with third parties for their own marketing. The following providers process data on our behalf, under contract and on our instructions:

• Hosting and content delivery (Cloudflare-based edge platform): serves this website and processes connection data. It sets a strictly necessary cookie named __cf_bm (bot management) with a short lifetime; it carries no advertising identifier and is used to distinguish automated traffic from human visitors.
• Managed Postgres database and authentication service: stores the enquiry and sales records described above.
• Resend: sends the transactional e-mails triggered by a form submission — the internal notification to our sales inbox and the confirmation to you. Resend receives your e-mail address, the message content and delivery metadata.
• Zoho Mail: hosts our business mailboxes, so correspondence you send to us is stored there.
• Google Analytics 4 (Google Ireland Limited): measures aggregate use of the public website only, as described in section 5.

5. Analytics and cookies

The public part of this website uses Google Analytics 4 (measurement of page views only). We send Analytics the page path, the page title and the page URL. We deliberately do NOT send any content of your enquiry — no name, no e-mail address, no telephone number, no company name, no message text, no quantity or destination. There is no advertising integration, no remarketing audience and no cross-site identifier configured.

Analytics is disabled entirely on our internal sales system and any other private path; those pages load no measurement script at all.

Google Analytics sets its own cookies (_ga and _ga_* by default) to distinguish sessions and returning visits. Where consent is legally required for such cookies in your jurisdiction, note that a consent banner is not yet implemented on this site — TODO for the operator; until it is, you can block these cookies in your browser or with a browser extension, and the website will function normally.

The strictly necessary __cf_bm cookie described in section 4 cannot be switched off without losing the platform's abuse protection.

We use no other tracking, no social media pixels and no advertising tags.

6. International transfers

Some of the providers above are established outside the European Economic Area or use infrastructure there. In those cases the transfer relies on the European Commission's Standard Contractual Clauses together with the provider's supplementary safeguards, or on an adequacy decision where one applies.

TODO — the operator should list, per provider, the transfer mechanism in force once the contracts are consolidated on ETC accounts.

7. How long we keep data

• Enquiries that do not lead to a business relationship: kept for up to 24 months from the last contact, so we can recognise a returning enquiry and avoid duplicate records, then deleted or anonymised.
• Enquiries that lead to a quotation, order or delivery: kept for the duration of the relationship and afterwards for the statutory retention period applicable to commercial and tax records (typically 5 to 10 years, counted from the end of the relevant financial year).
• Transactional e-mail delivery metadata at our e-mail provider: kept for the provider's standard log retention window (short-term, days rather than months).
• Abuse-protection records: automatically deleted within 24 hours.
• Aggregate analytics data: retained according to the retention setting of the Analytics property, at most 14 months.

8. Your rights

Where the GDPR or an equivalent law applies to you, you have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability of the data you provided, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting processing already carried out.

To exercise any of these rights, write to sales@energytradecompany.com with the subject line "Privacy request". We answer within one month; if the request is complex we will tell you and may extend by two further months.

You may also lodge a complaint with the data protection authority competent for the controller's establishment or for your place of residence. TODO — the operator should name the competent supervisory authority here once the registered seat is confirmed.

9. Is providing data mandatory?

No. Providing your details is voluntary, but without a name, a company and a working e-mail address we cannot prepare or send a quotation, so the enquiry cannot be handled.

10. Security

Traffic to this website is encrypted in transit. The sales system requires individual authentication, enforces record-level access rules in the database, limits repeated login attempts and keeps an audit trail of status changes. Credentials for e-mail and database services are held in server-side secret storage and are never sent to the browser.

11. Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect data from them.

12. Changes to this policy

This policy was last reviewed in September 2026. We update it when our processing or our providers change; the current version is always the one published at this address.