Privacy Policy

Applicable Laws & Regulations

  • EU: Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and applicable EU/EEA Member State implementing legislation (e.g. the Dutch GDPR Implementation Act (Uitvoeringswet AVG))
  • US: applicable US federal and state data protection and privacy legislation, including sectoral and state consumer privacy statutes (e.g. the California Consumer Privacy Act, as amended)
  • UAE/Dubai: UAE Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data, and, where applicable to the relevant Burando Energies entity, the DIFC Data Protection Law (DIFC Law No. 5 of 2020) or other applicable free zone data protection regime
  • Any other data protection, privacy or data localization legislation applicable in a jurisdiction where Burando Energies operates or has a Customer or Supplier relationship, as identified and maintained on the Local Law Annex referred to in Section 3 of this Policy

 

1. Introduction

1.1 Policy Objectives

Burando Energies (Burando) is a bunkering supplier that supplies exclusively to professional counterparties, being other businesses, vessel operators, charterers, and commercial intermediaries, and does not offer products or services to consumers. In the ordinary course of its business, Burando nonetheless processes personal data, including the personal data of employees, directors, representatives and contact persons of its Customers, Suppliers and other business counterparties, as well as of its own personnel.

This Policy sets out the group-wide, high-level principles that govern how Burando collects, uses, stores, shares and otherwise processes personal data. It is deliberately drafted as an overarching framework rather than a jurisdiction-specific compliance manual, because Burando operates across multiple jurisdictions, including the European Union, the United States and the United Arab Emirates (including Dubai), each of which imposes its own data protection requirements.

The objective of this Policy is to ensure that, wherever Burando processes personal data, it does so in a manner consistent with recognized international data protection principles, and that local legal requirements are correctly identified, layered on top of this Policy, and complied with in full.

This Policy represents the minimum group-wide standard that must be met by all Burando entities. Where local law imposes stricter or additional requirements, those local requirements prevail, as further described in Section 3 (Hierarchy: Local Law Prevails).

1.2 Scope

This Policy applies to Burando Energies, including its subsidiaries, branches and representative offices, wherever located, and to all Burando Personnel who process personal data in the course of their work for Burando.

This Policy covers personal data relating to (i) contact persons, representatives, directors and employees of Customers, Suppliers, agents and other professional counterparties; (ii) Burando's own employees, workers and contractors; and (iii) any other individual whose personal data Burando processes in connection with its business as a bunkering supplier. As Burando supplies exclusively to professional counterparties and does not contract with consumers, this Policy is not intended to, and does not, create a consumer-facing privacy notice; a separate website or consumer-facing privacy notice may be issued where required by local law.

This Policy does not itself list every applicable local law. Local Compliance, supported by the Data Protection Officer or equivalent local function, is responsible for maintaining a Local Law Annex for each jurisdiction in which Burando operates, identifying the specific local data protection legislation, regulator, and any jurisdiction-specific obligations that apply in addition to, or in substitution for, the principles in this Policy.

1.3 Waivers & Deviations

This Policy represents the requirements that must be fulfilled by the entities in scope. Where a jurisdiction-specific deviation is needed because local law cannot be reconciled with a specific requirement of this Policy, a deviation request must be submitted to the Policy Owner, together with the substantiation for the requested deviation and confirmation of the conflicting local legal requirement. A deviation is only permitted once approved by the Policy Owner. Where the Policy Owner considers the deviation to be material, the matter shall be brought to the attention of the Executive Committee (ExCo).

Where structural adherence to a requirement of this Policy is not immediately possible for a specific entity or jurisdiction, a waiver may be requested from the Policy Owner by way of a substantiated memo. Waivers are generally granted for a limited period to achieve compliance and are documented by Compliance.

1.4 Disciplinary Sanctions

Failure to comply with this Policy, the Local Law Annex applicable to a given jurisdiction, or related procedures, will result in disciplinary action. The severity of any disciplinary action will be determined by Compliance and HR having regard to the seriousness and frequency of the non-compliance.

 

 

2. Hierarchy: Local Law Prevails

2.1 Overarching principle

This Policy is a high-level, group-wide framework. It does not replace, override or limit any obligation that Burando or its personnel have under the data protection, privacy or data localization laws of a jurisdiction in which Burando operates, employs personnel, or otherwise processes personal data.

Wherever a requirement of local law is stricter than, conflicts with, or otherwise differs from a provision of this Policy, the requirement of local law shall prevail and must be complied with. This Policy sets a floor, not a ceiling: it establishes minimum group-wide expectations, and local law may only ever add to, and never reduce, the level of protection afforded to personal data.

2.2 Local Law Annexes

For each jurisdiction in which Burando operates, including at a minimum the European Union (and the EU/EEA Member States in which Burando or its counterparties are established), the United States (at federal and, where applicable, state level) and the United Arab Emirates (including any applicable Dubai free zone regime such as the DIFC), local Compliance or the Data Protection Officer shall maintain a Local Law Annex to this Policy.

Each Local Law Annex shall identify, at a minimum: (i) the applicable local data protection legislation and regulator(s); (ii) the legal basis or bases available for processing personal data in that jurisdiction; (iii) any local registration, notification or Data Protection Officer appointment requirements; (iv) local requirements on cross-border data transfers; (v) local data breach notification timelines and thresholds; and (vi) any additional or divergent data subject rights or retention requirements.

In the event of any inconsistency between this Policy and a Local Law Annex, the Local Law Annex prevails, provided it reflects a genuine local legal requirement and has been approved by Compliance in accordance with Section 1.3 (Waivers & Deviations).

2.3 Interpretive priority

Where personal data processing by Burando is subject to the laws of more than one jurisdiction, for example, where a Customer, Supplier or data subject is located in a different jurisdiction than the Burando entity processing the data, Burando Personnel must apply the most protective of the applicable legal standards to the extent this is consistent with satisfying each applicable law. Compliance should be consulted whenever it is unclear which requirement takes precedence.

 

 

3. Regional and Cross-Border Considerations

3.1 European Union

Where Burando processes personal data of individuals located in the EU/EEA, or processes such data from an establishment in the EU/EEA, the GDPR and applicable Member State implementing legislation apply. This includes, among others, the GDPR's requirements on lawful basis for processing, data minimization, purpose limitation, data subject rights, data protection by design and by default, records of processing activities, and notification of personal data breaches to the competent supervisory authority and affected individuals within the timeframes prescribed by the GDPR.

3.2 United States

Where Burando processes personal data subject to US federal or state privacy legislation, including where applicable state consumer privacy statutes extend to personal data of business contacts or employees, the relevant US legal requirements apply, as set out in the applicable Local Law Annex. Local Compliance is responsible for monitoring the evolving US state privacy law landscape and updating the Local Law Annex accordingly.

3.3 United Arab Emirates (including Dubai)

Where Burando processes personal data subject to UAE law, including Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data or, where applicable to the relevant Burando entity, a free zone data protection regime such as the DIFC Data Protection Law, the relevant requirements apply, as set out in the applicable Local Law Annex. This includes any applicable requirements on appointing a Data Protection Officer, conducting data protection impact assessments, and restrictions on cross-border transfer of personal data out of the UAE or the relevant free zone.

3.4 Cross-border transfers

Burando may transfer personal data between its entities and jurisdictions, including between the European Union, the United States and the United Arab Emirates, in the ordinary course of its business as a bunkering supplier. Any such transfer must comply with the cross-border transfer requirements of the exporting jurisdiction's local law, for example, the GDPR's Chapter V requirements for transfers out of the EU/EEA, before the transfer takes place. Local Compliance is responsible for identifying and implementing the appropriate transfer mechanism (such as adequacy, standard contractual clauses, or another recognized safeguard) for each cross-border data flow.

 

 

4. Data Protection Principles

Subject always to Section 2 (Hierarchy: Local Law Prevails), Burando applies the following principles as a minimum group-wide standard when processing personal data:

  • personal data shall be processed lawfully, fairly and in a transparent manner;
  • personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
  • personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (data minimization);
  • personal data shall be accurate and, where necessary, kept up to date;
  • personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed, subject to applicable statutory retention periods;
  • personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage;
  • Burando must be able to demonstrate compliance with the above principles (accountability).

As Burando supplies exclusively to professional counterparties, the personal data it processes in relation to its Customers and Suppliers is generally limited to business contact and representative data (such as names, business contact details, and signing authority) rather than data relating to individual consumers. This does not reduce Burando's obligations under applicable data protection law with respect to that data, including in respect of the personal data of its own employees.

 

 

5. Governance, Roles and Responsibilities

5.1 Policy Governance

This Policy is owned by Compliance and will be reviewed and updated at least annually, or sooner where required by a material change in applicable law, a significant data breach, or a material change to Burando's business or data processing activities. Once approved by the ExCo, this Policy will be published internally.

5.2 Local Compliance and Data Protection Officers

Each jurisdiction in which Burando operates shall designate a local Compliance contact or Data Protection Officer, as required by local law, who is responsible for maintaining the Local Law Annex for that jurisdiction, advising on local data protection questions, and acting as the local point of contact for data subjects and regulators.

5.3 Burando Personnel

All Burando Personnel who process personal data in the course of their work must comply with this Policy and the Local Law Annex applicable to their jurisdiction, and must escalate any actual or suspected personal data breach to their local Compliance contact or Data Protection Officer without undue delay, in accordance with the Data Breach Notification Procedure.

 

 

6. Policy Implementation Information

6.1 Policy Awareness & Communication

Compliance is responsible for ensuring that Burando Personnel receive training appropriate to their role on the principles set out in this Policy and, where relevant, on the specific requirements of the Local Law Annex applicable to their jurisdiction.

6.2 Policy Monitoring & Reporting

Compliance conducts periodic risk-based monitoring of adherence to this Policy and the Local Law Annexes, and escalates identified instances of material non-compliance to the ExCo.

 

 

Appendix A — Definitions and abbreviations

Personal Data

Any information relating to an identified or identifiable natural person, as further defined under the applicable local law of the relevant jurisdiction (e.g. Article 4(1) GDPR or Article 1 of UAE Federal Decree Law No. (45) of 2021).

Data Subject

The identified or identifiable natural person to whom Personal Data relates.

Controller

The entity that determines the purposes and means of the processing of Personal Data.

Processor

The entity that processes Personal Data on behalf of, and under the instructions of, a Controller.

Local Law Annex

The jurisdiction-specific annex to this Policy, maintained by local Compliance or the Data Protection Officer, identifying the applicable local data protection legislation and requirements as described in Section 2.2.

Professional Counterparty

A business, vessel operator, charterer, commercial intermediary or other professional entity to which Burando supplies bunkers, as opposed to a consumer.

Burando Personnel

Employees, directors, officers, workers and contractors of Burando Energies, including its subsidiaries, branches and representative offices.