Privacy policy

1. Who is responsible

The controller responsible for this website and for enquiries sent to us is:

[OWNER TO CONFIRM: if the company has no establishment in the EU but the GDPR applies to it under Article 3(2), the name and address of its EU representative (Article 27 GDPR) — otherwise delete this sentence]

2. In short

• No analytics, advertising or social-media tools, and no tracking cookies or pixels.
• No fonts, images, videos or other content loaded from other companies’ servers.
• No user accounts, no newsletter and no comment functions.
• The enquiry form does not transmit anything: you decide whether to send us your enquiry (section 5).

3. Hosting and server logs

The website and our email are hosted by Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA, which processes data on our behalf. [OWNER TO CONFIRM: the data centre location of the hosting plan, as shown in the Namecheap account]

Each time you open a page, your browser transmits technical data: your IP address, the date and time, the address of the page requested, the referring page, and your browser and operating system. The server records this in access logs, which are used to deliver the pages, to keep the service secure and stable and to investigate faults. The hosting control panel can also produce overall visitor statistics from these logs; no cookies or tracking code are used for this.

Legal basis: our legitimate interest in providing a secure, working website (Article 6(1)(f) GDPR). Access logs are kept only as long as needed for these purposes, and longer only where needed to investigate a security incident. [OWNER TO CONFIRM: the log retention set in cPanel under “Raw Access”]

4. Cookies and storage on your device

The website stores only what is strictly necessary to provide the website or a function you ask for. This does not require consent (Article 5(3) of the ePrivacy Directive and the national laws implementing it, such as Section 25(2) No. 2 TDDDG in Germany).

• “lang”: set by this website only when you choose a language with the language switch. It contains only the language code (for example “en” or “ar”) and is kept for 12 months, so that the next page is shown in the language you chose.
• Scroll positions: while you browse, the website keeps the scroll position of pages you have visited in your browser’s session storage (an entry beginning “tsr-scroll-restoration”), so that going back returns you to the same place. It never leaves your device and is deleted when you close the tab.

If you do not use the language switch, the language is taken from your browser’s language setting, which is not stored. The single cookie named “lang” is not used for any other purpose and is not shared with anyone. You can delete cookies at any time in your browser settings.

5. Enquiries

The enquiry form prepares your enquiry on your own device. While you fill it in, nothing is sent to us or to anyone else, and nothing is stored on a server. When it is ready, you can download it as a file, copy the text, or open it in your own email program. If you use “Open in email app”, the enquiry is handed to the email program on your device and reaches us only if you send that email yourself.

When you send us an enquiry or another message, we receive your name, company, contact details and what you write. We use this to answer you, to assess the requested business and to take steps you ask for before a possible agreement. Email to our address is received and stored by our email provider:

Legal basis: steps taken at your request before a contract (Article 6(1)(b) GDPR) where you contact us for yourself, and otherwise our legitimate interest in communicating with the businesses you represent (Article 6(1)(f) GDPR).

If no business follows, we delete the enquiry when it is no longer needed to answer you or to follow up the same requirement. [OWNER TO CONFIRM: the maximum period for keeping enquiries that do not lead to business, e.g. a fixed number of months after the last contact]

6. Business partners and transactions

If an enquiry leads to a business relationship, we process the contact details of the people who represent the parties, our correspondence, documents identifying the companies involved and their owners and representatives, and the records of the transaction. To meet our legal obligations and to protect ourselves against fraud, we may check companies and the people acting for them against sanctions lists and public registers, and ask for identification documents.

Legal basis: performance of our agreement (Article 6(1)(b) GDPR); legal obligations, for example under sanctions, anti-money-laundering, accounting and tax law where they apply to us (Article 6(1)(c) GDPR); and our legitimate interest in knowing whom we deal with and in preventing fraud and sanctions breaches (Article 6(1)(f) GDPR).

We keep these records for the duration of the relationship and afterwards for the periods required by commercial, tax and, where applicable, anti-money-laundering law. [OWNER TO CONFIRM: the statutory retention periods that apply in the company’s jurisdiction]

7. Who receives data

• our hosting and email provider, which processes data on our behalf;
• the prospective buyer or seller, to the extent needed for an introduction you have asked for;
• banks, inspection companies, logistics providers and professional advisers such as lawyers and accountants, where needed for a transaction or to protect our rights;
• authorities, where we are legally obliged to disclose data.

We do not sell personal data and do not use it for advertising.

8. Processing outside your country

Our providers and business partners may process data outside your country, including outside the EU and EEA. Our hosting and email provider is a company in the United States. Where the law requires it, transfers from the EU are based on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified recipients) or on the Commission’s standard contractual clauses. [OWNER TO CONFIRM: the country where the company itself processes data, and the transfer safeguards in Namecheap’s data processing terms]

9. Your rights

Depending on the law that applies to you, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased or its processing restricted;
• receive your data in a portable format;
• withdraw any consent you have given, with effect for the future.

Right to object: where we process your data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data for legal claims.

To exercise your rights, write to info@friendsoilcompany.eu. We may ask you to confirm your identity. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you believe your rights were infringed. The authority competent for the company is:

You do not have to give us personal data, but we cannot answer an enquiry without contact details. This website does not use automated decision-making or profiling.

10. Changes

We update this policy when the website or our processing changes. The date of the current version is shown below.