Data Protection & Privacy

Privacy Policy

Caspivelo Commodities Ltd

Last Updated: 9 November 2025

1. Introduction

Caspivelo Commodities Ltd ("we", "us", "our", or "the Company") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you interact with our business, visit our website, or engage with our services.

This policy applies to all personal data processing activities carried out by Caspivelo Commodities Ltd, a private company limited by shares registered in England and Wales.

Data Controller: Caspivelo Commodities Ltd
Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company Type: UK Private Company Limited by Shares

2. Information We Collect

2.1 Personal Identification Information

When you engage with our services or submit inquiries, we may collect:

  • Full name and professional title
  • Company name and registration details
  • Email address and telephone number
  • Business address and correspondence details
  • Professional credentials and industry affiliations

2.2 Due Diligence and Compliance Information

As part of our regulatory obligations under UK and international financial crime prevention laws, we collect:

  • Identity verification documents (passport, national ID, driver's license)
  • Proof of address documentation
  • Beneficial ownership information and corporate structure details
  • Source of funds and source of wealth declarations
  • Sanctions screening results and compliance verification records

2.3 Technical and Usage Information

When you visit our website, we may automatically collect:

  • IP address and geographic location data
  • Browser type, device information, and operating system
  • Pages visited, time spent on pages, and referral sources
  • Cookies and similar tracking technologies (see our Cookie Policy)

2.4 Transaction and Commercial Information

In the course of business relationships, we may process:

  • Contract details, purchase orders, and sale agreements
  • Payment information and banking details
  • Shipping and logistics information
  • Correspondence and communication records

3. How We Use Your Information

We process your personal data only where we have a lawful basis to do so under UK GDPR and the Data Protection Act 2018. We use your information for the following purposes:

3.1 Contract Performance and Business Operations

  • To process inquiries and respond to business communications
  • To negotiate, execute, and fulfill commercial contracts
  • To coordinate shipments, logistics, and delivery arrangements
  • To process payments and manage financial transactions

Legal Basis: Contract performance (GDPR Article 6(1)(b))

3.2 Legal and Regulatory Compliance

  • To conduct Know Your Customer (KYC) and Anti-Money Laundering (AML) verification
  • To perform sanctions screening and watchlist checks
  • To comply with UK Companies House filing requirements
  • To respond to lawful requests from regulatory authorities and law enforcement
  • To maintain records as required by financial regulations and trade compliance laws

Legal Basis: Legal obligation (GDPR Article 6(1)(c))

3.3 Legitimate Business Interests

  • To assess creditworthiness and manage commercial risk
  • To prevent fraud, financial crime, and unauthorized activities
  • To improve our website, services, and customer experience
  • To maintain business records and internal documentation
  • To defend legal claims and protect our business interests

Legal Basis: Legitimate interests (GDPR Article 6(1)(f))

3.4 Consent-Based Processing

  • To send marketing communications or industry updates (where you have opted in)
  • To use cookies and tracking technologies (subject to cookie preferences)

Legal Basis: Consent (GDPR Article 6(1)(a)) – You may withdraw consent at any time

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your data with the following categories of recipients for legitimate business and legal purposes:

Service Providers and Professional Advisors

We may share information with third-party service providers who assist us in business operations:

  • Identity verification and KYC/AML screening providers
  • Legal advisors, accountants, and auditors
  • IT infrastructure and cybersecurity service providers
  • Inspection agencies (SGS, Bureau Veritas, Intertek)

Regulatory Authorities and Law Enforcement

We may disclose personal data to regulators, government agencies, and law enforcement when required by law or to comply with legal obligations, court orders, or regulatory investigations.

Transaction Counterparties

In the context of facilitating commercial transactions, we may share relevant business information with verified suppliers, buyers, and intermediaries involved in the transaction, subject to confidentiality obligations.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this policy.

Data Processing Safeguards

All third-party service providers are contractually bound by data processing agreements that require them to maintain appropriate security measures, process data only for specified purposes, and comply with UK GDPR requirements.

5. International Data Transfers

Given the international nature of commodities trading, your personal data may be transferred to, stored, or processed in countries outside the United Kingdom and European Economic Area (EEA).

Transfer Safeguards

When transferring data internationally, we ensure appropriate safeguards are in place:

  • Adequacy Decisions: Transfers to countries recognized by the UK government as providing adequate data protection
  • Standard Contractual Clauses: Use of UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs)
  • Binding Corporate Rules: Where applicable for transfers within corporate groups

You have the right to request information about the safeguards we have in place for international data transfers. Please contact us using the details provided at the end of this policy.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal, regulatory, and contractual obligations.

Retention Periods

Inquiry and Contact Information 2-3 years

Retained for business development and relationship management purposes

KYC/AML Verification Records 6 years minimum

Required by UK Money Laundering Regulations and financial crime prevention laws

Contract and Transaction Records 7 years

Required for tax, accounting, and commercial law compliance

Financial and Payment Records 7 years

As required by HMRC and Companies Act obligations

Website Analytics and Cookies Up to 24 months

Subject to cookie preferences and consent management

Important: In certain circumstances, we may retain data for longer periods where required by law, to defend legal claims, or where we have a legitimate interest in doing so. Personal data will be securely deleted or anonymized once the retention period expires.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration.

Technical Safeguards

  • Encryption of data in transit and at rest
  • Secure access controls and authentication
  • Regular security assessments and vulnerability testing
  • Firewall protection and intrusion detection systems

Organizational Measures

  • Confidentiality agreements for all employees
  • Role-based access controls (need-to-know basis)
  • Data protection training and awareness programs
  • Incident response and data breach procedures

Data Breach Notification: In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours as required by UK GDPR.

8. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you (Subject Access Request). We will provide this free of charge within one month.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. We will update your information promptly upon verification.

Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data in certain circumstances. However, this right is not absolute and may be limited where we have:

  • • A legal obligation to retain data (e.g., AML/KYC records for 6 years)
  • • Ongoing contractual obligations or pending transactions
  • • Legal claims that require retention of evidence

Right to Restrict Processing

You can request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

Where processing is based on consent or contract performance, you have the right to receive your data in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we have compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing. We do not currently use automated decision-making systems.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw consent at any time. This will not affect the lawfulness of processing prior to withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us using the details provided in Section 10. We will respond to your request within one month (extendable by two months for complex requests).

Contact Us About Your Rights

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance user experience, analyze website traffic, and improve our services.

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us recognize your device and remember your preferences during your visit or for future visits.

Types of Cookies We Use:

Strictly Necessary Cookies

Essential for website functionality and security. These cannot be disabled as they are required for the site to operate properly.

Performance and Analytics Cookies

Help us understand how visitors use our website, which pages are most popular, and identify technical issues. These cookies are used to improve site performance.

Functionality Cookies

Remember your preferences and settings (such as language preferences) to provide a more personalized experience.

Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to:

  • View and delete cookies stored on your device
  • Block third-party cookies
  • Block all cookies (note: this may affect website functionality)
  • Delete cookies when you close your browser

For more information on managing cookies, visit www.allaboutcookies.org

10. Contact Information

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we process your personal data, please contact us:

Company Details

Caspivelo Commodities Ltd
71-75 Shelton Street
Covent Garden, London
WC2H 9JQ
United Kingdom

Data Protection Inquiries

For all data protection and privacy matters, please use our contact form or reach out through the channels provided on our Contact page.

Contact Us

Response Time: We aim to respond to all data protection inquiries within one month. For complex requests, this may be extended by up to two additional months, and we will inform you of any delay.

11. Right to Complain to the ICO

If you are not satisfied with how we have handled your personal data or believe we have breached data protection law, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
United Kingdom

Website: www.ico.org.uk
Helpline: 0303 123 1113

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make significant changes, we will:

  • Update the "Last Updated" date at the top of this policy
  • Notify you via email or prominent notice on our website (for material changes)
  • Request your consent where required by law

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.