1. Purpose
We take the privacy and protection of your personal data seriously. We use encryption methods, access controls, and other technical and organizational measures to help prevent unauthorized access to your personal data.
The purpose of this document is to serve as a privacy notice ("Privacy Notice" or "Notice") for the Petrolodex group of companies (hereinafter referred to as "Petrolodex," "us," "we," or "our").
This Privacy Notice sets out important information about how your personal data is collected, handled, and generally used when you interact with Petrolodex, including through our website, RFQ and account registration process, and our wider trading operations.
"Petrolodex Group" refers to:
- Petrolodex FZCO, a company established under the laws of the United Arab Emirates; and
- Each company in which Petrolodex, directly or indirectly, controls fifty percent (50%) or more of the share capital, or otherwise has the ability to direct or procure the direction of the management and policies of that company (together, the "Petrolodex Group").
2. Introduction
In the course of your engagement with us, we will need to collect and Process your personal data. "Personal Data" is any information from which you can be directly or indirectly identified.
"Processing" refers to the collection, recording, storage, disclosure, and generally any use of your personal data. In compliance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, its executive regulations, and any other applicable data protection laws and regulations (collectively, "Data Protection Laws"), we are required to notify you of what Personal Data is collected and how we hold and Process Personal Data about you.
The "Data Controller" of your personal data is the Petrolodex Group entity responsible for the Processing of your Personal Data. Which entity this is will depend on the products traded, the location(s) these products are sourced from or delivered to, and with whom you or your company has a contract or otherwise liaises. If you have any questions about who the Data Controller of your personal data is, please contact us using the details in Section 10 below.
This Notice was last updated on October 2025. Please take the time to read and understand this Notice. We may need to make changes to it — for example, to reflect legislative changes, new technologies, other developments in privacy law, or changes in how we Process personal data. We may update this Notice at any time, so you should check our website periodically to view the most up-to-date version.
3. How We Collect and Use Your Personal Data
3.1 Overview
In addition to Personal Data, certain Data Protection Laws recognize specified categories of personal data that require further protection, known as "Special Category Data." This includes data relating to health, genetic or biometric data, criminal convictions, sex life or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. We may, in limited circumstances outlined in this Notice, collect and Process your Special Category Data where we have your consent to do so (if applicable) or in the specific circumstances described below, to the extent permitted under applicable law.
If you provide us with personal data relating to other individuals, you agree to inform them about the contents of this Notice and to obtain any required consent in accordance with this Notice.
The personal data we collect about you will vary depending on your relationship with us — whether you are a trading counterparty or account holder, a supplier or logistics partner, a website visitor, a job applicant, or a visitor to our offices. Please see the section below that best describes your relationship with us.
3.2 Business Customers, Trading Counterparties, and Account Holders
This section applies if you are a representative or contact of a prospective or existing Petrolodex trading counterparty, buyer, or an individual who registers for an account on our Website to submit requests for quotation ("RFQs") or manage trading correspondence.
(a) What personal data do we collect and Process about you?
- name, job title, company, and department;
- contact details, such as phone number and email address;
- username and password information used to log into your Website account;
- know-your-customer (KYC), anti-money laundering, and sanctions-screening documentation, such as identification documents, company registration details, and beneficial ownership information, collected to satisfy our compliance obligations described in our Website Terms and Conditions; and
- records of RFQs, quotations, contract negotiations, and any correspondence with you, such as telephone calls, emails, or written communications, which may include notes and recordings.
We do not typically collect or Process Special Category Data about you in this category, except where you voluntarily disclose it in correspondence.
(b) How will we collect your personal data?
All personal data is collected directly from you or from one of your colleagues, or generated in the course of your use of the Website.
(c) What will we use your personal data for, and on what legal grounds?
- To manage our trading relationship, process RFQs, and communicate with you — legitimate business interest or, where applicable, performance of a contract.
- To carry out KYC, anti-money laundering, and sanctions screening before onboarding you or proceeding with a transaction — legal obligation and legitimate business interest.
- For general internal business management purposes, such as audit, security, accounting, and record-keeping — legitimate business interest and legal obligation.
- To comply with our legal obligations, including disclosure to data protection regulators, customs and port authorities, law enforcement, and tax authorities — legal obligation.
- For business development purposes, to market our services to you, and to improve our services — consent or legitimate business interest.
- For purposes related to a merger, acquisition, sale, or restructure — legitimate business interest.
(d) Who will we share your personal data with?
- other members of the Petrolodex Group;
- logistics providers, freight forwarders, surveyors, inspection agencies, and terminal operators involved in fulfilling a trade;
- banks, trade-finance providers, and payment processors;
- KYC, anti-money laundering, and sanctions-screening service providers;
- our third-party service providers, including IT suppliers, document management providers, and information security providers;
- legal and professional advisers; and
- data protection regulators, customs and port authorities, law enforcement, and tax authorities, where legally required.
3.3 Suppliers, Producers, Shipowners, and Logistics Partners
This section applies if you are a sole trader, or a contact at a refinery, producer, shipowner, freight forwarder, surveyor, or other supplier or logistics partner with whom we engage as part of our trading operations.
(a) What personal data do we collect and Process about you?
- name, contact details, company, job title, and department;
- financial information, including bank details, for payment purposes;
- information obtained through onboarding, procurement, or due diligence checks; and
- records of correspondence with you, including telephone calls, emails, and written communications.
We may Process limited Special Category Data, such as information about criminal convictions disclosed as part of due diligence checks, where necessary and permitted under applicable law.
(b) How will we collect your personal data?
- directly from you;
- from introducers and business contacts; and
- from publicly available sources, where permitted by law.
(c) What will we use your personal data for, and on what legal grounds?
- To engage and onboard suppliers and logistics partners and fulfil our contractual obligations — performance of a contract and legitimate business interest.
- To manage our relationship and respond to any queries or complaints — legitimate business interest.
- For general internal business management purposes, such as audit, security, and record-keeping — legitimate business interest and legal obligation.
- To comply with our legal obligations, including disclosure to regulators and authorities — legal obligation.
- For purposes related to a merger, acquisition, sale, or restructure — legitimate business interest.
(d) Who will we share your personal data with?
- other members of the Petrolodex Group;
- our third-party service providers, including IT suppliers, document management providers, and information security providers; and
- data protection regulators, law enforcement, and tax authorities, where legally required.
3.4 Website Visitors and Enquiry Submitters
This section applies if you visit our Website, submit an enquiry, contact form, or chat with us online, or subscribe to receive updates from us.
(a) What personal data do we collect and Process about you?
- name and contact details, such as phone number and email address;
- company you work for, job title, and department;
- any questions, queries, or feedback you submit via our webforms, enquiry forms, or chat functions;
- your preferences when you sign up to receive updates from us; and
- information obtained through our use of cookies and similar technologies, such as IP address and device identification (see our Cookie Notice for further detail).
We do not collect or Process any Special Category Data about you in this category.
(b) How will we collect your personal data?
All personal data is collected directly from you or your device.
(c) What will we use your personal data for, and on what legal grounds?
- To respond to your enquiries and communicate with you — legitimate business interest.
- For general internal business management purposes, such as security and record-keeping — legitimate business interest and legal obligation.
- To send you marketing communications about our services — consent.
- To deploy cookies and similar tracking technologies — legitimate business interest (for strictly necessary cookies) or consent (for all other cookies), as described in our Cookie Notice.
(d) Who will we share your personal data with?
- other members of the Petrolodex Group;
- our third-party service providers, including IT, website, and analytics providers; and
- data protection regulators and law enforcement, where legally required.
3.5 Job Applicants
This section applies to individuals applying to work at Petrolodex. If your application includes personal data relating to others, such as referees or next of kin, you agree to inform them of this Notice and obtain any required consent.
(a) What personal data do we collect and Process about you?
- name, date of birth, and gender;
- contact details, including address and telephone number;
- next of kin and emergency contact details;
- identity documents, including passport, identification, and visa or citizenship details;
- recruitment information, including previous employment, job title, and department;
- financial information, including bank details for payment purposes; and
- where relevant to the role, background screening results, which may include criminal record checks, credit checks, and sanctions screening, given the compliance obligations described in Section 8 of our Website Terms and Conditions.
We may also Process the following Special Category Data: information about your health or disability where relevant to reasonable accommodations, and information about criminal convictions that you disclose to us or that arise from background screening.
(b) How will we collect your personal data?
- directly from you, including through interviews and correspondence;
- from recruitment or talent management agencies;
- from publicly available professional sources, such as LinkedIn, where permitted by law; and
- from background-check providers, once an offer of employment is made.
(c) What will we use your personal data for, and on what legal grounds?
- To assess your suitability for a role, conduct interviews, and negotiate an employment contract — steps to enter into a contract with you.
- To carry out background and sanctions screening checks — legal obligation and legitimate business interest.
- For general internal business management purposes — legitimate business interest and legal obligation.
- To comply with our legal obligations, including visa, immigration, or security clearance requirements — legal obligation.
(d) Who will we share your personal data with?
- other members of the Petrolodex Group;
- recruiters and your referees;
- background-check providers; and
- regulators, law enforcement, and immigration authorities, for visa or security clearance purposes.
3.6 Office and Facility Visitors
This section applies if you visit a Petrolodex office or facility.
(a) What personal data do we collect and Process about you?
- name and contact details, including emergency contact information;
- company you work for, job title, and department;
- identification or passport number; and
- security and monitoring information, such as CCTV footage.
Where our premises use facial recognition or similar technology for access control, we will also Process biometric data as Special Category Data, with your explicit consent or as otherwise permitted by law.
(b) How will we collect your personal data?
All personal data is collected directly from you.
(c) What will we use your personal data for, and on what legal grounds?
- To communicate with you and assist you during your visit — legitimate business interest.
- For security and health and safety purposes, including through the use of CCTV — legitimate business interest and legal obligation.
- To comply with our legal obligations, including health and safety compliance — legal obligation.
(d) Who will we share your personal data with?
- other members of the Petrolodex Group;
- our security and facilities service providers; and
- law enforcement and regulators, where legally required.
4. Using Your Personal Data for Marketing
With your consent, we may from time to time provide you with information about our services, market updates, or industry developments that we think will be of interest to you. This may be sent by email or by phone.
You can withdraw your consent to marketing communications at any time. An "unsubscribe" link appears in all our marketing emails, or you may contact us using the details in Section 10 below.
5. Automated Decision-Making and Profiling
Automated decision-making takes place when an electronic system Processes Personal Data to make a decision without human intervention. We do not currently make any decisions about you using solely automated means. If this position changes, we will take steps to notify you.
6. International Data Transfers
Given Petrolodex's global trading operations spanning North America, South America, EMEA, and Asia Pacific, your personal data may be transferred to other companies within the Petrolodex Group, or to logistics partners, banks, and service providers, located in jurisdictions outside the UAE, including the countries where cargo is sourced, loaded, shipped, or delivered (each, a "Relevant Location").
Where we transfer personal data to a Relevant Location, we will ensure such transfers are appropriately safeguarded and undertaken in compliance with Data Protection Laws. This may be achieved by:
- transferring to a country recognized as offering an adequate level of data protection;
- entering into standard contractual clauses or model data protection clauses with the recipient; or
- using another transfer mechanism approved by law, having ascertained that the recipient has taken appropriate technical and organizational measures to protect your personal data.
7. Personal Data Security
We are committed to safeguarding and protecting your personal data and implement a range of technical and organizational measures to do so, including encryption, access controls, and restricted access on a need-to-know basis.
These measures are designed to provide a level of security appropriate to the type of personal data Processed and to protect it from accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise Processed.
8. How Long We Retain Your Personal Data
We will only retain your personal data for as long as necessary to fulfil the purposes described in this Notice and to comply with our legal requirements. To determine the appropriate retention period, we consider:
- the purpose for which the data is used — we retain it only as long as necessary for that purpose; and
- legal and regulatory obligations — for example, applicable KYC, anti-money laundering, and sanctions-compliance regulations may require us to retain trading-counterparty due diligence records for a defined minimum period after the business relationship ends.
For example: if you are a contact at a trading counterparty or supplier, we retain your personal data for as long as the business relationship is active and for a further period afterward in accordance with our document retention policy; if your job application is unsuccessful, we retain your personal data for a defined period in accordance with our recruitment retention policy; and if you are an office visitor, we retain CCTV footage for a limited period, typically no longer than 90 days, unless a longer period is required for a specific investigation.
9. Your Data Subject Rights
Please keep us informed of any changes to your details so that our records remain accurate and up to date.
Depending on the Data Protection Laws that apply to you, you may have the right to:
- request access to your personal data and details of how we use it;
- request correction of personal data that is inaccurate, out of date, or incomplete;
- request erasure of your personal data in certain circumstances, for example where it is no longer necessary for the original purpose or you withdraw your consent;
- object to our Processing of your personal data where we rely on legitimate interest as our legal ground;
- withdraw your consent to marketing at any time, including via the "unsubscribe" link in our emails;
- request restriction of Processing in certain circumstances;
- request the transfer of your personal data to you or to a third party (data portability);
- request a review of, and object to, any decision made about you using solely automated means (noting we do not currently undertake automated decision-making);
- request details of the safeguards used for transfers of your personal data outside the Relevant Location;
- withdraw consent to Processing where we rely on your consent, without affecting the lawfulness of Processing carried out before withdrawal;
- make a complaint to Petrolodex if you believe there has been an infringement of Data Protection Laws; and
- lodge a complaint with the competent UAE data protection authority, or the relevant regulator in your jurisdiction.
Not all of these rights are absolute, and there may be circumstances where we are unable to comply with a request — for example, where this would conflict with our legal obligations. Where we cannot comply with a request, we will explain why. We would also encourage you to raise any concerns with us directly before escalating to a regulator.
You can exercise your rights by contacting us using the details in Section 10 below.
10. Contact Us
Thank you for taking the time to read this Notice. For any queries, concerns, or requests relating to this Privacy Notice, or the personal data we hold about you and how it is Processed, please contact us at:
Petrolodex — info@petrolodex.com
Office 1904, DAMAC XL Tower, Business Bay, Dabai, UAE
Email: [info@petrolodex.com] | Tel: +971-4-558-1599
