Privacy Notice

This Privacy Notice has been drafted to comply with the data protection laws applicable in the European Union (the EU General Data Protection Regulation (GDPR)), the United Kingdom (the UK GDPR and the Data Protection Act 2018) and Switzerland (the Federal Act on Data Protection (FADP)).

This Privacy Notice explains how Vitol collects, uses, shares and protects personal data when you interact with us, and what rights you have in respect of that personal data. We are committed to protecting your privacy and processing your personal data in accordance with applicable data protection laws.

This Privacy Notice may be relevant for you in a range of situations, including (but not limited to) where you:

• visit or use our website at vitol.com or any other Vitol Group website that links to this notice;
• are, or represent, a prospective or existing counterparty, customer, supplier or business partner of Vitol (including as a director, officer, beneficial owner, authorised representative, agent or other associated individual of such an entity);
• register for or attend a Vitol-hosted event, or are nominated as a delegate by your employer;
• visit one of our offices, terminals or operated sites, or use our visitor Wi-Fi; or
• are otherwise in contact with us in a business context (for example as a journalist, regulator or professional adviser).

There may be other circumstances in which Vitol collects personal data where a separate privacy notice would apply. That privacy notice will govern the relevant processing.

The terms “Vitol,” “Vitol Group”, “the Company,” or “the Group” may be used for convenience and refer to Vitol Netherlands Coöperatief U.A. and its direct and indirect subsidiaries and affiliates, each of which are separate and distinct legal entities. Further, the words “we,” “us,” “our,” and “ourselves” are used to refer generally to the companies of the Vitol Group.

The Vitol entity responsible for processing your personal data (the “controller”) depends on the relationship you have with us. The principal Vitol controllers and their lead supervisory authorities are:

If you have any questions about this notice, wish to exercise your rights or want to raise a privacy concern, please contact us by e-mail via [email protected]. You can also reach us via post at: Vitol, Place des Bergues 3, P.O. Box 1384, 1211 Geneva 1, Switzerland.

The personal data we collect, and our reasons for collecting it, depend on how you interact with us. The principal interaction scenarios are set out below.

4.1. When you use our website

When you visit vitol.com we may collect limited technical data automatically (IP address, browser type and version, operating system, device identifiers, referrer URL, pages visited and timestamps), together with the cookies described in Section 7 and our separate Cookie Policy. When you choose to submit a contact or enquiry on the website, we may also collect the information you provide through that form.

4.2. When you use our visitor Wi-Fi service

If you connect to a Vitol office visitor Wi-Fi service, we (or your Vitol host) may collect your first and last name, business e-mail address and company name in order to create your Wi-Fi account, and while you use the service we record the MAC address and IP address assigned to your device and the visitor Wi-Fi username. We use this information to operate the Wi-Fi service securely and to investigate any misuse or cyber-security incidents.

4.3. When you are, or represent, a prospective or existing counterparty, customer, supplier or business partner

If you are, or represent, a prospective or existing counterparty, customer, supplier or other business partner of Vitol, we may collect personal data about you and (where applicable) about individuals associated with the organisation you represent, such as its directors, officers, beneficial owners and authorised representatives. This may include identification and contact details, professional information (such as job title and role), financial information, and identity verification documents.

If you do not provide this information, you, or the organisation you represent, may not be able to transact with us.

4.4. When you apply for a role with us, or are introduced to us

Where you apply for a role or other engagement with Vitol or are introduced to us by a recruitment agency or other intermediary, we may collect the information set out in our separate Fair Processing Notice for Job Applicants which is available to you. That notice prevails over this notice in respect of recruitment processing.

4.5. When you register for or attend a Vitol-hosted event

If you register for or attend an event that is hosted, sponsored or co-organised by Vitol, we may collect the information you provide on registration (including your name, employer, job title and contact details), and — where we organise your travel, accommodation or visas — your passport and visa details.

4.6. When you visit our offices, terminals or other premises

When you visit one of our offices, terminals or other premises, we may record your name, company name, time of arrival and departure and the name of your Vitol host in our visitor logs. For security reasons, our premises are monitored by CCTV in line with applicable signage.

4.7. When you are connected with a corporate transaction

Where Vitol is considering acquiring, investing in, divesting or financing a business, we may collect personal data about you if you are a director, shareholder, officer, employee or other associated individual of the target or counterparty in the corporate transaction. This will typically be collected from public registers, from professional advisers, from a data room or from the target itself.

4.8. When you are granted or hold a power of attorney

If a Vitol Group company grants a power of attorney to you, we will collect the identification, contact and authority information necessary to evidence and rely on that power of attorney.

The table below sets out the categories of personal data we process, the purposes, the legal basis we rely on, and our rationale.

5.1. Where we get your personal data from

We may obtain personal data about you from the following sources:

• Directly from you — for example when you contact us, attend our events, apply for a role or communicate with us in the course of a commercial relationship;
• From your employer or the organisation you represent — for example when you are nominated as a counterparty contact, director, beneficial owner or authorised representative;
• From third-party service providers — including identity-verification, KYC, sanctions-screening, adverse-media, credit-reference and background-check providers, recruitment agencies, professional advisers, business introducers and event-management providers;
• From publicly available sources — including public registers, regulatory filings, court records, company registries, news media, professional networking sites such as LinkedIn, and sanctions and PEP lists;
• From counterparties or transaction parties — for example a target company or its advisers in the context of a corporate transaction; and
• Generated by us — including records of our meetings, correspondence, calls, transactions, screening outcomes and any internal analysis we carry out.

5.2. Anonymisation and aggregation

We may convert your personal data into statistical or aggregated form, or otherwise de-identify it, to better protect your privacy or so that you cannot be identified from it. We may then use the anonymised information for research and analysis, including the production of statistical reports, without further notice to you.

We may use automated tools to assist us. Where the outcome of such a tool could have legal or similarly significant effects on you, the result is always subject to meaningful human review before any decision is taken, and we do not make such decisions on a solely automated basis.

Our website uses cookies to distinguish you from other users. Information about the cookies we use, their purposes, duration and recipients is set out in our Cookie Policy.

From time to time, we may invite you to a Vitol event or send you other information that we consider may be of interest to you in your professional capacity. You may object to any such direct marketing at any time by contacting [email protected].

9.1. Inside the Vitol Group

The Vitol Group includes companies and operations around the world. We share personal data with other Vitol Group companies where this is necessary for the purposes set out in Section 5 — including for centralised functions such as IT, finance, legal, compliance, HR, treasury, risk and audit, for the management of our commercial relationships, for risk and exposure management and for regulatory reporting. Access between Group companies is granted only on a need-to-know basis, depending on job function and role.

9.2. Outside the Vitol Group

From time to time, we may engage third parties to carry out business functions for us — for example IT support, hosting and cloud computing, KYC and sanctions-screening, background-check and credit-reference agencies, recruitment, event management, marketing communications, security and travel management. Where these third parties act as processors on our behalf, we will satisfy ourselves that they have appropriate security standards in place.

In certain circumstances we also share personal data with third parties who receive it as controllers in their own right, including:

• Banks, financial institutions, credit reference agencies, insurers and reinsurers;
• Commercial counterparties, brokers, intermediaries, exchanges, clearing houses and trade repositories;
• Regulators, supervisory authorities, tax authorities, customs and other competent governmental, regulatory or judicial authorities (including in response to legally binding requests and, where appropriate and proportionate, voluntary requests);
• Law enforcement and sanctions authorities;
• Our professional advisers, including auditors, lawyers, tax and accounting advisers, and information-security consultants;
• Prospective purchasers, sellers, joint-venture partners or counterparties in connection with corporate transactions, M&A, divestments, restructurings, joint ventures or financings (and their professional advisers); and
• Any other third party where you have specifically directed us to do so.

Vitol is a global business. Personal data that we collect from you in the EEA, the United Kingdom or Switzerland may be transferred to, stored at and processed in countries outside those territories, and may be processed by staff working for us or for one of our service providers outside those territories. We take all steps reasonably necessary to ensure that personal data is treated securely and in accordance with this notice.

We transfer personal data outside the EEA, the UK or Switzerland only where one of the following applies:

• The destination is the subject of an adequacy decision of the relevant authorities;
• The transfer is made subject to appropriate safeguards;
• Binding corporate rules approved by the competent supervisory authority are in place; or
• A specific derogation applies — used only on an exceptional, non-routine basis.

Where we rely on appropriate safeguards, we assess the level of protection in the destination country and put in place any additional measures needed to ensure your data remains adequately protected.

We take our security obligations seriously and have implemented appropriate technical and organisational measures to protect your personal data from unauthorised or unlawful processing and from accidental loss, destruction or damage. These measures include encryption in transit and at rest, role-based access controls, multi-factor authentication, vulnerability management, third party security due diligence, incident-response procedures, disaster recovery processes and regular staff training.

In the event of a personal data breach, we will assess the likely risk to your rights and freedoms and take appropriate steps to contain, investigate and remediate the incident. Where required by applicable law, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, unless an applicable legal exception applies.

We keep your personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. When determining the appropriate retention period, we consider the nature, sensitivity and volume of the data, the purposes for which we process it, the potential risk of harm from unauthorised use or disclosure, applicable legal, regulatory, tax, accounting and reporting requirements, relevant contractual obligations, and any legitimate interest pursued by us or by a third party.

At the end of the applicable retention period we securely delete, destroy or anonymise your personal data. Where data has been anonymised so that it can no longer be associated with you, we may continue to use the anonymised information without further notice to you.

Subject to the conditions and limitations of applicable data protection law, you have the following rights in respect of the personal data we hold about you. Please note that your ability to exercise these rights may be limited in circumstances where we are obliged to retain certain data.

We will respond to any request without undue delay and in any event within one month of receipt, extendable by a further two months for complex or numerous requests (in which case we will inform you of the extension within one month). We do not generally charge a fee, save where requests are manifestly unfounded or excessive.

To exercise your rights, please contact [email protected]. We may ask you for additional information to confirm your identity before responding. If any of the personal data you have provided to us changes, or you believe something we hold about you is incorrect, please let us know without delay.

To help us deal with your request as quickly as possible, please tell us as clearly as you can which personal data your request relates to (for example by reference to a date range, a specific Vitol entity or a specific business interaction). Where you wish to update or correct personal data we hold about you, please first check whether the relevant information can be updated directly (for example through any account or registration portal you may have with us).

We would appreciate the opportunity to address your concerns before you approach a regulator, and encourage you to contact us at [email protected] in the first instance. However, you have the right to lodge a complaint at any time with the competent supervisory authority. These include:

• For individuals in the EEA: the data protection authority of your habitual residence, place of work or the place of the alleged infringement. The lead supervisory authority for the Vitol Group is Autoriteit Persoonsgegevens (AP) — autoriteitpersoonsgegevens.nl;
• For individuals in the United Kingdom: the Information Commissioner’s Office (ICO) — ico.org.uk;
• For individuals in Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch.

Our website and services are not directed to, or intended for use by, children under the age of 16, or such lower age as Member State law permits (e.g. 13 in the United Kingdom). If you believe we have inadvertently collected personal data of a child, please contact [email protected] and we will take appropriate steps.

We may update this notice from time to time. We will review it periodically and update it as required to reflect changes in our processing activities or in applicable law. The effective date at the top of this notice will be updated accordingly.

If you would like more information about anything in this notice, or to discuss any concern with us, please contact us at [email protected].

Last Updated: 7 July 2026