The personal data we collect about you depends on your interaction with Gulf, your privacy settings and applicable law.

Direct interactions. We collect personal data when you provide it to us directly through your use of our website, or in the course of doing business with us. For example:

• If you contact us to request information about our products, services or partnerships, we may collect your name, contact details, information about the organisation you work for and your role within such organisation.
• If you register to use the Gulf Oil Extranet and create an account, we may collect your name, contact details, login information (username and password) and any other information you add to your account.
• If you participate in any of our marketing activities, including offers, sweepstakes, contests and promotions, we may collect your name, contact details, electronic identification data, consumption habits or interest and any other information you may provide.
• We will collect business contact information when you do business with us which may include company name, your name, your role at your company, business email address.
• We may also keep records of your interactions with us both on our website and in person including if you ask us a question, submit an enquiry form or contact our customer service team.
• If you make a purchase via our website (please note that this is only available in certain countries), then we will collect details of the transaction and any associated billing or delivery information which may include credit/debit card details or other payment related data.
• If you engage with us on social media or use the social media integrations on our website, then we may collect information about this engagement.
• We may collect other information you provide to us if, for example, you search for a Gulf retail outlet or supplier you may be asked to provide your postcode so that we can show the outlets or suppliers nearest to you.

Automated technologies or interactions. We will also collect information about how you use and interact with our website, such as:

• technical information about your use of our website, including your IP address, browser type and version, time-zone setting and location, operating system and platform and other device information; and
• information collected automatically using cookies and other similar technologies, such as which pages you viewed and which content you interacted with. We explain more about this below.

Third-party or publicly available sources. We may collect personal data about you from third parties when they send us your personal data to enable the supply of our products or services to you, where permitted by law or when we interact with governmental or regulatory authorities, including from various tax agencies. If you do not wish to provide your personal data where we need to collect such data by law or under a contract with you, we may not be able to perform our obligations under the contract or otherwise (for example, we may be unable to provide you with products or services).

Depending on how you use the Sites or otherwise do business with us, your interactions with us, and the permissions you give us, the purposes for which we use your information include:

• To maintain, promote and/or provide the products, services and information you have requested via the Sites.
• To manage and respond to any queries, feedback or messages submitted via the Sites.
• To improve, administer and maintain the Sites, and monitor their usage.
• To build and manage our business relationships.
• To organise, host and promote events and marketing activities.
• For market research, e.g. we may use your feedback to develop and improve our products and services.
• To provide and maintain your Gulf Oil Extranet account (if you have one).
• To provide our social media pages and integrations.
• To tell you about Gulf Oil partnerships, products and services we think you will be interested in, e.g. we may send marketing messages and newsletters where we have your consent or are otherwise permitted to do so.
• For security purposes, to investigate fraud and where necessary to protect ourselves and third parties.
• To comply with our legal and regulatory obligations, including undertaking appropriate due diligence on our suppliers, clients and other business contacts.

We will only use your personal data for the purposes for which we collected it or for another reason compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We rely on the following legal bases under applicable data protection laws, to process your personal data:

• Because it is in our legitimate interests, unless your interests and fundamental rights override those interests (e.g. to administer the Site or social media pages and deliver relevant content. This enables us to establish, manage and maintain our customer and commercial relationships).
• Because we have obtained your consent (e.g. where you contact us with a query, where you add optional information to your account, or if you consent to receive marketing from us). You have the right to withdraw your consent at any time by contacting us.
• Because the processing is necessary to perform a contract with you, or take steps prior to entering into a contract with you (e.g. where you have made a purchase with us, we use your personal data to communicate with you, process the payment and fulfil your order).
• Because we need to comply with a legal obligation.

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

If you send us information in connection with an application to work for Gulf then we may process this information to assess your application to join our workforce. The information you provide may include your contact details, a record of your previous employment and a copy of your CV or resume. During the recruitment process, Gulf may also collect data about your performance at an assessment or interview and information provided about and by your referees.

Please note that certain categories of personal data such as that about race, ethnicity, religion, health or criminal convictions are considered ‘sensitive personal data’ under certain countries’ data protection laws. We try to limit the circumstances where we process sensitive personal data and to ensure we do not collect this information unless it is necessary. There will, however, be circumstances where we may collect and process sensitive personal data as part of the recruitment process. For example, for the purposes of conducting equal opportunities monitoring, to make arrangements for you to attend an interview or assessment, or where this is required for the position you have applied for.

We may send you newsletters and marketing materials about our products, services and partnerships, where you have permitted us to do so, or where otherwise permitted by law. If you no longer want to receive these communications, you can change your preferences at any time by Contact Us or clicking on the ‘unsubscribe’ link in any email. Please note that where you unsubscribe or opt out from a marketing communication, we need to keep a record of your email address to ensure that we do not send you marketing emails in the future.

We may share your personal data with third parties in the following circumstances:

• Gulf is a global group of companies that share various operations and business processes. Accordingly, we may need to share your personal data with other members of our group as part of our business relationship with you, or because it is in our legitimate interests to do so.
• Where we are working with our partners and licensees, it may be necessary to share your personal data to deliver the products or services to you.
• Where we are using a third party service provider to provide services that involve data processing (for example, hosting our website or processing payments).
• Where we work with online advertisers, social media platforms and advertising networks to deliver, tailor and measure advertising to you and others both on our website and elsewhere on the internet.
• If we are required to seek legal advice to defend our rights, property or interests then we may share your personal data with our legal and other external advisers.
• Where we are under a legal or regulatory obligation to disclose your personal data, or to protect the rights, property or safety of our company, or customers or others.
• If our company, or substantially all of our company’s assets, are merged or acquired by a third party, your personal data may form part of the transferred or merged assets.

If we share your personal data, we will do so on strict conditions of confidentiality and with appropriate levels of security to safeguard your data.

Due to Gulf’s global operations, your personal data may be processed in countries outside your jurisdiction. This means that your information may be transferred to countries where you may have fewer legal rights in respect of your personal data than you do under local law. In such cases, we take appropriate steps (as required by applicable law) to ensure that your privacy rights are adequately protected. For example, we may use contracts or the Standard Contractual Clauses approved by the European Commission or the UK Government.

We have put in place reasonable security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

We will keep your personal data for as long as we need it for our legitimate business purposes (as set out above under ‘What do we use your personal data for?’) and so this period will vary depending on your interactions with us. For example, if you make a complaint about a product or service, we may keep a record of our correspondence with you for as long as is necessary to protect us from a legal claim.

We use cookies and similar technologies to provide certain functionality to our website (e.g. to remember your log-in details), to allow you to set preferences (e.g. region or user name), to understand and measure our website’s performance (e.g. to make certain parts of our website easier to use), and to deliver targeted advertising. This means we may obtain information about your general internet usage through the use of cookies or other internet tracking technologies.

For example, you may see adverts for our products and services on third party websites, including on social media. These adverts may be tailored to you using cookies (which track web activity to enable us to serve relevant content to individuals who have visited our website). Where you see an advert on social media, this may be because we have engaged the social network to show adverts to our customers or users who match the demographic profile of our customers. If you no longer want to see tailored adverts you can change the cookie and privacy settings on your browser or the third party website.

Where legally required, we will obtain your consent to use cookies which are not strictly necessary for us to provide our website. Normally, this is done by a notification banner when you first use our website. You can adjust the cookie and privacy settings at any time.

Further details of the cookies we use can be found in our Manage Cookies.

Depending on the country in which you are based, you may have certain rights in respect of your personal data, such as the right to access, correct, and request the erasure of your data. You may also have the right to object to your personal data being used for certain purposes, including to send you marketing (see ‘Marketing’ above for more details of how to opt-out).

We will comply with any requests to exercise your rights in accordance with applicable law. Please be aware that there are a number of limitations to these rights, and there may be circumstances where we are not able to comply with your request. To make any requests regarding your personal data, or if you have any questions or concerns regarding your personal data, you should contact us using the details below. You may also be entitled to contact your local supervisory authority for data protection.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notices of every website you visit.

We may update this Global Privacy Notice periodically to reflect changes in our privacy practices. We recommend that you revisit this page on occasion to see the latest version.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

If you have any queries or concerns on any aspect of this Global Privacy Notice or the handling of your personal data, please contact us using the “Contact Us” section on our website.You also have the right to make a complaint to your local data protection authority directly. If you are in the United Kingdom, you can contact the Information Commissioner’s Office here or by calling 0303 123 1113. However, we would appreciate the chance to deal with your concern promptly and satisfactorily, so please contact us in the first instance.