Privacy Policy

PRIVACY NOTICE

OILFAST HOLDINGS LIMITED  |  PUBLIC PRIVACY INFORMATION

Last updated: 28 May 2026

1. Introduction and scope

Oilfast Holdings Limited (Oilfast, we, us, our) respects your privacy. This notice explains how we collect, use, share and protect personal data when you visit our website, request a quote, purchase fuel or related products, apply for an account or credit terms, contact us, or deal with us as a supplier or business representative.

Read this notice alongside any additional notice we give you for a particular service or activity. Separate notices may apply to employees and job applicants.

2. Who controls your information and how to contact us

Data controller: Oilfast Holdings Limited. Company number: SC453328. Registered office: Fuel Depot, Nethan Street, Motherwell, Scotland, ML1 3TF.

For privacy questions or to exercise your rights, write to Data Protection / Privacy Enquiry at the registered office above. Alternatively, use dataprotection@oilfast.co.uk

Please tell us if your contact or account details change so that our records remain accurate.

3. The personal information we collect

Identity and contact data: names, titles, dates of birth where needed for checks, addresses (including delivery and billing addresses), telephone numbers, email addresses and customer identifiers.

Account and profile data: account numbers, authorised contacts, account access permissions, enquiries, quotes, order history, preferences, feedback and correspondence.

Financial and transaction data: billing and payment information, amounts due and paid, failed payments, credit terms, credit-risk information, affordability indicators and related public-record information where applicable.

Business data: job titles, employers, business contact details and information supplied by authorised representatives.

Technical, website and security data: IP addresses, device and browser details, website interactions, cookies where used, access logs, security alerts and audit records.

Compliance data: identity-verification results, fraud-prevention indicators, due-diligence and regulatory records. We do not ordinarily seek sensitive special-category data; if it is necessary, we will identify an appropriate additional legal condition.

4. How we obtain personal information

We receive information directly from you when you enquire, request quotes, place orders, open accounts, pay invoices or contact us; from employers or businesses that nominate you as a contact or authorised user; from payment, delivery and other service providers; from public sources such as Companies House and other public records; and, where relevant, from Creditsafe and its consumer-data partner TransUnion.

When you use our website, technical information may be collected through server logs and, where implemented, cookies or similar technologies. Any non-essential cookies should be explained and controlled through a separate cookie notice or preference mechanism.

5. Purposes and lawful bases for processing

The table summarises our principal purposes and the UK GDPR lawful bases that may apply. The actual basis depends on the circumstances, including whether you act personally or for a business.

Purpose	Typical lawful basis / legitimate interest
Enquiries, quotations, customer accounts, orders and deliveries	Contract or steps before a contract; legitimate interests in serving business customers
Invoicing, payment collection, accounting and tax records	Contract; legal obligation; legitimate interests in recovering debts
Identity, creditworthiness and affordability checks	Legitimate interests in responsible credit decisions and fraud prevention; legal obligation where applicable
Fraud prevention, cyber security and incident investigation	Legitimate interests in protecting customers, systems and TransUnion data; legal obligation where applicable
Customer service, complaints and essential service messages	Contract; legitimate interests in customer administration; legal obligation
Website operation, analytics and service improvement	Legitimate interests where appropriate; consent for non-essential cookies where required
Marketing and customer communications	Consent or legitimate interests where permitted by applicable direct-marketing rules

6. Credit reference and affordability checks

To help us assess applications, prevent fraud and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data. Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 742313). TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 737740).

The information may include identity information, credit commitments, payment history and public records. We use it for creditworthiness assessment, identity verification and fraud prevention in accordance with applicable law. A CRA may retain a record of a search under its own privacy notice.

Further information: Creditsafe Transparency Notice (Customers & Suppliers), available from Creditsafe; TransUnion Bureau Privacy Notice: https://www.transunion.co.uk/legal/privacy-centre/pc-bureau.

7. Marketing and your choices

Where lawful, we may contact you about relevant products and services. You can opt out of direct marketing at any time by following any unsubscribe instructions provided or contacting us at the address above. Opting out of marketing will not prevent necessary order, payment, account or safety communications.

We do not sell personal data to third parties for their own marketing. If we use information to tailor offers, we will comply with applicable profiling, transparency and marketing requirements.

8. Website cookies, analytics and third-party links

Our website may use essential technologies needed for operation and security, and may use optional analytics or marketing cookies where enabled. Details of the cookies actually deployed, their purposes, durations and controls should be set out in a website cookie notice. Non-essential cookies will be subject to consent where required.

Our website may link to independent third-party websites. Their privacy practices are governed by their own notices, which we encourage you to read.

9. Who receives personal data

Where necessary and proportionate, we may disclose information to Oilfast group companies; fuel and delivery partners involved in fulfilling an order; payment and banking providers; IT, hosting, security and support providers; credit reference and identity-verification providers (including Creditsafe and TransUnion); professional advisers and insurers; and regulators, HMRC, law-enforcement bodies or courts where lawful.

Some recipients act as our processors under contract and instructions; others, such as certain payment providers or credit reference agencies, may act as independent controllers and publish their own notices. We require appropriate confidentiality and security measures and restrict access on a need-to-know basis.

If the business is reorganised, sold or merged, personal data may be shared with relevant parties subject to appropriate safeguards and applicable law. Specific suppliers and processing locations should be verified before any public subprocessor list is published.

10. International transfers

Some service providers may access or process personal data outside the UK. Where a restricted transfer occurs, we use a valid UK transfer mechanism, where required, such as UK adequacy regulations, an International Data Transfer Agreement or the UK Addendum to standard contractual clauses, together with any necessary assessment and supplementary safeguards.

We do not claim that all processing is UK-only unless Oilfast has verified every relevant provider, support-access arrangement and backup location.

11. Security and incident handling

We use proportionate technical and organisational security measures, including access controls, confidentiality obligations, system monitoring and procedures for managing suspected personal data breaches. Access is limited to people and providers with a legitimate business need. We will notify affected individuals and regulators where the law requires.

12. Retention and deletion

We keep personal data for no longer than needed for its original purposes, including contractual, tax, accounting, dispute-resolution, fraud-prevention and legal requirements. The period depends on the nature and sensitivity of the data, the risk of harm, applicable limitation periods and whether the purpose can be met with less information.

Consumer credit and affordability information is retained only for the necessary assessment and related lawful record-keeping, then securely deleted or anonymised. We may retain properly anonymised statistics where individuals can no longer be identified. Specific retention schedules can be requested from us.

13. Providing information and consequences

Certain information is required to enter into or fulfil contracts, process orders, arrange deliveries, manage payments, verify identity or comply with law. If you do not supply it, we may be unable to open an account, provide credit terms, complete an order or deliver services. Optional marketing information is not mandatory.

14. Automated tools and decisions

We may use software to generate credit, fraud or identity risk indicators and recommendations. These may affect how an application is reviewed. We do not state that Oilfast makes solely automated decisions producing legal or similarly significant effects unless this has been confirmed.

Where qualifying solely automated decision-making is used, we will provide the specific information and safeguards required by law, including relevant rights to make representations, obtain human involvement and contest decisions where applicable. Oilfast should confirm its actual decision workflow before publication.

15. Your rights

Depending on the circumstances and legal exemptions, you may request access to personal data; correction of inaccurate information; erasure; restriction; portability; or object to processing based on legitimate interests or for direct marketing. Where we rely on consent, you may withdraw it without affecting prior lawful processing.

Contact us at the registered office above to exercise your rights. We may request reasonable information to verify identity and prevent unauthorised disclosure. Requests are generally free, although a reasonable fee may be permitted for manifestly unfounded or excessive requests. We normally respond within one month, subject to lawful extensions for complex requests.

16. Complaints, accessibility and updates

If you are unhappy with how we use your information, please contact us first so we can investigate. You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/.

We aim to explain our practices in clear language. Contact us if you need clarification or an accessible format. We may update this notice to reflect changes in law, our services or processing practices; the date at the beginning shows the latest revision.