HORIZONCREDIT ADVISORY
Legal

Privacy Policy

Last updated: [TODO(client): date]

Note: This is draft/template copy and has not yet been reviewed by a qualified solicitor. It must be reviewed, completed (all [TODO(client): ...] items filled in and verified), and approved by a suitably qualified legal adviser before it is published or relied upon.

Horizon Credit Advisory ("we", "us", "our") is an independent counterparty credit risk advisory serving energy and commodity trading firms, with offices in London (UK) and Warsaw (Poland). We work on a business-to-business basis only. This policy explains what personal data we collect through our website, why we collect it, the legal bases we rely on, how long we keep it, and the rights you have over it.

We have deliberately kept our website simple. We do not use advertising cookies, cross-site trackers or social media pixels, and our web fonts are served from our own domain rather than a third-party font service. To understand how the site is used we use Google Analytics, which sets cookies and processes limited usage data — but only if you accept analytics cookies through our banner; it is not loaded if you decline. The main personal data we handle through the site comes from our contact form, together with standard server logs; all of these are described below.

This policy applies to https://horizoncreditadvisory.com and to enquiries you send us through it. It does not cover third-party websites we may link to, which have their own privacy practices.

Who we are and who is responsible for your data

Horizon Credit Advisory is the "controller" of the personal data described in this policy, meaning we decide how and why it is processed.

Depending on which of our offices you engage with, your data may be handled by our UK entity (London) or our Polish entity (Warsaw). Where the UK entity acts as controller, processing is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the Warsaw entity acts as controller, processing is governed by the EU General Data Protection Regulation (EU GDPR).

Our full legal and contact details are:

  • Company name and registered company number: [TODO(client): registered company name(s) and number(s) for the UK and Polish entities]
  • Registered office address(es): [TODO(client): London and Warsaw registered addresses]
  • ICO registration number (UK): [TODO(client): ICO registration number]
  • Contact for data protection queries: [TODO(client): named contact / DPO, if appointed, and dedicated email or postal address for data rights requests]

If you are unsure which entity holds your data, please contact us using the details in "How to exercise your rights" below and we will point you to the right one.

The personal data we collect

We collect only the data we need to respond to enquiries and to run our website securely.

Contact form. When you use the contact form on our website, we collect the information you choose to provide, which is:

  • Your name
  • Your work email address
  • Your firm or organisation
  • The content of your message

Server logs. Like most websites, our web server automatically records standard technical information each time a page is requested. This typically includes your IP address, the date and time of the request, the page or file requested, and basic technical details such as your browser type. These logs are generated for security and reliability purposes and are not used to identify or profile you.

We do not intentionally collect special category data (such as data about health, race, or political opinions). Please do not include such information in your message. Because our services are provided to businesses, we ask that you do not submit personal data about third parties through the form unless you have a proper basis to do so.

How and why we use your data, and our legal bases

We use your personal data for the following purposes, relying on the legal bases set out below.

  • To respond to your enquiry and correspond with you. Legal basis: our legitimate interests (Article 6(1)(f) UK/EU GDPR) in responding to people who contact us and in developing our business. Where your message concerns a possible engagement, we also rely on the need to take steps at your request prior to entering into a contract (Article 6(1)(b)).
  • To operate, secure and maintain our website. Legal basis: our legitimate interests (Article 6(1)(f)) in keeping our site available, protecting it against misuse and abuse, and diagnosing technical problems, using server logs for these purposes.
  • To comply with legal obligations. Where the law requires us to retain or disclose information, our legal basis is compliance with a legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and rights, and we believe our use of your data is proportionate and expected in a business context. You have the right to object to processing based on legitimate interests, as explained under "Your rights" below.

Email delivery and international transfers

Submissions from our contact form are handled by Web3Forms, a third-party form-processing and email-delivery service that acts as our processor and handles your message on our instructions solely to deliver it to us by email.

This means the contents of your enquiry, including the name, work email, firm and message you provide, pass through Web3Forms' systems in the course of delivery.

Web3Forms may process or store data on infrastructure located outside the United Kingdom and the European Economic Area (for example, in the United States). Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards recognised under UK and EU data protection law, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or an applicable adequacy decision. [TODO(client): confirm Web3Forms' provider legal entity, its data-processing terms / DPA, and the exact transfer mechanism relied on.]

You can ask us for more information about these safeguards using the contact details below.

Who we share your data with

We do not sell your personal data, and we do not share it for advertising or marketing by others.

We share personal data only in limited circumstances:

  • With Web3Forms, our form-processing and email-delivery provider, to deliver contact-form submissions to us (see above).
  • With Amazon Web Services (AWS), which hosts our website and serves it through its content delivery network. When the site is requested, standard technical request data (such as your IP address) is processed by AWS on our behalf to serve the site and keep it secure. [TODO(client): confirm the AWS region(s) used and reference AWS's data processing terms.]
  • With Google, which provides Google Analytics, but only if you accept analytics cookies — to help us understand how the site is used. Google may process this data outside the UK and EEA, including in the United States, under appropriate safeguards (the EU-US Data Privacy Framework and/or Standard Contractual Clauses). [TODO(client): confirm the Google Analytics data-processing terms and retention, and whether Google Signals or advertising features are enabled.]
  • With professional advisers, regulators, or law enforcement where we are required to do so by law, or to establish, exercise or defend legal claims.

Any processor we use is bound by a written agreement requiring it to protect your data and to process it only as instructed by us.

How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy.

  • Contact-form enquiries: we retain the emails generated by your enquiry (and any copy held transiently by Web3Forms during delivery) for as long as needed to respond to you and to manage any resulting or prospective engagement, after which they are deleted or archived. [TODO(client): confirm a specific retention period, e.g. delete enquiries that do not lead to an engagement after 12 months.]
  • Server logs: we retain these for a limited period for security and diagnostic purposes and then delete or overwrite them. [TODO(client): confirm the log retention period.]

Where we are under a legal or regulatory obligation to keep certain records for longer, we will retain them for the period required.

Cookies, storage and tracking

By default our website sets no non-essential cookies. If you accept through our cookie banner, we load Google Analytics to understand how the site is used; it then sets analytics cookies and processes limited usage data (such as the pages you view, your approximate location and your device type). We do not use advertising cookies, cross-site trackers or social media pixels. You can decline, or withdraw your consent later, using the cookie settings in the footer.

We use a single item of browser localStorage for one purpose only: to remember your cookie-consent choice so that we do not ask you again on every visit. This is strictly necessary to give effect to your preference and does not track you across sites.

Our web fonts are self-hosted, meaning they are served from our own domain. As a result, viewing our site does not transfer your data to a third-party font service or content delivery network.

We enable Google Analytics only after you have given consent through our cookie banner, and you can withdraw that consent at any time. If we introduce any further non-essential technologies, we will likewise enable them only after you have given consent, and we will update this policy accordingly.

Automated decision-making and profiling

We do not use your personal data to make decisions about you by automated means, and we do not carry out automated profiling that produces legal or similarly significant effects.

How we keep your data secure

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include serving our website over an encrypted (HTTPS) connection, limiting access to enquiry data to the senior team members who need it, and using reputable service providers.

No method of transmission or storage is completely secure, so while we work to protect your data we cannot guarantee absolute security. Please avoid sending sensitive or confidential information through the contact form; we can arrange a more secure channel if needed.

Your rights

Under UK and EU data protection law you have rights over your personal data. Subject to certain conditions and exemptions, these include:

  • The right to be informed about how we use your data (which this policy provides).
  • The right of access to a copy of the personal data we hold about you.
  • The right to rectification of inaccurate or incomplete data.
  • The right to erasure of your data in certain circumstances.
  • The right to restrict our processing of your data in certain circumstances.
  • The right to data portability, allowing you to obtain and reuse certain data.
  • The right to object to processing based on our legitimate interests.
  • Rights relating to automated decision-making (though, as noted above, we do not carry out such decision-making).
  • Where we rely on consent for any processing, the right to withdraw that consent at any time, without affecting processing carried out before withdrawal.

Exercising these rights is free of charge in most cases, and we will respond within the time limits set by law (normally one month).

How to exercise your rights and contact us

For any privacy question, or to exercise any of the rights above, you can contact us at contact@horizoncreditadvisory.com.

For formal data-rights requests (access, rectification, erasure, restriction, portability or objection), please email privacy@horizoncreditadvisory.com. We will respond within one month, as required by the UK GDPR and the EU GDPR.

We may need to verify your identity before acting on a request, to make sure we do not disclose data to the wrong person.

Your right to complain

If you have a concern about how we handle your personal data, we would appreciate the chance to address it first, so please contact us.

You also have the right to lodge a complaint with a data protection supervisory authority:

  • In the United Kingdom, the Information Commissioner's Office (ICO): https://ico.org.uk.
  • In Poland, the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, PUODO): https://uodo.gov.pl.

You may complain to the authority in the country of your habitual residence, place of work, or the place of the alleged infringement.

Governing law

This policy and any dispute arising from it are governed by the laws of England and Wales. Where our Warsaw entity acts as controller, or where an engagement is subject to Polish law, the mandatory data protection provisions of Polish and EU law will also apply.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, take reasonable steps to bring the changes to your attention.

We encourage you to review this policy periodically to stay informed about how we protect your data.