PRIVACY POLICY

Evolve Green Commodities S.R.L.

Last updated: 02.08.2026

This Privacy Policy explains how Evolve Green Commodities S.R.L. ("we", "us", "our") collects, uses, stores and protects personal data in connection with our website and our commercial brokerage activities in biofuels, feedstock and carbon markets. We comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Romanian data protection law.

1. Who We Are (Data Controller)

Company name: Evolve Green Commodities S.R.L.

Registration No.: ________________________________

VAT No.: RO_______________________

Registered address: Strada Plevnei 166, Cluj-Napoca, Cluj, Romania

Email for data protection matters: privacy@[yourdomain].com

We are the data controller for personal data processed in connection with our website and business activities.

2. What Data We Collect and Why

Website contact forms

Data collected: Name, company name, email address, phone number, message content, product/service interest

Purpose: Responding to your enquiry; assessing potential commercial relationship

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

Retention: 3 years from last contact, or until you request deletion

KYC / Due Diligence

Data collected: Company registration documents, VAT number, registered address, UBO (beneficial owner) information, representative's name and ID, bank details, ISCC EU certificate

Purpose: Anti-money laundering (AML) compliance; counterparty verification; regulatory due diligence obligations

Legal basis: Legal obligation (Art. 6(1)(c) GDPR) + Legitimate interest

Retention: 5 years from end of commercial relationship (legal obligation)

Commercial correspondence

Data collected: Email correspondence, contract terms, transaction details, pricing information

Purpose: Executing commercial transactions; record-keeping; dispute resolution

Legal basis: Contract performance (Art. 6(1)(b)) + Legal obligation

Retention: 5 years from transaction date

Website analytics

Data collected: IP address, browser type, pages visited, time on site (via Squarespace analytics)

Purpose: Understanding website usage; improving content

Legal basis: Legitimate interest / Consent (for non-essential cookies)

Retention: 26 months (analytics data)

Cookie data

Data collected: Session cookies, preference cookies, analytics cookies — see Cookie Notice below

Purpose: Website functionality; analytics

Legal basis: Consent (Art. 6(1)(a) GDPR) for non-essential cookies

Retention: Per cookie — see Cookie Notice

3. How We Use Your Data

We use your personal data only for the purposes described above. We do not use your data for automated decision-making or profiling. We do not send marketing emails without your explicit consent. We do not sell your data to third parties.

4. Who We Share Data With

Pipedrive — CRM: storing and managing contact information from website forms; tracking commercial leads and deals. Safeguards: Standard Contractual Clauses (SCCs) where applicable (Pipedrive is headquartered in Estonia, EU — confirm current data-hosting region and transfer mechanism in Pipedrive's own Data Processing Agreement before publishing)

Google Workspace (USA) — Email communication; document storage. Safeguards: EU-US Data Privacy Framework; SCCs

Squarespace Inc. (USA) — Website hosting; form submission processing. Safeguards: EU-US Data Privacy Framework; SCCs

Independent inspection companies (SGS, Bureau Veritas etc.) — Transaction execution: sharing counterparty details as necessary for inspection. Safeguards: Contractual obligation of confidentiality

Legal and financial advisors — Legal advice; accounting; compliance. Safeguards: Professional confidentiality obligations

Competent authorities (ANSPDCP, courts, law enforcement) — Legal obligation: only when required by law

For transfers to countries outside the EU/EEA (USA, Israel), we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission as the legal transfer mechanism.

5. Your Rights Under GDPR

Access — Request a copy of all personal data we hold about you. Email privacy@[yourdomain].com — we respond within 30 days.

Rectification — Request correction of inaccurate or incomplete data. Email as above.

Erasure ('right to be forgotten') — Request deletion of your data, subject to legal retention obligations (we cannot delete KYC data during the mandatory 5-year retention period). Email as above.

Restriction — Request that we limit processing of your data in certain circumstances. Email as above.

Data portability — Receive your data in a structured, machine-readable format. Email as above.

Objection — Object to processing based on legitimate interest. Email as above — we will assess and respond within 30 days.

Withdraw consent — Where processing is based on consent (e.g. cookies), you can withdraw consent at any time without affecting prior lawful processing. Use the cookie banner on our website, or email us.

Lodge a complaint — File a complaint with the Romanian data protection authority (ANSPDCP). ANSPDCP: www.dataprotection.ro | anspdcp@dataprotection.ro

6. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. These measures include: access controls (password protection, 2FA where available), encrypted email and file storage (Google Workspace), cloud services with EU/ISO-certified security (HubSpot, Monday.com), and physical security at our offices.

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify ANSPDCP within 72 hours and, where required, the affected individuals without undue delay.

7. Cookies

Our website uses cookies. Please see our separate Cookie Notice below for full details of the cookies we use, their purpose, and how to manage your preferences.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last updated. We will notify you of significant changes by posting a notice on our website. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

9. Contact

For any questions about this Privacy Policy or how we handle your data, please contact:

Fartan George Sebastian | [Company Name] S.R.L.

Email: privacy@[yourdomain].com

Address: Strada Plevnei 166, , Romania