Contents
1. About cookies
A cookie is a small text file placed on your device by a website or application. Cookies are widely used to make websites function, to remember preferences, and to provide information to website operators. Local storage, session storage, IndexedDB, and similar mechanisms behave for privacy purposes in much the same way as cookies, and we treat them under this Notice on equivalent terms. References in this Notice to "cookies" include those technologies.
Two regulatory regimes apply. PECR Regulation 6 requires us to obtain your consent before storing or accessing information on your device, except where the storage or access is strictly necessary to provide a service you have explicitly requested. The UK GDPR applies to any personal data we then process as a result of using cookies.
2. Categories we use
We classify the cookies we use into three categories:
- Strictly necessary — required for the Trade Portal to function and to keep your sign-in secure. Examples: session identifier, CSRF token, MFA-step indicator, load-balancer affinity. PECR consent is not required for these because you have explicitly requested the service that depends on them. They cannot be turned off.
- Functional preferences — remember your choices to improve the experience. Examples: UI theme, language, last-applied filter on the Approved Crude List. Set only with your consent.
- Aggregate analytics — first-party only, used to understand which portal pages are used and how performance can be improved. Set only with your consent. We do not use third-party advertising or tracking cookies.
3. Inventory of cookies
The following cookies and equivalent local-storage entries may be set on your device.
Strictly necessary
| Name | Purpose | Domain | Type | Lifetime |
|---|---|---|---|---|
__Host-EBF_SID |
Sign-in session identifier. Encodes only an opaque server-side reference. Secure, HttpOnly, SameSite=Strict, host-only. | portal.eurabeltfuels.com | HTTP cookie | Session, capped at 8 hours |
EBF_CSRF |
Cross-site request-forgery protection token, paired with the form submission. | portal.eurabeltfuels.com | HTTP cookie | Session |
EBF_MFA_STEP |
Indicates that password verification has completed and the multi-factor challenge is pending. Holds no personal data. | portal.eurabeltfuels.com | HTTP cookie | 15 minutes |
EBF_LB |
Load-balancer affinity, ensuring requests in the same session reach the same application server. Optional and only set on multi-server deployments. | portal.eurabeltfuels.com | HTTP cookie | Session |
ebf_cookie_consent_v1 |
Records your choices on this Cookie Notice so we do not repeatedly prompt you. Holds the categories you have accepted, the version of the notice, and a timestamp. | your browser | localStorage | 12 months |
Functional preferences (only if you consent)
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
ebf_theme |
Stores your interface theme preference (system, light, dark). | localStorage | 12 months |
ebf_locale |
Stores your interface language preference. | localStorage | 12 months |
ebf_crudes_filter |
Remembers the last filter you applied on the Approved Crude List page. | localStorage | 3 months |
Aggregate analytics (only if you consent)
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
ebf_visit |
First-party visit identifier, rotated daily, used to compute the count of distinct daily users without identifying you across sessions. Truncated IP and salted hash only. | HTTP cookie | 24 hours |
ebf_pages_viewed |
Counter of pages viewed in the current session, for understanding portal navigation patterns. No content of pages is recorded. | sessionStorage | Session |
Analytics are processed first-party on infrastructure controlled by Eurabelt Fuels. We do not transmit analytics data to Google Analytics, Meta Pixel, or any other third-party advertising or tracking platform.
4. Similar technologies
In addition to cookies, we use localStorage and sessionStorage as listed in section 3. We do not use fingerprinting techniques to identify you across sessions, browsers, or devices, and we do not use browser-cache abuse (Etag tracking, HSTS pinning) for tracking purposes. We do not embed third-party pixel trackers.
5. Lawful basis and consent
Strictly necessary cookies are set under PECR Regulation 6(4) (the strictly-necessary exception) and, where they involve personal data, under UK GDPR Article 6(1)(b) (performance of a contract with you for the use of the Trade Portal) or Article 6(1)(f) (legitimate interests in the security of the Sites).
Functional and analytics cookies are set only after we have obtained your prior, freely-given, specific, informed, and unambiguous consent through the cookie banner displayed at the bottom of the page on first visit and every time the Notice changes materially. The "Reject non-essential" button is given equal prominence to the "Accept all" button. You may withdraw consent at any time using the "Cookie preferences" control in the footer of every page.
6. Your choices
When you first visit the Sites you are presented with a cookie banner offering
three options: Accept all, Reject non-essential, and
Customise. The Customise control lets you accept or reject
Functional and Analytics cookies independently. Your choices are recorded in
the ebf_cookie_consent_v1 entry described in section 3 and apply
for 12 months, after which we ask again.
You may change your choices at any time using the "Cookie preferences" control in the footer of every page.
7. Browser controls
Most browsers allow you to control cookies through their settings. You can block all cookies, block third-party cookies, delete existing cookies, or set a notification each time a cookie is set. If you block strictly necessary cookies, the Trade Portal will not function — you will not be able to sign in or use any feature that requires authentication.
Helpful guidance is published by the major browser vendors:
- Microsoft Edge: Settings → Cookies and site permissions
- Apple Safari: Preferences → Privacy
- Mozilla Firefox: Settings → Privacy & Security
- Google Chrome: Settings → Privacy and security → Cookies and other site data
8. Do Not Track & Global Privacy Control
We honour the Global Privacy Control (Sec-GPC) signal: if your browser sends Sec-GPC: 1, we treat it as a withdrawal of consent for Functional and Analytics cookies on that visit. The legacy Do Not Track (DNT) header is no longer maintained by the major browser vendors; we do not rely on it. Strictly necessary cookies remain set in either case because they are required for the service you have requested.
9. Third parties
No third-party advertising, tracking, or social-media cookies are set by the Sites. The Sites do not embed third-party trackers, web fonts loaded from third-party CDNs, or social-media share widgets that set cookies on the visitor's device.
The Sites are operated on cloud infrastructure provided by our hosting partner. The hosting partner does not set cookies on the visitor's device on its own behalf; it acts as our processor in respect of any technical request logs.
10. International transfers
Where information generated by cookies is transferred outside the United Kingdom, the safeguards described in section 7 of our Privacy Notice apply.
11. Children
The Sites are not directed to and may not be used by anyone under 18 years of age. We do not seek consent from, or set non-essential cookies on the device of, a person we know to be under 18.
12. Changes
We may update this Cookie Notice from time to time. Material changes trigger a fresh consent prompt on your next visit. The current version is always shown on this page with its "Effective" date and version number.
13. Contact
Cookie-related enquiries should be addressed to the Data Protection Lead, [DPO_NAME], at [DPO_EMAIL]. You may also lodge a complaint with the Information Commissioner's Office at ico.org.uk.
This Cookie Notice is a working draft prepared for the establishment of the Eurabelt Fuels Trade Portal. The cookie inventory in section 3 reflects the technical implementation contemplated for the portal at this stage of design. The inventory must be re-verified by your engineering team before go-live and the Notice reviewed by qualified data-protection counsel.