Privacy Policy

1.Who is responsible

Gray Coast Energies AG, Musterstrasse 1, 8001 Zurich, Switzerland, is the controller of the personal data described in this policy. Our offices in Dubai and Germany act on its behalf.

For any question about your data, or to use the rights described below, write to [email protected] or to the postal address above, marked for the attention of the Data Protection Officer.

Our representative in the European Union is our German office: Gray Coast Energies GmbH, Musterstraße 1, 20457 Hamburg, Germany.

2.When this policy applies

This policy covers the website graycoastenergies.com and the forms on it. It does not cover data we handle while delivering services to clients, which is governed by the contract for that work, or data about our own employees, which is covered by our internal policies.

3.What we collect

We only collect personal data that you give us through a form or by email, plus a small amount of technical data needed to run the site.

• Proposal requests. Your name, company, job title, work email, phone number, country, the service you are interested in and the project details you write.
• Supplier registrations. The company name, country, registration number and website, the contact person’s name, email and phone number, certifications held, a description of what the company offers, and the company profile if you upload one.
• Family visit requests. Your name, relationship to the employee, email, phone number and country of residence, the employee’s name and employee number, where they work, your travel dates, the number of visitors, and the names and ages of the other visitors.
• Job applications. The CV and any other details you send us by email.
• Technical data. Our hosting provider records the IP address, browser type, pages requested and time of each visit in short-lived server logs, to deliver the site and protect it from abuse.

We do not ask for sensitive categories of data such as health, religion or political views. Please do not include them in free-text fields unless they are needed, for example an access requirement for a visit.

4.Why we use it and on what legal basis

• To answer enquiries and prepare proposals. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
• To assess and contact suppliers. Legal basis: your consent and our legitimate interest in selecting qualified suppliers.
• To assess and arrange family visits. Legal basis: your consent, and our legitimate interest in controlling access to our offices and sites safely.
• To consider job applications. Legal basis: steps taken at your request before entering into an employment contract.
• To keep the website secure and working. Legal basis: our legitimate interest in running a secure and reliable website.
• To meet legal obligations. Where a law requires us to keep or disclose information.

We do not use your data for advertising, we do not sell it, and we do not use it to make automated decisions about you.

5.Data about other people and children

A family visit request includes information about the employee you want to visit and about the people travelling with you, who may be children. Only include other adults with their knowledge. Details of anyone under 18 must be provided by their parent or legal guardian. We use this information only to assess and arrange the visit.

6.Who we share it with

Inside the company, your data is seen only by the people who need it to handle your request. We also use the following service providers, who process data on our instructions:

• Cloudflare for website hosting, security, spam protection and cookie-free visit statistics, and for storing form submissions in data centres in the European Union.
• Mailgun for sending a short notification email to our team when a form is submitted, through its European service. The email contains only key details, plus the company profile if a supplier attaches one; the full submission stays in our database.

We may also disclose data to professional advisers, or to authorities and courts where the law requires it. For a family visit, we share the request with the employee concerned and with the office or site that would host the visit.

7.Transfers to other countries

Our offices are in Switzerland, the United Arab Emirates and Germany, and some of our service providers operate from the United States. Where data is transferred to a country that does not offer the same level of protection as Switzerland or the European Union, we rely on recognised safeguards such as the European Commission’s standard contractual clauses, adapted for Swiss law where needed.

8.How long we keep it

We keep personal data only for as long as we need it for the purpose it was collected for, then delete or anonymise it.

• Proposal requests and general enquiries: 24 months after our last contact.
• Supplier registrations: 36 months after submission, or until you ask us to remove them.
• Family visit requests: 12 months after the visit date or the decision.
• Unsuccessful job applications: 6 months after the decision, unless you agree to a longer period.
• Server logs: 30 days.

We keep data longer where the law requires it, for example for accounting records, or where it is needed for a legal claim.

9.How we protect it

The website is served only over an encrypted connection. Form submissions go straight to our own server-side functions and are stored in a database that cannot be read from a browser. A company profile attached to a supplier registration is sent to our team by email and is not stored on the website. Access is limited to authorised staff. No system is perfectly secure, so if you believe your data has been misused, tell us straight away.

10.Your rights

Depending on where you live, you have some or all of the following rights:

• to ask what data we hold about you and receive a copy
• to have inaccurate data corrected
• to have your data deleted
• to restrict or object to how we use it
• to receive the data you gave us in a commonly used format
• to withdraw consent at any time, without affecting what we did before you withdrew it

To use any of these rights, email [email protected]. We may ask you to confirm your identity. We reply within 30 days and do not charge a fee unless a request is clearly excessive.

11.How to complain

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to a supervisory authority: the Federal Data Protection and Information Commissioner in Switzerland, the data protection authority in your own EU or EEA country, or the UAE Data Office.

12.Cookies

This website does not use advertising or tracking cookies. See our Cookie Policy for details.

13.Changes to this policy

We update this policy when the website or the law changes. The date at the top of the page shows when it was last revised. If a change significantly affects how we use data you have already given us, we will tell you directly where we can.

14.Applicable law

This policy is written to meet the Swiss Federal Act on Data Protection, the EU General Data Protection Regulation and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, each as far as it applies to us.