This policy explains what personal data we process when you visit bepcatalyst.com or write to us, why we do so and what rights you have. It is written to meet our duty to inform you under Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
1. Who we are
The controller of your personal data is Blue Marble Services s.r.o., IČ 25572351, with its registered office at Dostihová 673, 763 15 Slušovice, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, file C 33970 ("we").
For anything concerning your personal data, write to info@bepcatalyst.com or to our registered office. We have not appointed a data protection officer.
2. What data we process, why and on what legal basis
2.1 Enquiries through the contact form or by e-mail
When you send us an enquiry, we process:
- your name and e-mail address;
- your organisation, if you give it;
- the type of interest you select (for example investor, fleet operator or distributor) and, on the Evidence page, the report you ask for;
- the content of your message and of our further correspondence;
- the time of sending and the IP address from which the form was sent.
We use this data to answer your enquiry and, where the enquiry concerns a possible investment, supply, trial or distribution, for communication before a contract is concluded. The legal basis is Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Where an enquiry has no such link (for example a question from a researcher or journalist), the legal basis is Article 6(1)(f) GDPR: our legitimate interest is answering the people who contact us.
We use the IP address and time of sending only to limit the number of messages sent from one address and to block spam and other abuse of the form. The legal basis is Article 6(1)(f) GDPR: our legitimate interest is keeping the form usable and secure.
Giving us your data is voluntary. Name, e-mail address and message are marked as required: without them we cannot reply.
2.2 Operating the website
When you open any page, your browser sends technical data to the server, as with every website: the IP address, the time of the request, the requested address and the browser identification (user agent). Our hosting provider records this data, together with the server's response, in request logs. We use the logs only to run the website, find faults and protect it against attacks. The legal basis is Article 6(1)(f) GDPR: our legitimate interest is a working and secure website.
We do not use analytics, advertising or tracking tools and we do not build visitor profiles. Fonts and all other files are served from our own server; the pages load nothing from third-party servers. Cookies are described in our Cookie Policy.
3. Recipients and processors
Your data is processed by our staff who handle enquiries and by these processors, which act on our instructions under a data processing agreement (Article 28 GDPR):
- Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): a service that delivers the messages from the contact form to our mailbox. Resend keeps sent messages and their delivery logs for up to 30 days.
- Railway (Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA): hosting of the website. The website runs in Railway's Europe West region in Amsterdam, the Netherlands. Railway keeps request logs for at most 30 days.
- the provider of our e-mail mailbox, where your enquiry and our replies are stored.
We do not sell or pass your data to anyone else, unless the law requires us to (for example at the request of a court or public authority).
4. Transfers outside the EU and EEA
Resend processes data mainly in the United States. Resend is certified under the EU-US Data Privacy Framework, so the transfer is covered by the European Commission's adequacy decision (Commission Implementing Decision (EU) 2023/1795, Article 45 GDPR). Resend's data processing agreement also incorporates the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914, Article 46(2)(c) GDPR), which apply if the certification ceases to cover the transfer.
Railway runs our website on servers in the Netherlands. Railway is a US company that operates its services largely from the United States, so its staff may access the logs from there, for example during support or maintenance. These transfers are covered by the standard contractual clauses incorporated in Railway's data processing agreement (Commission Implementing Decision (EU) 2021/914, Article 46(2)(c) GDPR).
You can ask us for a copy of the safeguards at info@bepcatalyst.com.
5. How long we keep data
- Enquiries and correspondence: up to 24 months after our last communication with you. If a contract follows, we keep the data for as long as the contract lasts and then for as long as we need it to establish, exercise or defend legal claims or to meet our legal obligations, such as keeping accounting records.
- IP address and time of sending from the form: only as long as needed to apply the limit on messages, at most 24 hours.
- Request logs at the hosting provider: at most 30 days.
- Copies of messages at Resend: at most 30 days.
6. Your rights
You have the right to:
- access your data and receive a copy of it (Article 15 GDPR);
- have inaccurate data rectified or incomplete data completed (Article 16 GDPR);
- have your data erased, for example when we no longer need it (Article 17 GDPR);
- restrict processing, for example while we check the accuracy of your data (Article 18 GDPR);
- data portability, that is, to receive the data you gave us in a machine-readable format or have it sent to another controller, where we process it on the basis of a contract or pre-contractual steps (Article 20 GDPR);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21 GDPR). We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.
To exercise a right, write to info@bepcatalyst.com. We will respond without undue delay and in any event within one month; for complex or numerous requests, this period may be extended by two further months, and we will tell you so. Exercising your rights is free of charge. If we have reasonable doubts about your identity, we may ask you for additional information.
7. Right to lodge a complaint
If you believe that we process your personal data in breach of the law, you may lodge a complaint with a supervisory authority (Article 77 GDPR). In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz. You may also complain to the authority in the EU country where you live or work.
8. No automated decision-making
We make no decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
9. Changes
We will update this policy when the way we process personal data changes, for example if we add a new service. The current version is always published on this website with its effective date.