Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy applies to personal information, business contact information, corporate inquiry data, website usage information, document submission records, communication records and transaction-related information that ASA Global Solutions Inc. may collect or process through its website, forms, email, phone calls, messaging channels, business communications, compliance review, fraud prevention procedures, buyer or counterparty qualification, document control and commercial relationship management.

This Privacy Policy applies to visitors, prospective buyers, sellers, counterparties, representatives, mandates, brokers, introducers, advisors, logistics contacts, compliance contacts, financial contacts, corporate officers, employees of counterparties, website users and any other person who voluntarily provides information to ASA Global Solutions Inc. or whose information is provided to ASA in connection with a commercial inquiry, compliance review, fraud prevention matter or transaction discussion.

This Privacy Policy does not create a contractual guarantee that every transaction, inquiry, party, document or communication will be accepted, processed, retained or reviewed. ASA may decline, reject, suspend, delete, preserve or escalate information depending on the nature of the information, the applicable law, the purpose of collection, the transaction stage, the risk level, the legitimacy of the source and the business necessity involved.

2. Applicable privacy and data protection framework

ASA Global Solutions Inc. operates in an international commercial environment. Depending on the user, location, transaction, website interaction, communication channel, contracting party, destination country, product, payment route, documentation submitted and applicable governing law, different privacy and data protection frameworks may apply.

Canadian and Quebec frameworks may include, where applicable, the laws of Canada, the laws of Quebec, the Personal Information Protection and Electronic Documents Act, Quebec’s private-sector personal information protection legislation, privacy governance obligations, confidentiality incident rules, individual access and correction rights, consent rules, purpose limitation, collection limitation, safeguard obligations and transparency requirements.

United States frameworks may include, where applicable, federal sectoral privacy rules, state consumer privacy laws, data breach notification laws, financial privacy requirements, anti-fraud record preservation rules, cybersecurity requirements, marketing communication rules and any applicable law connected to the user, transaction, state, platform, payment route or service provider.

European Union and United Kingdom frameworks may include, where applicable, the General Data Protection Regulation, UK GDPR, Data Protection Act 2018, data protection principles, lawful basis requirements, transparency obligations, cross-border transfer rules, data subject rights, security obligations, breach notification rules and restrictions concerning profiling, automated decision-making and direct marketing.

Mexican frameworks may include, where applicable, personal data protection requirements for private parties, privacy notice obligations, consent rules, data owner rights, transfer limitations, security duties, confidentiality obligations and any applicable rule connected to the person, entity, communication, payment route, business inquiry or transaction structure.

Internationally, ASA may also align its privacy handling with recognized principles of accountability, lawful purpose, transparency, proportionality, data minimization, security safeguards, retention limitation, access rights, confidentiality, record integrity and responsible cross-border information management.

3. Categories of information that may be collected

ASA Global Solutions Inc. may collect information that users provide directly, information generated through website use, information received through business communications and information necessary for compliance, fraud prevention, document review or transaction-stage analysis.

Such information may include name, company name, job title, corporate role, email address, telephone number, country, city, corporate website, business address, inquiry details, product interest, requested volume, destination, transaction role, preferred delivery structure, communication content, attached documents, identity or corporate verification materials, KYC/KYB information, beneficial ownership information where applicable, banking context where applicable, logistics references, product requirements and other information voluntarily provided by the user or required for legitimate business review.

ASA may also collect technical and usage information, including IP address, approximate location derived from technical data, browser type, device type, operating system, pages visited, date and time of access, referral source, form submission records, cookie identifiers, analytics events and security logs where such collection is enabled by the website, hosting provider, analytics tools or security systems.

4. Sources of information

ASA may receive information directly from the person concerned, from a corporate representative, from an authorized counterparty, from a submitted website form, from email communications, from phone or messaging communications, from business documents, from transaction files, from compliance materials, from public business records, from sanctions or watchlist screening sources, from corporate websites, from professional directories, from hosting or analytics tools, from CRM systems or from service providers involved in website, communication, security, compliance or operational support.

ASA does not authorize the unlawful collection, scraping, impersonation, unauthorized surveillance, password misuse, unauthorized access or deceptive acquisition of personal information. Information used for business development, fraud prevention, KYC/KYB or transaction review should be obtained through lawful means, legitimate business context and appropriate sources.

5. Purposes of processing

ASA Global Solutions Inc. may process information for the purpose of responding to inquiries, reviewing buyer or counterparty requests, evaluating product requirements, conducting preliminary KYC/KYB review, preventing fraud, verifying communication channels, assessing document consistency, preserving transaction records, managing business relationships, improving website performance, measuring digital activity, protecting ASA’s legal rights, complying with applicable obligations and supporting legitimate commercial decision-making.

Information may also be used to evaluate whether a request is coherent with product, destination, volume, receiving capability, compliance context, documentation route, delivery terms and transaction stage. ASA may decline to proceed when information is incomplete, inconsistent, unsupported, suspicious, excessive, irrelevant, unlawful, misleading or not aligned with ASA’s business protocols.

6. Legal basis, consent and legitimate purposes

Where consent is required, ASA may rely on the user’s voluntary submission of information, written consent, express confirmation, implied consent in a business context or other consent mechanism recognized by applicable law. Users should not submit personal information, corporate documents, identification materials, financial context or third-party data unless they have the authority and lawful basis to do so.

Where permitted by applicable law, ASA may also process information on the basis of legitimate business interests, contractual necessity, pre-contractual review, compliance obligations, fraud prevention, security protection, legal claim preservation, record keeping, document control, transaction verification and protection of ASA, counterparties and the integrity of commercial communications.

A person may withdraw consent where applicable; however, withdrawal may not affect processing already carried out, legal retention obligations, fraud prevention records, security logs, transaction evidence, compliance records, contractual records or other information that ASA is permitted or required to retain under applicable law.

7. KYC/KYB, fraud prevention and compliance review

In hydrocarbon, commodity, logistics and international commercial transactions, ASA may request or review information necessary to understand the identity, authority, role, corporate structure, beneficial ownership, jurisdiction, communication channel, documentation history, transaction purpose, payment context and legitimacy of a party or inquiry.

KYC/KYB and fraud prevention information may include corporate registration documents, authorized representative details, proof of role, transaction documents, communication history, sanctions-related review data, beneficial ownership information, source-of-funds context where applicable, mandate or authority documents, commercial history and supporting records.

ASA may preserve suspicious communications, documents, sender details, IP records, payment instructions and related evidence where necessary to prevent fraud, investigate misuse, protect legal rights, respond to claims, secure communications, notify affected parties or cooperate with authorized service providers, financial institutions, legal advisors, regulators or competent authorities where lawful and appropriate.

8. Cookies, analytics and digital measurement

ASA’s website may use cookies, similar technologies, analytics tools, hosting logs, security tools or digital measurement technologies to operate the website, improve performance, understand visitor activity, protect the site from misuse, support marketing measurement, measure campaign performance or improve user experience.

Cookies may be necessary, functional, analytical, performance-based or marketing-related, depending on the tools enabled on the website. Users may manage cookies through browser settings, device settings or any consent mechanism that may be implemented on the website. Disabling certain cookies may affect website functionality, security, analytics or user experience.

Additional details regarding cookies, tracking technologies and browser controls may be provided in ASA’s Cookie Policy.

9. Communications, forms and messaging channels

When a user contacts ASA through a website form, email, telephone, WhatsApp, messaging channel, social media, business card, meeting, document submission or other communication route, ASA may collect and retain the information necessary to respond, evaluate the inquiry, verify identity, maintain a record, prevent fraud, manage business communications and protect the integrity of the transaction process.

Users should avoid sending unnecessary sensitive personal information through unsecured channels. ASA may request that documents or sensitive information be submitted through specific communication routes when necessary for document control, verification, privacy protection, evidence preservation or compliance review.

10. Disclosure and sharing of information

ASA may disclose information where necessary for legitimate business, operational, legal, compliance, fraud prevention, security or transaction-related purposes. Disclosure may occur to authorized internal personnel, professional advisors, legal counsel, compliance advisors, hosting providers, CRM providers, analytics providers, email providers, security providers, payment-related parties, counterparties, logistics contacts, inspection parties, document reviewers, financial institutions, regulators or authorities where appropriate and lawful.

ASA does not sell personal information as a core business activity. ASA does not authorize unauthorized resale, misuse, disclosure or circulation of personal information submitted for inquiry, compliance, fraud prevention or transaction review purposes.

Where information is shared with service providers, ASA expects such providers to process information only for authorized purposes, subject to appropriate confidentiality, security, contractual or legal obligations where applicable.

11. International transfers and cross-border processing

ASA may process, store, access or transfer information across borders depending on the location of hosting providers, email systems, CRM tools, analytics services, service providers, counterparties, advisors, financial institutions, transaction participants or legal requirements.

Personal information may be subject to the laws of the jurisdiction where it is processed, stored or accessed. Where applicable, ASA may use contractual, organizational, technical or legal safeguards to support appropriate cross-border handling of information.

Users who submit information to ASA acknowledge that cross-border business activity may involve communications and processing outside their country, province, state or region of residence.

12. Retention of information

ASA retains information only as long as reasonably necessary for the purposes for which it was collected, including inquiry response, business relationship management, transaction review, compliance review, fraud prevention, legal claim preservation, accounting, audit, security, record keeping and applicable legal or contractual requirements.

Retention periods may vary depending on the nature of the information, the transaction stage, the risk level, the applicable jurisdiction, the existence of a dispute, fraud risk, legal requirement, contractual obligation, regulatory inquiry or legitimate business need.

ASA may delete, anonymize, archive, restrict or preserve information according to business necessity, legal requirements, security obligations, fraud prevention needs and document control procedures.

13. Security safeguards

ASA takes reasonable administrative, technical and organizational measures intended to protect information against unauthorized access, misuse, disclosure, alteration, loss, destruction, impersonation, document manipulation and unauthorized communication.

Such measures may include access limitation, communication control, document review, secure storage practices, password protection, hosting safeguards, email security measures, evidence preservation, internal authorization controls, role-based access, anti-fraud procedures and reasonable vendor management where applicable.

No website, communication system, email route, hosting environment, database, cloud service or digital platform can be guaranteed to be completely secure. Users should exercise caution when transmitting sensitive information and should verify authorized communication channels before submitting confidential or transaction-sensitive documents.

14. Confidentiality incidents and security events

If ASA becomes aware of a confidentiality incident, data breach, unauthorized access, loss, misuse, suspicious disclosure or security event involving information under its control, ASA may take reasonable steps to assess the incident, reduce risk, preserve evidence, secure systems, notify affected persons, notify service providers, consult advisors or notify competent authorities where required by applicable law.

The determination of whether notification is required may depend on the jurisdiction, the sensitivity of the information, the probability of harm, the nature of the incident, the legal requirements involved and the measures taken to reduce risk.

15. Individual rights

Depending on applicable law and jurisdiction, individuals may have rights to request access to personal information, correction of inaccurate information, withdrawal of consent, deletion, restriction of processing, portability, objection to certain processing, information about disclosures, information about retention, information about automated processing and the right to lodge a complaint with a competent privacy authority.

ASA may require identity verification before responding to a rights request. ASA may refuse, limit or delay a request where permitted by law, including where disclosure would affect another person’s rights, reveal confidential business information, interfere with fraud prevention, affect legal claims, compromise security, conflict with legal obligations or involve information that ASA is required or permitted to retain.

Requests concerning personal information may be submitted through ASA’s official contact channels. Users should clearly identify the nature of the request and provide enough information for ASA to locate the relevant records.

16. Third-party websites, platforms and service providers

ASA’s website may contain links to third-party websites, platforms, forms, tools, social media pages, analytics systems, hosting services, communication services or other third-party technologies. ASA does not control the privacy practices of third parties and is not responsible for their independent privacy policies, security practices or data processing activities.

Users should review the privacy policies and terms of any third-party platform or service before providing information through that platform. Use of third-party services may be governed by the legal terms and privacy practices of those providers.

17. Children and minors

ASA’s website and services are intended for business, corporate, commercial and professional use. ASA does not knowingly solicit personal information from children or minors for consumer services.

If ASA becomes aware that it has collected personal information from a minor without appropriate authority or legitimate purpose, ASA may delete, restrict or otherwise handle the information according to applicable law and the circumstances of the case.

18. Automated processing and profiling

ASA may use digital tools, analytics, CRM systems, security tools or business systems to organize inquiries, measure website activity, support fraud prevention, improve communication or assist business review.

ASA does not intend to make legally binding or similarly significant decisions about individuals solely by automated processing through this website. Any commercial decision, transaction acceptance, counterparty review or compliance action may involve human review, document review and business judgment.

19. Accuracy and responsibility for submitted information

Users are responsible for ensuring that information submitted to ASA is accurate, current, lawful, authorized and not misleading. Users should not submit personal information about another person unless they have the authority, consent or lawful basis to do so.

ASA may request updated information, clarification, correction or supporting documentation where submitted information appears incomplete, inaccurate, inconsistent, suspicious, outdated or unsupported.

20. Changes to this Privacy Policy

This Privacy Policy is effective as of April 4, 2025, and may be updated, revised, expanded or replaced at any time without prior notice. Updates may be made to reflect operational changes, legal developments, regulatory expectations, website changes, technology changes, business processes, service provider changes, fraud prevention practices or transaction procedures.

Continued use of the website, continued communication with ASA or continued submission of information after publication of an updated Privacy Policy constitutes acknowledgment that the updated version applies to subsequent interactions.

21. Contact regarding privacy matters

Questions, concerns or requests regarding this Privacy Policy or the handling of personal information may be submitted through ASA Global Solutions Inc.’s official contact channels. ASA may require identity verification before responding to privacy-related requests.

Users should not submit unnecessary sensitive personal information through unsecured channels. If a request involves sensitive documents, legal claims, transaction evidence or identity verification, ASA may provide instructions regarding the appropriate communication route.