Privacy Policy

This Privacy Policy (“Policy”) explains how Svetlo Carbon Pte. Ltd. (UEN 202523448H), a private company limited by shares incorporated in Singapore (“Svetlo Carbon”, “we”, “us”, or “our”), collects, uses, discloses, retains, and protects personal data. It applies to individuals who:

• visit or interact with our website at www.svetlocarbon.com;
• subscribe to our paid business-to-business (B2B) research newsletter under the Svetlo Carbon Subscription Agreement;
• are nominated as Authorised Users of a subscribing entity and access the EUA Analytics portal; and
• contact us by email, webform, or other means of correspondence.

The EUA Analytics portal (the “Portal”) provides market data visualisation, options gamma exposure analysis, Commitment of Traders (COT) reports, trading position tracking, market indicators, and daily email market summaries. Use of the Portal is governed by our Terms of Service and, for subscribing entities, the Svetlo Carbon Subscription Agreement.

This Policy is written to meet the requirements of the EU General Data Protection Regulation 2016/679 (“GDPR”), the United Kingdom General Data Protection Regulation as retained and amended under the Data Protection Act 2018 (“UK GDPR”), and the Singapore Personal Data Protection Act 2012 (“PDPA”). Where these laws grant different rights or impose different obligations, the provisions applicable to your jurisdiction apply.

Please read this Policy carefully. If you do not agree with it, please do not use our website or services.

Svetlo Carbon Pte. Ltd. is the controller of personal data processed in connection with our services (for PDPA purposes, we are the organisation collecting and using the personal data).

We collect personal data directly from you, automatically from your use of our services, and from the entity that nominates you as an Authorised User (if applicable). The categories below describe the data we collect and why. If we start collecting additional categories, we will update this section and, where required, obtain your consent.

Under Article 6 of the GDPR and UK GDPR, every processing activity must have a lawful basis. We rely on the following bases for the processing described in this Policy:

• Contract (Art. 6(1)(b)) — delivering the newsletter, authenticating portal access, processing subscription payments, and providing support. This basis covers the steps necessary to enter into the Subscription Agreement at your request and to perform it.
• Legitimate interests (Art. 6(1)(f)) — system security, fraud prevention, sanctions and AML screening of counterparties, business records, and service-related communications to existing customers. We have assessed that these interests are not overridden by your rights and freedoms; a Legitimate Interests Assessment (LIA) is available on request from the DPO.
• Legal obligation (Art. 6(1)(c)) — tax and accounting record-keeping, sanctions compliance, and responding to lawful regulator or court requests.
• Consent (Art. 6(1)(a)) — optional analytics and marketing cookies (once introduced), and direct marketing emails sent to individuals where consent is the required basis.

The table below maps specific purposes to the lawful basis (or bases) on which we rely:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you have the right to object — see section 9.

Svetlo Carbon is incorporated in Singapore and is therefore subject to the Personal Data Protection Act 2012 (“PDPA”). We collect, use, and disclose personal data in accordance with the PDPA, including the following key obligations:

• Consent and notification (ss.13–14, 20) — we collect personal data only with your consent (or where an exception applies), and only for purposes that a reasonable person would consider appropriate in the circumstances. We notify you of those purposes at or before collection through this Policy and through just-in-time notices at collection points.
• Deemed consent and legitimate interests (ss.15 and 18) — where you voluntarily provide personal data (for example by signing up for an account or corresponding with us), you may be deemed to have consented to its use for the purposes reasonably necessary to provide the requested service. We also rely on the legitimate-interests exception where appropriate, subject to an assessment that the benefit to the public or our business is not outweighed by any adverse effect on you.
• Access and correction (ss.21 and 22) — you may request access to personal data about you that we hold or have used in the preceding year, and you may request correction of errors or omissions. We will respond within 30 days or let you know when we can.
• Withdrawal of consent (s.16) — you may withdraw any consent given for the collection, use, or disclosure of personal data at any time by contacting the DPO. Withdrawal may affect our ability to provide the service.
• Protection and retention (ss.24 and 25) — we protect personal data with reasonable security arrangements and cease to retain personal data (or anonymise it) as soon as the retention is no longer necessary for the purpose for which it was collected or for a legal or business purpose.
• Transfer limitation (s.26) — we transfer personal data out of Singapore only where the recipient is bound by legally enforceable obligations providing a comparable standard of protection. See section 7.
• Data breach notification (ss.26A–26D) — we will notify the Personal Data Protection Commission and (where required) affected individuals of a notifiable data breach. See section 12.
• Do Not Call (s.37 and following) — if we send marketing calls, SMS, or faxes to Singapore telephone numbers, we will first check the relevant Do Not Call registers and obtain the required consent. We do not currently conduct such campaigns.
• Data Protection Officer (s.11(3)) — our designated DPO is contactable at jamie@svetlocarbon.com.

We do not sell personal data. We share personal data only with carefully selected service providers, professional advisers, group companies (if any), and third parties where required by law. Every processor acts under a written contract meeting the requirements of Article 28 of the GDPR / UK GDPR and the equivalent PDPA transfer safeguards.

Because Svetlo Carbon is established in Singapore and engages service providers outside the EEA and the United Kingdom, your personal data will typically be transferred across borders. We apply the following safeguards:

Where we transfer personal data of EU/EEA or UK subjects to Singapore or to processors outside the UK/EEA, we rely on: (a) the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and (b) for UK data subjects, the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs. We conduct transfer risk assessments and apply supplementary measures (encryption in transit and at rest, access controls, contractual audit rights) per Schrems II. For transfers out of Singapore, we comply with PDPA section 26 by ensuring recipients are bound by legally enforceable obligations providing a comparable standard of protection. Copies of transfer mechanisms are available from our DPO.

In narrowly defined circumstances and where no other safeguard applies, we may rely on the derogations in Article 49 of the GDPR / UK GDPR (for example, explicit consent, necessity for the performance of a contract with you, or the establishment, exercise, or defence of legal claims). We do not rely on Article 49 for routine processing.

As at the date of this Policy, the European Commission has not adopted an adequacy decision for Singapore; we will update this section if that status changes.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, regulatory, or reporting requirements, to resolve disputes, or to enforce our agreements. The table below summarises the retention periods we currently apply. Where a retention period is driven by a limitation statute, we apply the longer of the statutory period and any internal business need.

At the end of the retention period we securely delete, anonymise, or (for backup media) retire the data in line with our data-disposal procedures. Aggregated or anonymised information that can no longer be attributed to you may be retained indefinitely.

If you are in the EEA or the United Kingdom, you have the following rights in relation to your personal data:

• Right of access — to be told whether we process personal data about you and, if so, to receive a copy and the information required by Art. 15 GDPR.
• Right to rectification — to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (“right to be forgotten”) — to have personal data deleted where the conditions in Art. 17 are met (for example, the data is no longer necessary for the purpose, or you have withdrawn consent).
• Right to restriction of processing — to have processing restricted in the circumstances set out in Art. 18.
• Right to data portability — to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object — to object to processing based on legitimate interests, including any profiling; and to object at any time to direct marketing.
• Rights relating to automated decision-making — not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently carry out such decision-making.
• Right to withdraw consent — where we rely on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the DPO at jamie@svetlocarbon.com. We will respond within one month of receipt (extendable by two further months for complex or numerous requests, with notice to you). We do not charge a fee for routine requests, but we may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority. If you are in the United Kingdom, the lead authority is the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you may complain to the supervisory authority in your member state of residence, place of work, or place of the alleged infringement. We would, however, appreciate the opportunity to address your concerns first — please contact our DPO.

If you are in Singapore (or your personal data is processed under the PDPA), you have the following rights:

• Right of access (s.21) — to request access to personal data about you that we hold or have used within the past year, and to be informed of the ways in which it has been used or disclosed.
• Right of correction (s.22) — to request correction of an error or omission in your personal data.
• Right to withdraw consent (s.16) — to withdraw any consent given for the collection, use, or disclosure of personal data, on reasonable notice.
• Right to data portability — when the data-portability provisions of the PDPA come into force, to request that certain personal data be transmitted to another prescribed organisation.
• Right to lodge a complaint — to complain to the Personal Data Protection Commission (pdpc.gov.sg) if you believe we have breached the PDPA.

We aim to respond to access and correction requests within 30 days. If we cannot respond within 30 days, we will inform you of the likely timeframe. We may charge a reasonable fee for an access request in accordance with the PDPA and publicise any such fee on request.

A cookie is a small text file stored on your device when you visit a website. We use cookies only for strictly necessary purposes described below. We do not currently set any analytics, advertising, or marketing cookies; if we do so in the future, we will update this Policy and, where required, obtain your consent first.

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures include:

• Encryption of personal data in transit using TLS 1.2 or later, and encryption of sensitive data at rest;
• Salted, one-way hashing of passwords; no storage of plaintext passwords;
• Role-based access control, least-privilege principles, and multi-factor authentication for administrative access;
• Network segmentation, logging, and monitoring of access to production systems;
• Regular review of third-party subprocessors, including contractual security and audit rights;
• Employee training, confidentiality obligations, and need-to-know restrictions.

Despite these measures, no method of transmission over the Internet or electronic storage is completely secure; we cannot guarantee absolute security.

Our services are intended only for business-to-business use by professional users aged 18 or over. We do not knowingly market to, or collect personal data from, children. If you believe a child has provided personal data to us, please contact the DPO and we will take prompt steps to delete the relevant records.

We may update this Policy from time to time to reflect changes to our services, applicable law, or our internal practices. When we make material changes we will update the “Last updated” date at the top of the Policy and, where appropriate, give you additional notice (for example, by email to registered subscribers or an in-site banner). If a change requires a fresh consent under applicable law, we will seek it before applying the change. We encourage you to review this Policy periodically.

If you have questions about this Policy, want to exercise a data-protection right, or want to complain about our handling of your personal data, please contact our Data Protection Officer:

Data Protection Officer
Svetlo Carbon Pte. Ltd.
100c Pasir Panjang, #04-03 See Hoy Chan Building
Singapore 118519

Email: jamie@svetlocarbon.com

We will acknowledge your enquiry promptly and aim to provide a substantive response within the timeframes required by applicable law (one month under the GDPR / UK GDPR; 30 days under the PDPA).