01. Data Controller
The three entities comprising Huron Smith Oil act as joint controllers of your personal data. For any privacy-related questions, you may contact us at the email address legal@huronsmithoil.com.
02. Personal Data We Collect
We may collect the following categories of personal data, depending on your interaction with us:
- Identification and contact data: first and last name, email address, phone number, postal address, job title, and industry sector.
- Account and registration data: username, encrypted password, communication preferences, and profile settings.
- Billing and payment data: information necessary to process payments (credit/debit card details, billing address). We do not store full payment card data on our servers; this is managed securely and exclusively by PCI-DSS Level 1 certified payment gateways.
- Usage and browsing data: IP address, device type, operating system, browser, pages visited, interactions on the Site, access logs, and API usage logs.
- Communication data: content of inquiries, support tickets, emails, and any other communications you send us.
03. Purposes of Processing and Legal Bases
We process your personal data for the following purposes, based on the indicated legal bases:
- Performance of a contract or pre-contractual measures: managing your registration, providing the purchased products and services, processing payments, making shipments, and providing technical support and customer service.
- Compliance with legal obligations: retaining accounting and tax records, responding to requests from judicial or administrative authorities, complying with AML/CFT regulations and security breach notification obligations.
- Legitimate interests of HSO: improving our products and services through aggregated usage analysis, protecting the security and integrity of our systems, preventing fraud and abuse, and sending you commercial communications about products or services similar to those you have already contracted (always with a clear and simple option to unsubscribe).
- Explicit consent: when required by law, we will request your prior, informed, and explicit consent for purposes such as sending newsletters, installing non-essential cookies, or participating in promotional activities. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out previously.
04. How We Share Your Information
We do not sell, rent, or transfer your personal data to third parties for commercial purposes. We may share your information exclusively with:
- Essential service providers: companies that assist us in operating the business (web hosting, payment gateways, analytics tools, email delivery services), always under strict contractual agreements that oblige them to process the data only according to our instructions and to implement equivalent security measures.
- Authorities and regulatory bodies: when necessary to comply with the law, respond to legal processes, protect our rights, or cooperate in official investigations.
- Business transfer: in the event of a merger, acquisition, restructuring, or sale of all or part of our assets, personal data may be transferred to the acquiring entity, respecting in all cases the applicable legal guarantees.
05. International Data Transfers
Your personal data may be stored and processed on servers located in the United States and, in certain cases, in other countries where our service providers have facilities. In such circumstances, we ensure that such transfers are made with adequate safeguards, including the execution of Standard Contractual Clauses (SCCs) approved by the competent authorities and the verification that providers maintain security and confidentiality measures equivalent to those required by U.S. legislation.
06. Data subject rights (Florida, Mississippi, and California)
If you are a resident of Florida, Mississippi, or California, and to the extent granted by applicable law, you may exercise the following rights:
- Right of access and portability: request confirmation as to whether we are processing your personal data and obtain a copy thereof in a structured, commonly used, and machine-readable format.
- Right of rectification: request the correction of any inaccurate or incomplete personal data.
- Right of erasure (“right to be forgotten”): request the deletion of your personal data, unless there is a legal obligation requiring us to retain it.
- Right to restriction of processing: obtain the restriction of the processing of your data in certain circumstances, including the limitation of the processing of sensitive data as provided in the Florida Digital Bill of Rights (SB 262).
- Right to non-discrimination: you will not be subject to retaliation or discrimination for exercising any of your privacy rights.
To exercise your rights, please send a request by email to legal@huronsmithoil.com with the subject line “Privacy Rights Request”. To protect your information, we may ask you to verify your identity before processing the request. We will respond to your request within the deadlines established by applicable law (generally 45 calendar days, extendable by an additional 45 days in cases of special complexity).
07. Security Breach Notification
In the event of a security breach that compromises unencrypted personal data of Florida or Mississippi residents, we will notify the affected individuals without undue delay and, where legally required, inform the relevant state authority (the Florida Department of Legal Affairs in the case of Florida), in accordance with FIPA (Fla. Stat. § 501.171) and the Mississippi Security Breach Notification Law (Miss. Code Ann. § 75-24-29).
08. Data Retention
We will retain your personal data only for as long as necessary to fulfill the purposes for which they were collected, including the retention periods required by tax, commercial, and anti-money laundering laws. As a general rule, data related to financial transactions and contractual relationships will be retained for a period of five (5) to seven (7) years from the end of the relationship. After these periods, the data will be securely deleted or anonymized.
09. Data Security
We implement and maintain appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
- Network segmentation and access controls based on roles and least privilege.
- Security audits and penetration tests conducted periodically by independent external entities.
- Internal security policies and mandatory training for all personnel.
10. Cookie Policy
For detailed information about the cookies and similar technologies we use, as well as to manage your preferences and grant or withdraw your consent, please refer to our Cookie Policy.
11. Modifications to the Privacy Policy
We may update this Privacy Policy occasionally to reflect changes in our data processing practices or in applicable legislation. The updated version will be posted on the Site with a new “last updated” date. If the changes are material, we will notify you through the contact means you have provided (email) or through a prominent notice on the Site.
12. Privacy Contact
For any questions, comments, or requests regarding this Privacy Policy or the processing of your personal data, please do not hesitate to contact our Privacy Officer:
- Email: legal@huronsmithoil.com
- Phone: +1 (866) 954-5938
- Postal address: 204 Hays St, Batesville, Mississippi, 38606, USA