European Economic Area (EEA) & EU

EU/EEA Addendum — GDPR (Regulation 2016/679). Our EU Representative under Art. 27 GDPR:

United Kingdom (UK)

UK Addendum — UK GDPR & Data Protection Act 2018.

United States of America

US Addendum — CCPA/CPRA (California) and applicable state laws. See also 'Do Not Sell or Share' notice in website footer.

Kingdom of Saudi Arabia

KSA Addendum — Personal Data Protection Law (PDPL) enforced by SDAIA. Cross-border transfers require SDAIA-compliant safeguards.

United Arab Emirates

UAE Addendum — Federal PDPL (Decree-Law No. 45/2021). Processing of UAE residents' data is subject to this law regardless of our location.

Other Jurisdictions

This global Policy applies. We strive to apply the highest applicable standard across all regions.

Account Registration

Name, email address, password, country/region, company name, job title, phone number (optional). Collected when you create a user account.

Lead Generation / Contact Forms

Name, work email, phone, country, city, company, inquiry type, description of requirements, products of interest, purchase timeline (optional), budget (optional), energy type requirement, how you heard about CSG. Collected via forms on the Website.

Marketing Subscription

Name, email, country, city (optional), postal code (optional), company (optional), topics of interest. Collected when you subscribe to marketing communications.

Event / Webinar Registration

Name, email, company, country, product/service of interest, date of attendance. Collected when you register for CSG events.

Event Surveys / Questionnaires

Email, survey responses (open-ended and closed questions). Collected when you complete event feedback forms.

Customer Service – Email

Email content including sender, recipient, timestamp, and the substance of your inquiry. Collected when you contact us by email.

Customer Service – Phone

Call recording (only with your explicit prior consent), call metadata (number, time, duration). Collected when you contact our customer service line.

Log Data

IP address, browser type and version, operating system, referring URL, pages viewed, time zone, session duration, source channel tag, website interaction score.

Cookie & Tracker Data

Cookie identifiers, advertising IDs, pixel data from social and analytics platforms. See Section 4 for full details.

Device & Connection Data

Device type, screen resolution, network routing information, language preference.

Purpose

To create and maintain your user account; to provide account-linked services on the Website.

Legal Basis

Contractual Necessity (Art. 6(1)(b) GDPR): processing is necessary to perform the user account contract. Without this data, we cannot create your account.

Personal Data

Name, email, password (hashed), country/region, company, phone (if provided), auto-generated user ID, creation/modification/login timestamps, activation status.

Recipients

Hosting and IT infrastructure service providers (under Data Processing Agreements).

Retention

For the duration of the account. Upon account deletion, data is anonymised within 30 days (see Section 9).

Purpose

To respond to your product/service enquiry; to manage and develop our commercial relationship; to improve our products and services.

Legal Basis

Legitimate Interests (Art. 6(1)(f) GDPR): responding to enquiries and maintaining commercial relationships. For residents of jurisdictions where Legitimate Interests is not recognised as a standalone basis (e.g. certain GCC countries), we rely on your consent provided at the time of form submission. You have the right to object to processing under Legitimate Interests at any time (see Section 10.6).

Personal Data

Name, email, phone, country, city, company, inquiry type, description of requirements, products of interest, purchase timeline (optional), budget (optional), energy type requirement, acquisition channel.

Recipients

CRM and customer service third-party providers (under Data Processing Agreements).

Retention

Active leads: reviewed every 18 months from last engagement. If no commercial relationship develops and no engagement for 18 months: securely deleted or anonymised. If a commercial relationship results: retained for the duration of the relationship plus 10 years for legal/tax/warranty obligations.

Purpose

To send you product updates, event invitations, industry insights, and promotional communications aligned with your stated interests, where you have opted in to receive such communications.

Legal Basis

Consent (Art. 6(1)(a) GDPR and equivalent under Saudi Arabia PDPL, UAE PDPL): explicit opt-in at the time of subscription. For jurisdictions where Legitimate Interests is recognised as sufficient for B2B marketing communications (e.g. certain EU member states under ePrivacy rules), we may rely on that basis where you have a prior commercial relationship with CSG and the communication is relevant to your business activities, subject to your right to object at any time. You may withdraw your consent or object to processing at any time without affecting the lawfulness of prior processing (see Section 10.7).

Personal Data

Name, work email address, country, company (optional), topics of interest, consent timestamp, consent source (e.g. form URL), and IP address at time of subscription.

Recipients

Email marketing service providers (under Data Processing Agreements).

Retention

Until you withdraw consent or unsubscribe. Unsubscribe requests are processed within 10 business days. Consent records (including withdrawal records) are retained for 5 years for compliance purposes.

Purpose

To send product information, company updates, and promotional materials by email to prospective business customers who have not previously subscribed, where we have a legitimate basis to do so.

Legal Basis

Legitimate Interests (Art. 6(1)(f) GDPR) for EU/UK B2B contacts where the communication is relevant to the recipient's role or business activities, and where our interest in promoting our services does not override the recipient's rights. Explicit Consent for contacts in Saudi Arabia (PDPL), UAE (PDPL), and other jurisdictions requiring prior consent for commercial communications. We will not send proactive marketing emails to recipients in jurisdictions requiring prior consent unless that consent has been obtained and documented.

Personal Data

Name, business email address, company name, job title, country, and any prior interaction data indicating relevance.

Recipients

Email marketing and CRM service providers (under Data Processing Agreements).

Retention

Active contacts: reviewed every 18 months. Opt-out and suppression records retained indefinitely to honour unsubscribe requests. If no engagement or commercial relationship within 18 months, contact data is deleted or anonymised.

Your Rights

Every outbound marketing email will include: (i) clear identification of CSG as the sender; (ii) a physical or registered address; (iii) a clear and functional unsubscribe/opt-out mechanism; and (iv) the ability to opt out of all future marketing communications. Opt-out requests are processed within 10 business days. You may also contact us at privacy@csgfuture.com to be added to our suppression list.

Purpose

To process your event registration; to communicate event details; to conduct post-event follow-up and analysis.

Legal Basis

Contractual Necessity (Art. 6(1)(b) GDPR) for event-related communications; Legitimate Interests for post-event analysis.

Personal Data

Name, email, company, country, product/service of interest, date.

Recipients

Event management service providers (under Data Processing Agreements).

Retention

12 months from the date of the event for post-event communication and analysis; thereafter anonymised or deleted.

Purpose

To collect feedback to improve events, products, and services.

Legal Basis

Consent (Art. 6(1)(a) GDPR).

Personal Data

Email, survey responses.

Recipients

Survey platform service providers (under Data Processing Agreements).

Retention

12 months from the date of survey completion, then deleted.

Purpose

To respond to your enquiry; to fulfil contractual obligations where the communication relates to an existing contract.

Legal Basis

Contractual Necessity (Art. 6(1)(b) GDPR) where applicable; Legitimate Interests (Art. 6(1)(f) GDPR) for general enquiries.

Personal Data

Email content including sender, recipient, timestamp.

Recipients

Customer service platform providers (under Data Processing Agreements).

Retention

6 months from the date of the email interaction for general enquiries; up to 10 years where the email relates to a contractual or warranty matter.

Purpose

To accurately process your enquiry; for quality assurance; for staff training.

Legal Basis

Explicit Consent (Art. 6(1)(a) GDPR). Before any recording begins, you will be clearly informed and asked for your explicit consent. If you do not consent, the call will proceed unrecorded and this will not affect the service provided to you.

Personal Data

Call recording, call metadata (number, time, duration), personal data mentioned during the call.

Recipients

Customer service platform providers (under Data Processing Agreements).

Retention

6 months from the date of the call.

Purpose

To ensure the security, stability, and proper functioning of the Website; to diagnose errors and prevent fraud.

Legal Basis

Legitimate Interests (Art. 6(1)(f) GDPR): ensuring a secure and operational website. For jurisdictions where Legitimate Interests may not be available, this processing is technically necessary for the operation of the service.

Personal Data

Log Data: source IP, time zone, request date/time, browser type, OS, pages viewed, referrer URL, session events, source channel tag.

Recipients

Website hosting and security service providers (under Data Processing Agreements).

Retention

90 days from the date of collection, unless a security incident requires longer retention for investigation purposes.

Consent

Marketing email subscriptions; phone call recording; analytics, functional, and advertising cookies (where prior consent is required by applicable law, including in EU/EEA, UK, Saudi Arabia, and UAE). Outbound marketing communications to contacts in Saudi Arabia and UAE. You may withdraw consent at any time.

Contractual Necessity

Account registration; event registration; fulfilment of purchase-related enquiries. Processing is necessary to perform our agreement with you.

Legitimate Interests

Lead generation responses; B2B outbound marketing emails to EU/UK contacts (where relevant to their role and business); website security; post-event analysis; fraud prevention. We have conducted a Legitimate Interests Assessment (LIA) and concluded our interests do not override your fundamental rights. You have the right to object at any time.

Legal Obligation

Compliance with tax, accounting, statutory retention, and other mandatory legal requirements.

Strictly Necessary

Essential for the Website to function (e.g. session management, security). Cannot be disabled without impairing the Website.

No consent required in any jurisdiction — technically necessary for service delivery.

Performance / Analytics

Measure Website traffic, identify popular pages, and analyse user behaviour to improve the Website.

EU/EEA: explicit opt-in required (ePrivacy Directive + GDPR). UK: explicit opt-in required; purely aggregate analytics may qualify for opt-out under DUAA 2025 if no cross-site tracking is involved. Saudi Arabia / UAE: explicit opt-in required (PDPL). USA: opt-out mechanism sufficient (no prior consent required under most US state laws). Australia / Others: notice + opt-out sufficient.

Functional

Remember your preferences (e.g. language, country selection) and personalise your experience.

EU/EEA/UK: consent required if beyond strictly necessary. Other regions: generally no prior consent required if clearly disclosed.

Targeting / Advertising

Used by advertising partners to build interest profiles and serve relevant advertisements on third-party sites.

Explicit opt-in consent required in EU/EEA, UK, Saudi Arabia, and UAE. Opt-out mechanism sufficient in USA and most other markets. You may opt out at any time via cookie settings.

Access (Right to Know)

Request a copy of the personal data we hold about you, including information on how it is processed.

Rectification (Correction)

Request correction of inaccurate or incomplete personal data.

Erasure (Right to Delete)

Request deletion of your personal data under certain conditions: the data is no longer necessary; you withdraw consent and no other basis applies; you have successfully objected; or applicable law requires deletion.

Restriction of Processing

Request that we limit processing of your data while accuracy is disputed, or while an objection is being assessed.

Data Portability

Receive your personal data in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means.

Right to Object

Object to processing based on Legitimate Interests (including profiling) or direct marketing. Where you object to direct marketing, we will cease such processing immediately.

Withdraw Consent

Where processing is based on your consent, withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing. You can unsubscribe from marketing emails via the 'Unsubscribe' link in every email.

Non-Discrimination (US)

You will not be discriminated against for exercising your privacy rights (e.g. refused service or given a lower quality of service).

Opt-Out of Sale/Sharing (US)

California and other US state residents may opt out of the 'sale' or 'sharing' of personal data for targeted advertising. Use the footer link or contact privacy@csgfuture.com.

Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority competent for your jurisdiction, including: EU: your national Data Protection Authority; UK: Information Commissioner's Office (ICO); Saudi Arabia: SDAIA; UAE: Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) / relevant authority; USA: State Attorney General.

Personal Data

Any information relating to an identified or identifiable natural person ('data subject').

Processing

Any operation performed on personal data, including collection, recording, storage, use, disclosure, or deletion.

Data Controller

The entity that determines the purposes and means of processing personal data. CSG is the data controller for this Website.

Data Processor

An entity that processes personal data on behalf of the controller (e.g. our service providers).

GDPR

The EU General Data Protection Regulation (2016/679).

UK GDPR

The UK version of the GDPR as retained and amended by the Data Protection Act 2018.

CCPA/CPRA

California Consumer Privacy Act and California Privacy Rights Act.

PDPL (KSA)

Saudi Arabia Personal Data Protection Law, enforced by SDAIA from 14 September 2024.

PDPL (UAE)

UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

PIPL

China Personal Information Protection Law (2021).

SCCs

Standard Contractual Clauses — contractual safeguards approved by the European Commission for cross-border data transfers.

DPO

Data Protection Officer — a designated individual responsible for overseeing data protection strategy and compliance.

LIA

Legitimate Interests Assessment — a documented balancing test performed to justify processing under the Legitimate Interests basis.