Privacy Policy

We collect:

• (a) Identity data — full legal name, date of birth, nationality, passport or national ID number

(b) Contact data — business email address, phone number, LinkedIn profile URL

(c) Professional data — employer, job title, seniority level, industry focus, geographic region

(d) Verification data — KYC/KYB documents uploaded during onboarding (passport copy, proof of address, corporate registry extracts)

(e) Transaction data — subscription payments, marketplace deal participation, data access logs

(f) Technical data — IP address, device fingerprint, browser type, session tokens, access timestamps

(g) Communication data — messages sent via the platform's encrypted messaging layer, deal room document access logs

(h) Preference data — language setting, notification preferences, matchmaking interest tags.

We rely on the following lawful bases:

• (a) Contract performance (Article 6(1)
• (b) GDPR / Art. 6(1) 152-FZ) — processing your name, email, professional profile and payment data is necessary to provide the membership services described in the Membership Agreement

(b) Legal obligation (Article 6(1)

• (c) GDPR / Art. 22(2) 152-FZ) — we are required to verify member identities under AML/CFT obligations and to retain certain data for statutory periods

(c) Legitimate interests (Article 6(1)

• (f) GDPR) — we process technical and usage data to secure the platform, prevent fraud and improve service quality

(d) Consent (Article 6(1)

• (a) GDPR) — we rely on your consent for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

To comply with Article 18 of Federal Law 152-FZ, personal data of Russian citizens is stored and primarily processed on servers physically located in the Russian Federation (Moscow data centre operated by our certified hosting partner). Cross-border transfers to non-Russian jurisdictions occur only where:

• (a) the destination country provides an adequate level of protection as determined by Roskomnadzor, or
• (b) we have executed Standard Contractual Clauses (SCCs) approved under GDPR, or
• (c) you have provided explicit consent. Prior to any cross-border transfer we record the transfer in our Article 30 Record of Processing Activities and notify Roskomnadzor as required by Art. 12 152-FZ. Transfers to our EU data centre (Frankfurt, Germany) for serving EU members are governed by GDPR SCCs (Commission Implementing Decision 2021/914).

Under GDPR you have the right to:

• (a) Access — request a copy of your personal data within 30 days

(b) Rectification — correct inaccurate data

(c) Erasure ('right to be forgotten') — request deletion where there is no overriding legal basis for continued processing

(d) Restriction — ask us to pause processing pending a dispute

(e) Data portability — receive your profile data in a machine-readable format (JSON/CSV)

(f) Object — object to processing based on legitimate interests

(g) Withdraw consent — for any consent-based processing at any time. Under 152-FZ you have equivalent rights as provided in Articles 14–17 of that law. To exercise any right, submit a written request to dpo@internationalenergyclub.org. We will respond within 30 calendar days (GDPR) or 10 business days (152-FZ), as applicable. Identity verification may be required before fulfilling a request.

We retain personal data only for as long as necessary for the stated purpose:

• (a) Active member profile data — for the duration of membership plus 3 years after termination

(b) KYC/AML documentation — 5 years after the end of the business relationship (per FATF Recommendation 11 and Russian Federal Law No. 115-FZ on AML)

(c) Transaction and payment records — 7 years for accounting purposes

(d) Security logs — 12 months on a rolling basis

(e) Consent records — 3 years from the date of the last interaction. Upon expiry of the applicable retention period, data is securely deleted or anonymised in accordance with our Data Deletion Standard.