Counterparty due diligence

This Counterparty Due Diligence Privacy notice (“Privacy notice”) informs you of how a member of the bp Group ("bp", "we", "us" or "our") processes your “Personal Information” in relation to due diligence performed against our counterparties.

 

It is important that you read this Privacy notice, together with any other privacy notice we may provide to you to be aware of how and why we are using your Personal Information, and how you can exercise your rights over your Personal Information.

Personal Information, or personal data, means any information or combination of information relating to an identified or identifiable individual or as otherwise defined by applicable data privacy laws. A sub-set of Personal Information is Special Categories of Personal Information which means Personal Information that may be defined by an applicable data privacy law as having heightened sensitivity and may include, but not be limited to, information relating to an individual’s race, ethnicity, citizenship or immigration status, political opinions, religious or philosophical beliefs, trade-union membership, genetic information, biometric information as well as information concerning a person’s health, sex life or sexual orientation, and commission or alleged commission of any criminal offence.

 

We may process the following Personal Information and Special Categories of Personal Information about you. This is not an exhaustive list, and this may differ between jurisdictions:

• Biographical information such as name, telephone number and postal or email address, unique personal identification number, date of birth, nationality and country of residence and where applicable, photograph.
• Special Categories of Personal Information such as Personal Information relating to criminal offences and convictions (e.g. road traffic offences), political affiliation and activities, occupation.

You may provide this information to us, or we may obtain this information from other sources, such as from third parties.

Where required under applicable law, we ensure that we have a lawful basis to process your Personal Information for the purposes outlined in this notice. As such, where applicable, we will generally rely on one or more of the following lawful bases:

• Legitimate interests to use your Personal Information where it is necessary for our (or a third party’s) legitimate interests and those interests do not override your rights, fundamental rights and freedoms. This means we will only use your information for the purposes of a legitimate interest when there is no unfair impact on you.
• Compliance with law or regulation if we also use your Personal Information where it is necessary to comply with the law.
  

The table below sets out in more detail why we process your Personal Information, for the following purposes and our lawful bases under applicable data protection laws.

Intragroup sharing

 

We may share your Personal Information with other entities within the bp Group as part of our business operations, including with our parent company bp PLC, headquartered in the United Kingdom. Your Personal Information will only be disclosed to authorized individuals if and to the extent necessary required to fulfil a particular legitimate purpose. 

 

Third party service providers 

 

We may share your Personal Information with third-party service providers, agents and contractors to provide services to us (for example our accountants, professional advisors, and IT and communications providers). Any third-party provider we appoint must protect your Personal Information in line with the contractually required security measures.

 

Legal and regulatory disclosures

 

We may disclose your Personal Information as required by law, or when we believe that disclosure is necessary to protect our rights and / or comply with a judicial proceeding, court order, request from a regulator or any other legal process served on bp. We may also share your Personal Information in connection with legal proceedings, and these bodies may be situated outside of your jurisdiction. In these instances, the legal and/or regulatory authority will be considered to be a data controller (not acting on our instructions) and will be primarily responsible for deciding how your Personal Information is held and used once shared by us. In order to protect your privacy, we will only disclose the minimum amount of information necessary for the required purpose.

 

Restructuring recipients

 

We may share your Personal Information with third parties (and their advisors) to whom we may choose to sell, transfer or merge parts of our business or our assets.

As an international company, we may store or transfer your Personal Information to other bp entities around the world. Where this is the case, we will ensure that the importing jurisdiction offers an adequate level of data protection, or we will provide the Personal Information under a comprehensive, flexible, and global compliance framework which implements appropriate measures and safeguards to ensure that your Personal Information is protected in accordance with applicable data protection laws.

 

Similarly, where we transfer Personal Information to a third party located in a different jurisdiction, we will ensure that appropriate measures are in place to ensure an adequate level of protection for your Personal Information, such as by including appropriate clauses in our agreements with third parties.

 

You can request further information about our international transfers and the contractual safeguards we implement using the contact details below. If you wish to exercise any of the rights set out below, please contact us. You have the right to:

Some or all of the rights set out below will apply to you depending on where you are located:

• Request access to your Personal Information. Where applicable, you are entitled to receive a copy of Personal Information we hold about you.
• Request correction of the Personal Information that we hold about you. You may request that we correct any incomplete or inaccurate information we hold about you, though we may need to verify the accuracy of the new information you provide to us. It is important that the Personal Information we hold about you is accurate and current. Please contact us to update us in the event of any changes to your Personal Information.
• Request erasure of your Personal Information. You may request that we delete or remove Personal Information where there is no overriding reason for us to continue to process it. You also have the right to ask us to delete or remove your Personal Information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Information to comply with applicable law.
• Object to processing of your Personal Information. Where we are relying on legitimate interests, you have the right to object to processing of your Personal Information where you consider that the processing impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to continue to process your Personal Information and if this is the case, we will inform you.
• Request restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information. Some examples may include, if you want us to establish the information's accuracy, where our use of the information is unlawful but you do not want us to erase it, where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims or where you have objected to our use of your Personal Information but we need to verify whether we have overriding legitimate grounds to continue to process it.
• Request the transfer of certain of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Please note that this right only applies to information you provided to us and which we process on the basis of consent or where it is necessary to perform a contract with you.
• Withdraw consent where we are relying on consent to process your Personal Information. Withdrawal will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Opt-out of sale or sharing of your Personal Information. In jurisdictions where this right exists, you have the right to opt out of the sale of your Personal Information or the sharing of your Personal Information.
• Raise a complaint. You have the right to raise a data protection complaint directly with bp. We have an internal process to receive, investigate and respond to your complaint without undue delay. To submit a complaint, please contact us. If you are not satisfied with our response, you also have the right to complain to your local data protection supervisory authority (regulator).

How long we will hold your Personal Information for will vary and will be determined by the purpose for which we are using it. We will need to keep the information for as long as is necessary for each purpose, in line with our business needs. Additionally, there may be laws or regulation which set a minimum period for which we have to keep your Personal Information. We will only hold your information for the defined retention period, before anonymizing the information or deleting it. 

If you have any questions about this Privacy notice our privacy practices or your data protection rights, please contact us.

Changes to this privacy statement

This notice was last updated on 18^th March 2026.