Privacy Policy

1. Introduction

Tarangau (“we”, “us”, or “our”) operates the Platform at https://www.tarangau.energy. We are committed to protecting the privacy and security of all personal and business information we collect in connection with our services.

This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and what rights you have over it.

This Policy applies to all individuals and entities who visit our website, use our Platform, or interact with us in any capacity. It covers our obligations under the:

• Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• General Data Protection Regulation (GDPR) (EU/UK) where applicable
• California Consumer Privacy Act (CCPA) and its amendment by the CPRA where applicable
• General international best practices for data privacy and security

2. Who We Are

For the purposes of applicable data protection law:

• Data Controller / APP Entity: Tarangau
• Contact: contact@tarangau.energy
• Website: https://www.tarangau.energy

If you are located in the EU or UK, Tarangau acts as the Data Controller for personal data processed in connection with your use of the Platform.

3. Data We Collect

3.1 Information You Provide Directly

When you register, use the Platform, or contact us, we collect:

• Identity data: Full legal name, job title, date of birth (where required for KYC)
• Business data: Company legal name, ABN/ACN or equivalent registration number, country of incorporation, business address, and industry category
• Contact data: Email address, telephone number, and physical address
• KYC/AML data: Identity documents (passport, government-issued ID), beneficial ownership information, proof of address, sanctions screening results, and source of funds declarations
• Financial data: Bank account details (where required for settlement), billing information, and transaction history on the Platform
• Communications: Emails, enquiries, support tickets, and any messages sent through the Platform

3.2 Information Collected Automatically

When you visit our website or use the Platform, we automatically collect:

• Usage data: Pages visited, features accessed, session duration, and interaction logs
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and referral URLs
• Log data: Server logs, error reports, and access timestamps
• Location data: Approximate geographic location derived from IP address

3.3 Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to operate and improve the Platform. See Section 9 for our full Cookie Policy.

3.4 Information from Third Parties

We may receive personal and business data from:

• KYC/AML providers (e.g., identity verification platforms and sanctions screening services)
• Banking and payments partners in connection with settlement and trade finance
• Logistics and vessel data providers for real-time operational tracking
• Publicly available sources including company registries, regulatory databases, and sanctions lists

4. How We Use Your Data

Tarangau collects and processes personal data solely to the extent necessary to operate the Platform and discharge our legal obligations. Specifically, we use personal data only to:

• Authenticate users and provide access to the modules they have subscribed to
• Conduct mandatory KYC and AML verification, including sanctions screening
• Maintain audit and transaction records as required under financial-services and commodity-trading regulations
• Respond to enquiries and provide technical support
• Protect the Platform and its users from fraud, abuse, and unauthorised access

We do not use personal data for advertising, marketing profiling, behavioural analytics, automated content personalisation, or any commercial purpose unrelated to the core trading services. We do not sell, rent, license, or otherwise commercialise personal data to any third party.

Beyond the minimum required by law, we do not retain personal data for purposes outside the active provision of the Platform’s services.

We do not use personal data for automated decision-making that produces legal or similarly significant effects without human oversight, except in the context of KYC/AML screening, where regulatory frameworks require automated sanctions matching.

5. Legal Bases for Processing (GDPR)

For users in the EU or UK, we rely on the following legal bases:

• Performance of a contract: When processing is necessary to provide the Platform’s services to you
• Legal obligation: When processing is required for AML/CTF compliance, sanctions screening, regulatory reporting, or other statutory obligations
• Legitimate interests: When processing serves our legitimate business interests (e.g., fraud prevention, platform security, analytics) and does not override your rights
• Consent: For optional marketing communications or non-essential cookies — which you may withdraw at any time

6. How We Share Your Data

We do not sell personal data. We may share your data in the following circumstances:

6.1 Service Providers and Third-Party Processors

We engage trusted third-party service providers who process data on our behalf, including:

• KYC/AML verification platforms for identity and sanctions screening
• Banking and payments partners for settlement and trade finance
• Cloud infrastructure providers for hosting and data storage
• Logistics and vessel tracking providers for operational intelligence
• Analytics and monitoring tools for platform performance
• Legal and professional advisers for compliance and governance

All third-party processors are bound by data processing agreements and are required to process your data only in accordance with our instructions and applicable law.

6.2 Platform Counterparties

When you engage in a transaction on the Platform, certain identity and business verification data may be shared with your counterparty to the extent required for trade execution and compliance with applicable law. This includes verified KYC status and jurisdictional information — not your full identity documentation.

6.3 Regulatory and Legal Disclosures

We may disclose personal data to government authorities, regulators, courts, or law enforcement if required by law or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect rights or safety, or prevent fraud.

6.4 Business Transfers

If Tarangau undergoes a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the relevant successor entity, subject to the same privacy protections described in this Policy.

7. International Data Transfers

Tarangau operates globally and may transfer your personal data to countries outside your home jurisdiction, including Victoria, Australia, UAE, Singapore, and others where our service providers are located.

Where we transfer data from the EEA or UK to a third country, we do so using appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Other approved transfer mechanisms

For Australian users, we take reasonable steps to ensure overseas recipients handle personal data in accordance with the Australian Privacy Principles.

8. Data Retention

Tarangau retains personal data only for the period strictly necessary to provide the Platform’s services or to comply with applicable law (including AML/CTF record-keeping obligations, which typically require retention for seven years from the end of the customer relationship).

We do not maintain marketing databases, analytical archives, behavioural profiles, or backup copies of personal data beyond what is operationally and legally required. Where retention is no longer required, personal data is securely deleted or irreversibly anonymised.

If you close your account or terminate your relationship with us, personal data not subject to a statutory retention obligation is purged from active systems within thirty (30) days.

9. Cookie Policy

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar tracking technologies (pixels, local storage) to operate, secure, and improve our website and Platform.

9.2 Types of Cookies We Use

The Tarangau website uses a narrow set of first-party storage mechanisms strictly necessary for the operation and security of the site:

• Session cookie — issued upon authentication and used to maintain a signed-in session. Cleared on logout or session expiry.
• CSRF protection token — a short-lived, signed cookie that prevents cross-site request forgery on form submissions and API calls.
• Cookie-consent record — a single entry in the visitor’s browser local storage that records whether the cookie notice has been acknowledged. This entry contains no personal identifiers.

We do not deploy advertising cookies, marketing pixels, behavioural-analytics tags, social-media trackers, or any third-party tracking technology. No data collected by these mechanisms is shared with any external party, and no cross-site profiling occurs.

9.3 Your Cookie Choices

When you first visit our website, you will be presented with a cookie consent banner. You may:

• Accept all cookies
• Reject non-essential cookies
• Manage individual cookie categories

You can also manage cookies through your browser settings at any time. Note that disabling strictly necessary cookies may impact the functionality of the Platform.

For users in the EU or UK, we will not place non-essential cookies without your prior consent.

10. Security

We implement industry-standard technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. These measures include:

• End-to-end encryption for data in transit (TLS 1.2+) and at rest (AES-256)
• Multi-factor authentication for Platform access
• Role-based access controls limiting data access to authorised personnel only
• Regular penetration testing and security audits by independent third parties
• Immutable audit trails for all Platform transactions and document handling
• 24/7 security monitoring and incident response procedures
• Cyber insurance coverage

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant regulatory authorities within the timeframes required by applicable law (72 hours under GDPR; as soon as practicable under the Australian Privacy Act).

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

11.1 All Users

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request that inaccurate or incomplete data be corrected
• Right to deletion: Request deletion of your personal data (subject to legal retention obligations)
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

11.2 EU/UK Users (GDPR Rights)

In addition to the above:

• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes
• Right not to be subject to automated decision-making: Request human review of any automated decision that significantly affects you

11.3 California Users (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell (we do not sell personal information)
• Delete personal information we hold (subject to exceptions)
• Opt-out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising)
• Non-discrimination for exercising your privacy rights
• Correct inaccurate personal information
• Limit use of sensitive personal information

We do not sell personal information and have not done so in the preceding 12 months.

11.4 Australian Users (APP Rights)

Under the Australian Privacy Act, you have the right to:

• Access personal information we hold about you
• Request correction of inaccurate, out-of-date, or incomplete information
• Complain to us about how we have handled your personal information, and have that complaint investigated
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if not satisfied with our response

11.5 How to Exercise Your Rights

Submit a request to contact@tarangau.energy. We will respond within 30 days (or 45 days where permitted under applicable law for complex requests). We may need to verify your identity before processing your request.

12. Children’s Privacy

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us immediately at contact@tarangau.energy and we will delete it promptly.

13. Links to Third-Party Websites

Our website and Platform may contain links to third-party websites or integrated services. This Policy does not apply to those external sites. We encourage you to read the privacy policies of any third-party services you access.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. Where changes are material, we will notify you by email or prominent notice on the Platform at least 14 days before the changes take effect. The updated version will be published at https://www.tarangau.energy/privacy with the revised “Last updated” date.

15. Complaints

If you have a concern about how we have handled your personal data, we encourage you to contact us first at contact@tarangau.energy. We will investigate and respond within 30 days.

If you are not satisfied with our response:

• Australia: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) — 1300 363 992
• EU/EEA: Contact your local Data Protection Authority
• UK: Contact the Information Commissioner’s Office (ICO)
• California: Contact the California Privacy Protection Agency (CPPA)

16. Contact Us

For all privacy-related enquiries, requests, or complaints: