Effective 6 August 2026. This notice explains how The Oil Money handles personal data of visitors in the European Economic Area and the United Kingdom, under the EU General Data Protection Regulation and the UK GDPR. It sits alongside our Privacy Policy.
Data controller
The Oil Money, a business based in the United States, is the controller of the personal data described here. Contact: .
What we process, and why
theoilmoney.com is an educational website. Nothing is sold here, there are no user accounts, and no payments are taken, so the volume of personal data involved is small.
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser, device, pages viewed, referrer, timestamps | Keeping the site secure and available; understanding which articles are read | Legitimate interests (Art. 6(1)(f)) — operating and protecting our website |
| Analytics cookies | Aggregate traffic measurement | Consent (Art. 6(1)(a)) where required by local law; otherwise legitimate interests |
| Your email address and message, if you write to us | Replying to your enquiry | Legitimate interests (Art. 6(1)(f)) — responding to a request you initiated |
What we do not do
- We do not sell personal data, and we do not share it with third parties for their own marketing.
- We do not process special category data (health, biometrics, political or religious views, and similar).
- We carry out no automated decision-making or profiling that produces legal or similarly significant effects.
- We do not knowingly process data of children under 16 in the EEA or under 13 in the UK and US.
Recipients
Personal data is processed on our behalf by our web host, Cloudflare (delivery and security), Google (analytics and search performance) and WP Statistics. They act as processors under contract and may not use the data for their own purposes.
International transfers
We are established in the United States and our website is hosted there, so personal data of EEA and UK visitors is transferred to and processed in the United States. Where our processors transfer such data, they do so under the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy framework.
Retention
Server logs and analytics records are kept only as long as they remain useful for security and traffic analysis, after which they are deleted or irreversibly aggregated. Email correspondence is kept for as long as needed to deal with your enquiry and any follow-up.
Your rights
If the GDPR or UK GDPR applies to you, you have the right to:
- Access — obtain confirmation of whether we process your data, and a copy of it.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted where there is no overriding reason to keep it.
- Restriction — have processing limited while a dispute about it is resolved.
- Portability — receive data you gave us in a structured, machine-readable format.
- Object — object to processing based on legitimate interests, including any direct marketing.
- Withdraw consent — at any time, where processing relies on consent. This does not affect processing carried out before withdrawal.
How to exercise your rights
Email and describe what you want. We will respond within one month, as the regulation requires, and may ask for information to confirm your identity before acting. Exercising these rights is free.
Complaints
If you believe we have handled your personal data improperly, we would like the chance to put it right — please contact us first. You also have the right to lodge a complaint directly with your national data protection supervisory authority, or with the Information Commissioner’s Office in the United Kingdom.
Changes
If this notice changes we will update the effective date at the top of the page.