What you choose to send: what you type into either enquiry form — name, email address, organisation, country and the enquiry itself — the files you attach on the oil-result form, which are the test results that form asks for, and whatever you write or attach in email. The contact form has no file field. Beyond that, what is collected without a form is described in the two sections that follow, and the routes to refuse it are there too. The pages are served from a content delivery network, which handles the network requests needed to serve them.
The site loads two services that try to identify where a visit comes from, using the network address, cookies they set for that purpose, and the pages visited. RB2B tries to match the visit to a public professional profile — typically a name, an employer and a LinkedIn profile address; it resolves a minority of visits, mostly from the United States, and the organisation rather than the person elsewhere. It does that matching through LiveIntent, an identity network: the tracker loads a hidden frame from that network, which reads and sets cookies of its own to link the visit to a profile it already holds. The frame loads only when RB2B loads, so everything below that stops RB2B stops it too. Leadfeeder identifies the organisation a visit likely comes from — the employer behind the network address, not the person; Dealfront, its operator, processes this on the practice's behalf. The practice uses what either produces for one thing: deciding whom to write to about its services. Under the California Consumer Privacy Act this identification counts as sharing personal information; nothing is sold, and nothing is shared for any other purpose.
In the EEA, the United Kingdom, South Korea and Japan, neither service loads until you agree to exactly this in a prompt on the page, and declining is remembered the way agreeing is. Everywhere, two further routes stop both before anything is loaded: Do Not Sell or Share My Personal Information records the choice for your browser, and a browser that sends the Global Privacy Control signal is treated as having made the same choice without asking. Outside those jurisdictions the services load on the practice's legitimate interest in knowing who reads its pages, with the same two routes out.
Each view of a page is recorded: which page, what led to it — a campaign named in the link you followed, or the site that referred you — the country the request came from, and the time. That record names nobody. It holds no address, no name and nothing that identifies a person or a device, and it exists so the practice can tell which of the things it publishes are read.
Where the two services above may load without asking, the same record also carries an identifier of this site’s own, kept in a cookie for two years, so that a return visit and an enquiry can be recognised as coming from the same browser. In the EEA, the United Kingdom, South Korea and Japan that identifier is set only if you agree to the prompt described above, and if you do not, the counting continues without it. A browser sending Global Privacy Control, and any browser that has used the opt-out page, is not counted at all. This page and the opt-out page are never counted.
An enquiry sent through either form carries the same fact about where the visit came from, and which of the two forms it was, so that the practice knows which of the things it publishes brought it and which of the two it asked for. Where neither a campaign nor a referring site is known, nothing is inferred and the enquiry is recorded as having arrived without one.
To answer the enquiry and, where you take it further, to run the engagement. Personal information is not sold and is not used for advertising; an enquiry is used to correspond with you, and what the identification services produce to decide whom to write to — nothing beyond either.
Enquiries are held in the practice's customer-relationship system and its business email, and are copied to an internal messaging tool; a file attached to the oil-result form is held in the same customer-relationship system, on the record of the person who sent it, and only its name reaches the messaging tool. What the identification services produce reaches the same messaging tool. The visit counts described above are held in a database operated by the content delivery network that serves the pages, on servers in Europe, and are not sent anywhere else. Each of these processes the data on the practice's behalf and not for its own purposes.
For as long as the enquiry or engagement is live, and no longer than useful for resuming it. On request it is deleted.
To see, correct or delete what is held about you, write to privacy@grisaru.com. Whatever your jurisdiction grants, the practical route is that address, and the answer does not depend on which law applies.
The practice's confidentiality rule applies to enquiries as it does to engagements: no client, site, unit or dataset is identified without written permission.
Marius Grisaru — Chemistry & Transformer Oils Consulting · last updated 20 August 2026