Privacy policy

This Privacy Policy explains how Flopetrol Well Barrier AS (“we”, “us”, or the “Company”) processes personal data in connection with the website flopetrol-wb.com and our business activities.

1. Who is the controller?

Controller: Flopetrol Well Barrier AS

Controller representative: Stig Hetlevik

Address: Vestre Svanholmen 12, 4313 Sandnes, Norway

Email: mail@flopetrol.com

If you have questions about this Policy or our processing of personal data, contact us at the email address above.

2. What data we process and where it comes from

We process the following categories of personal data:

• Identification and contact details (e.g., name, company, role, email, phone)
• Communication content (your inquiries, feedback and any attachments you send us)
• Technical and usage data (e.g., IP address, device and browser details, pages visited, date/time, log files)
• Contract and billing data (for customers and suppliers: orders, invoices, payment details)
• Recruitment data (if you apply for a job: CV, application, references)

We collect data directly from you, from your employer/colleagues if you are a contact person, from publicly available sources (e.g., company registers), and from our service providers (e.g., hosting and security providers).

3. Purposes and legal bases

We process personal data for the purposes and on the legal bases listed below (GDPR Art. 6):

Purpose

Legal basis

Operating and securing our website (including basic logs, security monitoring and fraud prevention)

Legitimate interests (Art. 6(1)(f)) in running a secure, reliable website

Responding to contact requests and business inquiries

Legitimate interests (Art. 6(1)(f)) in communicating with you; or Contract (Art. 6(1)(b)) if the inquiry relates to entering into/performing a contract

Customer and supplier administration (contract management, deliveries, support)

Contract (Art. 6(1)(b))

Accounting, compliance and legal claims

Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f)) in establishing, exercising or defending legal claims

Recruitment

Legitimate interests (Art. 6(1)(f)); we rely on consent (Art. 6(1)(a)) if we keep applications on file for future roles

Direct marketing to existing customers (e.g., service updates, event invitations)

Legitimate interests (Art. 6(1)(f)); you can opt out at any time. For electronic marketing to non‑customers we obtain consent

Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

4. Cookies and similar technologies

Our website may use strictly necessary cookies to make the site work (e.g., load balancing and security). If we deploy non‑essential cookies (e.g., analytics or preference cookies), we will request your consent and provide details in a separate Cookie Notice available on the site. You can manage cookies through your browser settings.

5. Sharing of personal data

We share personal data only when necessary and on a need‑to‑know basis with:

• Service providers (processors) who supply hosting, security, IT support, email, and other business systems (bound by data processing agreements)
• Professional advisors (lawyers, auditors) under confidentiality
• Group companies or business partners where relevant for the purpose
• Public authorities when required by law
• Transaction counterparties (and their advisors) in connection with mergers, acquisitions or restructuring, subject to confidentiality

We do not sell your personal data.

6. International data transfers

If personal data is transferred outside the EEA, we ensure appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and supplementary measures where required. You may obtain a copy of the relevant safeguards by contacting us.

7. Data retention

We retain personal data only as long as necessary for the purposes described above or to comply with legal obligations. Typical retention periods include:

• Contact inquiries: up to 12 months after last interaction, unless they lead to a contract
• Customer and supplier records: contract term + 5 years (e.g., accounting rules)
• Technical and security logs: typically 6–12 months unless a longer period is needed to investigate incidents
• Recruitment: normally 6 months after a process ends; longer with your consent

We delete or anonymise data when retention periods expire.

8. Security

We apply appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, secure configuration and backups. Access is limited to authorised personnel with a need to know.

9. Your rights

Subject to conditions and exceptions under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Erase data (right to be forgotten)
• Restrict processing
• Object to processing based on legitimate interests (including direct marketing)
• Data portability (for data you provided to us, processed by automated means and based on consent or contract)

To exercise your rights, contact us at mail@flopetrol.com. We may need to verify your identity before responding. If you believe our processing infringes data protection law, you can lodge a complaint with your local supervisory authority. In Norway, this is the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

10. Children

Our services and website are not intended for children, and we do not knowingly collect personal data about children.

11. Changes to this Policy

We may update this Policy from time to time. The current version will always be available on flopetrol-wb.com with the “Last updated” date at the top.

12. Contact

Flopetrol – Privacy inquiries

Attn: Stig Hetlevik

Vestre Svanholmen 12, 4313 Sandnes, Norway

Email: mail@flopetrol.com