Privacy Policy

1. Who is responsible

Tubing Supply AS, organisation number 837 679 222, Stavanger, Norway, is the data controller for the processing described here. Questions and requests concerning personal data can be sent to support@tubingsupply.no.

2. Information we process

Accounts and company access: name, business email, phone number, company, role, account status, sign-in time and access decisions.
RFQs, quotations and sales orders: contact details, technical requirements, project or purchase references, delivery information, files you choose to upload and commercial correspondence.
Support requests: category, subject, message, name, company, email, optional phone number, delivery state and case status.
Security and operations: administrative audit events, delivery errors and limited technical logs needed to protect and operate the service.
Privacy-minimised website analytics: route path without query parameters, referring host, country/region/city supplied by the hosting platform, device category, bot classification and pageview time. If you are signed in, the pageview may be connected to your existing account.

3. Website analytics and cookies

Our first-party analytics is designed to provide aggregate visitor numbers, popular pages and approximate geography without building persistent anonymous profiles. The service does not store your raw IP address or user-agent. Instead, it creates a one-way visitor hash that changes every day. The hash cannot be used to follow an anonymous visitor across days. Query strings and URL fragments are discarded, detected bots are excluded from human totals, and browser Do Not Track is honoured.

We also use Vercel Web Analytics for aggregate website performance. We do not use advertising cookies or cross-site tracking. Essential cookies or equivalent browser storage may be used for sign-in security, maintaining a quote basket and preserving a session; these are necessary for the features you choose to use.

4. Purposes and legal bases

To take steps at your request before a contract and to perform B2B supply agreements, including RFQs, quotations, orders, deliveries and account access.
To pursue our legitimate interests in answering business enquiries, supporting customers, improving the website, measuring aggregate usage, preventing abuse and maintaining secure operations.
To comply with legal duties that apply to business, accounting, product traceability, sanctions, tax or dispute records.
Where we specifically ask for consent for an optional purpose, consent is the legal basis and can be withdrawn for future processing.

We do not sell personal information and do not use it for automated decisions that produce legal or similarly significant effects.

Authorised Tubing Supply personnel and suppliers that operate the service may receive only the data needed for their task. Current processor categories include cloud hosting and deployment (Vercel), database, authentication and file storage (Supabase), and transactional email (Resend). Information may also be shared with carriers, suppliers, professional advisers or public authorities when required for a request, contract or legal obligation.

Where a provider processes data outside Norway or the EEA, we use the provider’s applicable data-processing terms and lawful transfer safeguards. We do not give service providers permission to use customer data for their own advertising.

6. Retention

Raw first-party pageviews are automatically deleted after 90 days. Daily anonymous visitor hashes have no use beyond their day.
Account information is kept while the account or company relationship is active, then reviewed for deletion or anonymisation. Data linked to an open request, order, security event or legal duty is retained as needed for that purpose.
RFQs and support correspondence are normally reviewed after the business follow-up period. Accepted quotations, sales orders and related documentation may be retained longer for contractual, warranty, traceability, accounting or legal requirements.
Email delivery errors and audit records are retained only while useful for troubleshooting, security and accountability, then deleted or anonymised under our operational retention routines.

7. Security

We use encrypted transport, role-based admin access, row-level database security, service-only credentials, audit logging and restricted file access. Access to visitor analytics and support cases is limited to authorised administrators. No internet service can promise absolute security, but we review controls and investigate suspected incidents.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may also withdraw consent where consent is the basis. Some rights can be limited by contractual or legal record-keeping duties.

Send a request to support@tubingsupply.no. We may need to verify your identity before releasing or changing account data. You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

9. Changes

We update this notice when the service or processing changes. The current date is shown at the top, and material changes will be highlighted where appropriate.