Privacy Policy

Last updated: October 2026

Oxitrate AS processes personal data in connection with sales, customer relations, product deliveries, technical services and the operation of our business.

We are committed to handling personal data securely and responsibly, in accordance with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).

This Privacy Policy explains what personal data we collect and process, why we process it, how we protect it, and your rights regarding your personal information.

1. Data Controller

Oxitrate AS is the data controller responsible for the processing of personal data described in this Privacy Policy.

Oxitrate AS
Company registration number: 986 884 165
Address: Holterkollveien 6, 1448 Drøbak, Norway
Email: post@oxitrate.no
Phone: +47 22 25 04 00
Websites: www.oxitrate.no / www.oxitrate.com

If you have any questions about how we process personal data, please contact us using the details above.

2. Personal Data We Process

Sales and Customer Relations

Oxitrate processes personal data relating to contact persons at existing and prospective customers, suppliers and business partners.

This primarily includes:

Name, job title and employer
Telephone number and email address
Relevant correspondence, meetings, quotations and agreements
Information relating to deliveries and customer relationship management

This information is maintained in internal records, including spreadsheets such as Excel and business-related notes. It is used to support sales activities, business communications and the management of existing and prospective business relationships.

The legal basis for this processing is our legitimate interest in conducting and managing our business activities, pursuant to Article 6(1)(f) of the GDPR.

Technical Services and Deliveries

In connection with installations, maintenance, technical support and service activities, we process contact information relating to relevant personnel at our customers' organisations.

This information is used to plan, carry out and document deliveries, installations and service assignments.

The legal basis for this processing is our legitimate interest in delivering and supporting agreed products and services, pursuant to Article 6(1)(f) of the GDPR.

Oxitrate Insight

Oxitrate Insight is used to monitor and support the operation of our customers' facilities. Operational data is recorded at facility level and is not associated with identifiable individuals.

For customers with access to Oxitrate Insight, we process user account information and login records. This information is used for access control, account administration and security purposes.

Oxitrate AS acts as the data controller for this personal data. Processing is based on our legitimate interest in administering and securing the service, pursuant to Article 6(1)(f) of the GDPR.

User accounts and login history are retained for the duration of the contractual relationship with the customer. IP addresses are not recorded.

Job Applicants

When you apply for a position at Oxitrate, we process the personal data necessary to assess your application and manage the recruitment process.

This may include your name, contact details, CV, application, educational qualifications, certificates, employment references and information obtained through interviews.

As a general rule, this processing is necessary to take steps at your request prior to potentially entering into an employment contract, pursuant to Article 6(1)(b) of the GDPR.

Where additional assessments or checks are necessary to evaluate a candidate, processing may be based on our legitimate interest, pursuant to Article 6(1)(f) of the GDPR.

Applications and related documentation are retained for as long as necessary to complete the recruitment process and comply with any applicable legal obligations or address potential legal claims.

Personal data is deleted when there is no longer a lawful basis for retaining it.

3. Contact Forms and Newsletters

When you contact us through our website, we process the information you provide in order to respond to your enquiry and provide any necessary follow-up.

The legal basis for this processing is our legitimate interest in managing and responding to enquiries, pursuant to Article 6(1)(f) of the GDPR.

If you subscribe to our newsletter, we use your contact information to send industry insights, company news and relevant updates about Oxitrate's products and services.

Newsletter communications are sent on the basis of your consent, pursuant to Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time by using the unsubscribe link included in our newsletters or by contacting us directly.

4. Sources of Personal Data

We generally obtain personal data directly from you or from the organisation you represent.

As part of our sales activities and efforts to establish new business relationships, we may also collect publicly available business contact information from company websites and public registers.

Providing personal data is generally voluntary. However, certain contact information may be necessary for us to respond to enquiries, provide services and maintain customer relationships.

5. Website and Cookies

Oxitrate's websites do not use cookies or tracking technologies.

We do not store the IP addresses of visitors to our websites.

Personal data is processed when visitors voluntarily submit an enquiry through our website or subscribe to our newsletter.

6. How Long We Retain Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Our general retention practices are as follows:

Customers and business partners: Contact information and relevant documentation are retained throughout the business relationship and thereafter for as long as necessary to maintain appropriate records or address applicable rights and obligations.
Prospective customers: Personal data is retained for as long as it remains relevant to the potential establishment or development of a business relationship.
Oxitrate Insight: User accounts and login history are retained for the duration of the contractual relationship with the customer.
Job applicants: Personal data is retained for as long as necessary to complete the recruitment process or address any applicable legal claims.
Newsletters: Contact information is retained until consent is withdrawn or the newsletter service is discontinued.
Accounting records: Personal data included in statutory accounting documentation is retained in accordance with applicable Norwegian bookkeeping and accounting requirements.

When personal data is no longer required, and there is no other lawful basis for continued retention, it will be deleted or anonymised.

7. Sharing of Personal Data

Oxitrate does not sell personal data to third parties.

We use external service providers for certain business functions, including IT services, email communications, data storage, website hosting and accounting.

Service providers that process personal data on our behalf are required to comply with appropriate data processing agreements and information security requirements.

We may also disclose personal data to public authorities where required by law.

If personal data is transferred outside the European Economic Area (EEA), such transfers will be carried out using a valid legal transfer mechanism, such as an adequacy decision or approved Standard Contractual Clauses (SCCs), together with any supplementary safeguards required under applicable data protection legislation.

8. Information Security

Oxitrate implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or unlawful processing.

Access to personal data is restricted to employees and service providers who require the information to perform their assigned responsibilities.

9. Your Data Protection Rights

Under applicable data protection legislation, and subject to the relevant legal conditions, you have the right to:

Access: Request information about and access to the personal data we hold about you.
Rectification: Request the correction of inaccurate or incomplete personal data.
Erasure: Request the deletion of your personal data where applicable.
Restriction: Request that the processing of your personal data be restricted in certain circumstances.
Objection: Object to processing based on our legitimate interests.
Data portability: Request to receive or transfer your personal data where the right to data portability applies.
Withdrawal of consent: Withdraw your consent at any time where processing is based on consent.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

To exercise any of these rights, please contact us at post@oxitrate.no.

We will handle your request without undue delay and normally respond within one month of receiving it.

If you believe that our processing of your personal data violates applicable data protection legislation, you also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

For further information, please visit www.datatilsynet.no.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, data processing activities or applicable legal requirements.

The latest version of this Privacy Policy will always be available on our websites.