Privacy & Cookies

Summary

cBallast operates the cballast.com catalog and B2B order-handling workflow. This notice describes what we collect, why we collect it, how long we keep it, and the rights you have under EU General Data Protection Regulation (GDPR, Regulation 2016/679) as incorporated into Norwegian law by Personopplysningsloven (LOV-2018-06-15-38), and the ePrivacy rules as transposed via ekomloven.

We are a business-to-business supplier. The data we hold is overwhelmingly business-contact data (company name, purchasing contact, delivery address) collected for the sole purpose of quoting, fulfilling and invoicing an order. We do not run behavioural advertising, third-party remarketing or profiling. We do not sell data.

Data controller

The controller of the personal data described here is the operator of cballast.com — cBallast, registered in Norway. Full identity, registered address and organisation number are on the Imprint page. All privacy correspondence should reach us at sales@cballast.com with the subject line "GDPR request".

What we collect

All personal data comes directly from you or your organisation. We do not enrich records from third-party data brokers.

• Quote and order data — company name, registered and delivery address, VAT number, vessel or plant reference where relevant, purchase-order reference, line items, agreed payment terms.
• Business-contact data — name, work email, work phone of the purchasing, technical and shipping contacts you provide us.
• Account data — where you request a credit account, the documents needed for a credit assessment (company registration extract, trade reference, financial statements you choose to share).
• Site-usage data — standard web-server access logs (IP, timestamp, requested URL, HTTP status, referrer, user-agent), kept for a short operational period.
• Support correspondence — the emails and attachments you send us and our replies, kept for the period commercially reasonable for the matter.

Cookies and similar technologies

This site uses a minimal set of first-party cookies and browser storage strictly needed for the catalog to function (session state, catalog filter memory, theme preference). No consent banner is served because no cookie is set for advertising, remarketing, cross-site tracking or profiling.

We operate a single third-party analytics tag — Google Analytics 4 (measurement ID G-XL585NMX6F). It is loaded on a delayed schedule so it cannot affect page-load or user-input responsiveness. It is configured to measure aggregate page traffic only; we do not enable Google Signals, remarketing audiences, User-ID stitching, or ad personalisation. Google acts as our processor under the Google Analytics Terms of Service and Google Ads Data Processing Terms; the international-transfer safeguards are the EU-US Data Privacy Framework certification and Google's Standard Contractual Clauses. You can opt out at browser level by installing the Google Analytics Opt-out Add-on, or by refusing the analytics cookies through your browser's cookie settings.

We do not deploy Google Tag Manager, Meta Pixel, LinkedIn Insights, TikTok Pixel, Hotjar, Microsoft Clarity, Yandex Metrika, or any social-media sharing widget that pulls in third-party scripts.

We do not process payment-card data on this site; commercial settlement is by bank transfer against invoice.

Purpose and lawful basis

• Quotation and order fulfilment — GDPR Article 6(1)(b), performance of a contract or steps taken at your request prior to entering into a contract.
• Tax and bookkeeping records — GDPR Article 6(1)(c), compliance with a legal obligation under Norwegian bookkeeping law (Bokføringsloven) — 5 years for primary records, longer for special categories.
• Customs and export-control records — GDPR Article 6(1)(c), compliance with Norwegian customs law and EU dual-use Regulation (EU) 2021/821.
• Site security, fraud prevention and server logs — GDPR Article 6(1)(f), our legitimate interest in operating the site safely and free of abuse.
• Aggregate site analytics (Google Analytics) — GDPR Article 6(1)(f), our legitimate interest in understanding aggregate catalog demand; you may object at any time (see "Your rights").

Who we share data with

• Carriers (DHL, UPS, FedEx, sea-freight forwarder, or a customer-nominated carrier) — the name, delivery address, line items and commercial invoice data needed for the specific consignment.
• Customs authorities — commercial invoice, certificate of origin and HS-code data as required by the destination country's import procedure.
• Our bank — the payment reference data needed to reconcile an incoming bank transfer.
• Accountant and external auditor — order records for statutory bookkeeping and audit obligations, bound by their own confidentiality obligations.
• Google (as processor for the analytics tag described above) — aggregated interaction data, subject to the safeguards described in "Cookies and similar technologies".
• Regulatory or law-enforcement authorities where we are compelled to do so by valid legal process.
• We do not share data with marketing partners, ad networks or data brokers.

Where data is stored

Primary infrastructure is operated by cBallast in Norway. Backups are encrypted at rest and stored in EEA-located cloud storage. Data is not processed outside the EEA except as required to deliver a consignment to a non-EEA destination (carrier paperwork, customs declaration) or as inherent to the operation of the Google Analytics tag.

Where a US-headquartered carrier (DHL Express, FedEx, UPS) handles a non-EU shipment, the international-transfer safeguards are the carrier's own GDPR-compliant transfer mechanism (EU-US Data Privacy Framework or Standard Contractual Clauses). The analytics-tag transfer mechanism is described in "Cookies and similar technologies".

Retention

We keep personal data no longer than we need to for the purpose it was collected for, or for any longer period a legal obligation requires. Indicative retention periods:

• Quotation records — the commercially reasonable period after the last activity on the quote (typically 18 months), then deleted unless converted to an order.
• Order records — the period required by Norwegian bookkeeping law (Bokføringsloven §§ 13–14, currently 5 years for primary records; extended where customs or export-control records apply).
• Contact records for a person who has not placed an order — deleted after a commercially reasonable dormant period.
• Server access logs — a short operational period consistent with legitimate-interest processing.
• Backups — a rolling retention period, after which older snapshots are overwritten.
• Google Analytics user-level data — retained for the maximum period set in the property configuration; aggregated report data has no retention limit.

Your rights

Under GDPR Articles 15–22 you may request access to, rectification of, erasure of, restriction on the processing of, portability of, or object to the processing of your personal data. You may also withdraw a consent you have previously given. To exercise a right, email sales@cballast.com with the subject line "GDPR request", enclosing enough information for us to identify the data (a company-domain email is normally sufficient for company-held data; for personal data we may ask for additional verification). We will reply within one calendar month; complex requests may extend by a further two months in accordance with Article 12(3).

Complaints

If you consider that we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Norwegian data-protection authority (Datatilsynet — https://www.datatilsynet.no) or with the supervisory authority of your EEA member state of habitual residence, place of work, or the place of the alleged infringement.

Changes to this notice

This notice is updated from time to time. The version in effect is the version published on this page. Material changes are communicated on the site.