NORSK STÅL AS
Privacy Policy
Last updated: June 2026

This privacy policy describes how Norsk Stål AS collects, uses, and protects personal data when you visit our website, are a customer of ours, or otherwise interact with us.

Norsk Stål AS is the data controller for the personal data processed in accordance with this policy. This privacy policy does not apply to third parties’ processing of personal data. Such third parties are themselves responsible for their processing.

We process personal data in accordance with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).

1. Data Controller and Contact Information
Norsk Stål AS is the data controller for the processing of your personal data as described in this policy.

Org. no.: 959 493 715

If you have questions regarding the processing of your personal data, you can contact us:
• Email: firmapost@norskstaal.no
• Phone: +47 45 50 16 00
• Postal address: Lilleakerveien 6D, 0283 Oslo, Norway

2. What personal data do we collect?

Website visits
When you visit one of our websites, we automatically collect technical information about user behavior. The purpose is to optimize the website and analyze trends and usage patterns. The legal basis is our legitimate interest in adapting the website and services to users’ needs (GDPR Art. 6(1)(f)). Data collected includes:
• IP address
• Browser type and version
• Operating system
• Geographic location (country/region)
• Internet service provider
• Time spent on the site and website activity
• Referring website

Anonymized data that cannot be linked to you may be used and stored for statistical and analytical purposes.

Contact forms and inquiries
If you contact us via a contact form or otherwise, collected data may be used to contact you and provide relevant information. Data we collect includes:
• Name
• Email address
• Phone number
• Other information you provide in your inquiry

Newsletter
When subscribing to our newsletter, we process your email address and any preferences you have provided. The legal basis is an existing business relationship or your consent, provided that you have not opted out of receiving our communications.

3. Purpose and legal basis
The primary purpose of our processing of your personal data is to manage and fulfill the customer relationship and any other processing necessary to meet our obligations toward you as a customer. We process personal data to operate and optimize our website, where the legal basis is our legitimate interest (GDPR Art. 6(1)(f)). Furthermore, we process personal data to respond to inquiries and provide customer service, based on legitimate interest or the performance of a contract (GDPR Art. 6(1)(b) and (f)). We also process personal data in connection with newsletters and marketing, where the legal basis is consent or an existing customer relationship (GDPR Art. 6(1)(a) and (f)). Finally, we process personal data to conduct statistical analysis and improve our services, based on legitimate interest (GDPR Art. 6(1)(f)).

4. Data retention
We delete personal data when it is no longer necessary for the purpose for which it was collected. The retention period depends on the type of data and purpose. Data related to accounting documentation is retained for five years after the end of the financial year in accordance with the Norwegian Bookkeeping Act. For other data, the retention period is determined based on what is necessary for each purpose.

5. Sharing of personal data
Norsk Stål uses subcontractors (data processors) for the collection, storage, and processing of personal data. These process the data on our behalf in accordance with data processing agreements and our instructions, and within the framework of Norwegian and European data protection laws.

We may disclose personal data to public authorities when we are legally required to do so.

If we have obtained your explicit consent, we may share personal data with partners and other third parties for marketing purposes. We do not share personal data for such purposes without your prior consent. If there is a need for your consent, we may contact you using the contact information we have registered about you.

6. Cookies
We use cookies on our websites. Cookies are text files that are downloaded and stored on your device when you visit the website. We use cookies for the following purposes:
• Authentication, so you do not have to identify yourself each time you visit
• User statistics and traffic analysis
• Customization of the user experience and storage of preferences
• Marketing – cookies may be used to target relevant advertisements to you on other websites and digital platforms

Non-essential cookies, including those used for marketing purposes, are only used with your consent in accordance with the Electronic Communications Act and GDPR. You will be asked to consent on your first visit to the website, and you can change or withdraw your consent at any time via the cookie settings on the site.

You can also manage or delete cookies directly through your browser settings. Note that disabling cookies may affect the functionality of the website.

7. Your rights
Under the GDPR, you as a data subject have several rights regarding the personal data we process about you. You have the right of access, meaning you can find out what data we have registered, and the right to rectification if the data is incorrect or incomplete. In certain cases, you may also request that the data be deleted – the so-called “right to be forgotten” – or that processing be restricted.

You also have the right to data portability, meaning you can request to receive your data in a machine-readable format. Where processing is based on consent, you may withdraw your consent at any time. You also have the right to object to processing based on legitimate interest, including direct marketing.

To exercise these rights, you can contact us at firmapost@norskstaal.no or phone +47 45 50 16 00. We will respond without undue delay and no later than within 30 days.

8. Right to complain
If you believe that our processing of personal data is in violation of applicable regulations, you have the right to lodge a complaint with the Norwegian Data Protection Authority:
• Website: www.datatilsynet.no
• Phone: +47 74 07 70 00

However, we encourage you to contact us directly first so we can correct any errors.

9. Changes to the privacy policy
We may update this privacy policy as needed. In the event of significant changes, we will notify you via email or through a clear message on the website at least 30 days before the changes take effect. The current version is always available on this page.

10. Revision history
Below is an overview of when the privacy policy has been updated.

June 2026 – Revised version published