Privacy

Privacy notice

This notice explains what information OESA processes about you, why we do it, who helps us, how long we keep it and how you can use your rights.

Last updated 7 October 2026 · version 6

This is a translation. The Norwegian version applies if the two differ. See also the terms of use.

In short

We only store what we need to run the association: memberships, sign-ups, research by email, enquiries, what you choose to follow, and the analyses our members write.
We never sell data, show no advertising and use no tracking tools. Our own server counts how many times the pages are opened and which websites visitors come from, only as totals per day. OESA sets no cookies.
Only board members with administrator access can see the member list. Our partners never get it. Partner companies only see the CV profile of members who have switched it on themselves.
The data is kept in a database in the EU. The providers that help us are bound by agreements.
You can see, correct, download or delete your data at any time, and you can complain to the data protection authority.

1. Who is responsible

The controller is OESA – Offshore & Energy Student Association, a voluntary student association with members in Oslo, Bergen, Copenhagen, Trondheim, Kristiansund and Sogndal. The board is responsible for data protection day to day.

Association: OESA – Offshore & Energy Student Association
Organisation number: 938 592 306
Privacy contact: philipstave@oesa-global.com
Website: oesa-global.com

The association is not required to have a data protection officer and has not appointed one. All privacy questions go to the address above.

2. What we process, why and for how long

Each part of the website collects only what it needs. “Legal basis” is the article of the General Data Protection Regulation (GDPR) that allows us to process the data. The retention periods are OESA’s own rules. When a period ends, we delete the data or make it anonymous.

You apply for membership

What: Name, e-mail, place of study, year of study, study programme, the tracks you are interested in, any position you want to apply for and the motivation letter you attach. We also store when you applied, whether the application was approved or declined or whether you have left, when and by whom on the board it was handled, and possibly a short internal note from the board.
Why: To handle the application (it is also e-mailed, with the motivation letter, to the head of recruitment), administer the membership, form the groups in each city, invite you to events and contact you. The home page shows how many members we have in total and per city, but never who they are.
Legal basis: Membership is an agreement between you and the association (Art. 6(1)(b)). The tick box in the form confirms that you have read this notice and accept the terms.
How long: As long as you are a member. If you leave, or your application is declined, we delete the data within three months. This also applies to the motivation letter and the e-mail with the application to the head of recruitment. You can ask us to delete it straight away.

You log in to My page

What: Your e-mail address. You log in with a link we send to your e-mail. Once you are approved as a member, you can also create a password (the login service stores it only in encrypted form, and we cannot see it); if you forget it, we send a link to your e-mail. The login service also records when you logged in and technical details such as IP address and browser type. Your browser remembers the login until you log out or it expires (see section 5).
Why: To log you in, show only your own data and prevent misuse. Your membership is tied to your account, not just to your e-mail address.
Legal basis: The membership agreement (Art. 6(1)(b)) and our legitimate interest in keeping the service secure (Art. 6(1)(f)).
How long: The login account is deleted together with the membership. Accounts not linked to a membership, for example when someone creates an account without having applied, are deleted within twelve months. Technical login logs are deleted automatically by the provider after a short time.

You choose to appear in the member directory

What: Your name, city, place of study, your tracks and the link to your LinkedIn profile, if you add it.
Why: To let members find each other across cities. Only approved members who are logged in can see the directory. It is not open to search engines, partners or anyone else.
Legal basis: Your consent (Art. 6(1)(a)). You are not included until you switch it on yourself.
How long: Until you switch it off on My page or stop being a member. You then disappear from the directory immediately.

You switch on the CV profile for partner companies

What: What you write in the CV profile: a headline, a short text about you, the kind of position you want, when you are available and which cities you would like to work in. Together with this we show the name, school, study programme, year, tracks and LinkedIn link from your profile, and the titles of the analyses you have written in OESA if the board has linked them to you and you have not switched this off. We store when you gave your consent. Your e-mail is never shown. If a company asks to be put in touch via OESA, we store the company, the message, when it happened and whether the board has forwarded it to you.
Why: To let OESA’s partner companies find you for a summer job, internship, graduate position or permanent position, and to put you in touch without the company getting your e-mail address.
Legal basis: Your consent (Art. 6(1)(a)). The profile is off until you switch it on yourself, and it is separate from the member directory.
Who sees it: Logged-in users from the named partner companies that the board has given active access, for an agreed period. The companies with access right now are listed next to the switch on My page. Every time a company opens the candidate list, we log who and when, and the board can see the log. The companies have agreed to use the information only for a recruitment dialogue with you and not to copy or share it (see the terms for company users). If you get in touch with a company, the company is responsible for what it stores about you from then on.
How long: The profile is shown until you switch it off, until your membership is no longer approved, or until the company’s access ends – for each company, whichever comes first. When you switch it off, you disappear from the list immediately, and requests that have not been forwarded are stopped. The text you wrote stays on My page so you can switch the profile on again, until you clear it or the membership is deleted. Contact requests are deleted six months after they have been handled.

You sign up for an event

What: Name and e-mail, which event and when you signed up.
Why: To know who and how many are coming, hold the places and tell you about changes.
Legal basis: The membership agreement (Art. 6(1)(b)).
How long: Deleted no later than three months after the event. You can cancel on My page until the event starts.

You sign up for research by email

What: Your e-mail address, which topics you want (stocks and predictions, shipping, geology) and when you subscribed.
Why: To send you new analyses and stock predictions in the topics you chose. We send no advertising for others.
Legal basis: Your consent (Art. 6(1)(a)).
How long: Until you unsubscribe. Write to us and we will remove you from the list.

You follow a company, a field or a project

What: Which companies, fields and projects you follow, when you started following them, whether you have switched on e-mail alerts for each of them, and when we last sent you an alert. Without logging in, the list is kept only in your browser (see section 5). When you log in, it is stored in your account, and what you followed in the browser is moved there.
Why: To show the list on My page and on the globe on all your devices, and to send you e-mail alerts when you have switched them on yourself. You get at most one combined e-mail a day, to the address you log in with, with titles and links to new stock exchange announcements and events from the Norwegian Offshore Directorate for what you chose. Other members and companies cannot see the list, and we do not use it for anything else.
Legal basis: The agreement for the service you ask for (Art. 6(1)(b)). You only get e-mail alerts if you switch them on yourself.
How long: Until you stop following or delete your membership. “Delete membership” on My page deletes the list immediately, and it is also deleted together with your login account. Switch the alerts off with the toggle on My page, or with the unsubscribe link at the bottom of every e-mail. The link works without logging in and switches off all e-mail alerts, while the list of what you follow stays.

A company contacts us

What: The company, the contact person’s name and e-mail, phone number if given, what you are interested in, the message and whether we have replied.
Why: To answer the enquiry and possibly enter into and follow up a partnership.
Legal basis: Legitimate interest in answering and working with companies (Art. 6(1)(f)).
How long: Twelve months if no partnership follows. If it does, for as long as it lasts, and then as long as accounting rules require for agreements and invoices.

You use the company access (for partner companies)

What: Your e-mail address and a password that the login service stores only in encrypted form, the company, your name, the message you send with the request, when you accepted the terms, whether the access is active and until which date, a log of when you opened the candidate list and how many candidates it showed, and the contact requests you send via OESA.
Why: To give access only to employees of companies the board has approved, to be able to show members who sees their profiles, and to prevent and detect misuse.
Legal basis: The agreement on company access (Art. 6(1)(b)) and our legitimate interest in controlling and documenting who sees members’ information (Art. 6(1)(f)).
How long: The account is deleted three months after the access ended or was switched off, and a request that is never activated three months after it was sent. The log is deleted after twelve months. You can delete the account yourself on the company page; contact requests you have sent then stay with the board without a link to you until they are deleted after six months.

You write analyses or edit for OESA

What: E-mail, name and role (editor or administrator), a password that the login service stores only in encrypted form, and the analyses you publish with author name, any images and time of publication. If you are a member, the board can link the analysis to your profile so that it can be shown on your CV profile if you have switched it on.
Why: To give you access to publish and to show readers who wrote the analysis.
Legal basis: The agreement to write or edit for OESA (Art. 6(1)(b)).
How long: The account is deleted when the position or role ends. Analyses with the author’s name stay online as long as they are published. You can ask for them to be removed or for your name to be taken off (see the terms).

You are on the board or hold a position

What: Name, position, city and place of study, and if you wish: photo, a short bio, e-mail, phone and LinkedIn link. This is shown publicly on the home page.
Why: To show who leads the association so that members, universities and companies can get in touch.
Legal basis: Name and position: legitimate interest in showing who leads the association (Art. 6(1)(f)). Photo and contact details: your consent (Art. 6(1)(a)).
How long: Removed from the website when the position ends. Name and position may remain in minutes and annual reports as part of the association’s history.

You send us an e-mail

What: Your address and what you write.
Why: To reply and follow up the matter.
Legal basis: Legitimate interest in answering enquiries (Art. 6(1)(f)), or the membership agreement when it concerns your membership (Art. 6(1)(b)).
How long: Until the matter is closed, and no more than twelve months after the last message, unless the matter must be documented for longer.

You visit the website

What: When your browser fetches a page, the server sees your IP address, the time, the address requested and which browser you use. That is how the internet works. OESA’s own server keeps no log of visitors, only of errors, and error messages may contain the address that was requested. The server counts how many times each page is opened per day, and which website you came from if you came from another website (only its name, for example google.com). This is stored only as totals per day, without IP addresses, browsers or anything else that can be linked to you. The hosting provider and the database keep their own technical logs.
Why: To deliver the site, see how much it is used, find and fix errors and protect the service against attacks and misuse.
Legal basis: Legitimate interest in running a secure website (Art. 6(1)(f)).
How long: The logs are deleted automatically by the providers after a short time, usually within days or a few weeks. We do not use them to profile individuals. The visitor totals contain no personal data and are kept.

You read an analysis

What: Only a total count of how many times the analysis has been opened. Your browser remembers in session storage that you opened it, so the same visit is not counted twice. Nothing about you is sent to us.
Why: To show the most-read analyses.
Legal basis: No personal data.
How long: The count stays as long as the analysis does.

We do not use your data for automated decisions or profiling, and we do not ask for sensitive data such as health, religion or political views. Please do not enter such information in the free-text fields.

3. Who sees the data

The board. Only board members with administrator access can see the member list and the applications with motivation letters, sign-ups, the list of who gets research by email, company enquiries, company accounts, contact requests and the log of who has seen the candidate list. Access is given to individuals, not shared accounts, and removed when the position ends. The head of recruitment also receives each application with the motivation letter by e-mail.
You. When logged in, you see your own data and sign-ups and nobody else’s. This is enforced by rules in the database itself, not just by the website.
Other members only see you in the member directory if you have switched it on, and only the fields listed above.
Partners and companies never get the member list. Partner companies with active access only see the CV profile of members who have switched it on themselves, and never e-mail addresses (see the CV profile). If a company wants to invite members, we send the invitation ourselves.
Providers that run the service for us (section 4) only get access to what they need to do the job.
Authorities only receive data when the law requires it, for example following a court order.

We do not sell data or pass it on for marketing.

4. Providers and transfers outside the EEA

These providers process data on our behalf (processors). They may only use the data to provide the service to us, under data processing agreements that require confidentiality and security.

Provider	What they do for us	Where the data is
Supabase	The database for the forms, membership and analyses, the login and the image storage	Data centre in Ireland (EU)
Resend	Sends the login link and password reset e-mails from noreply@oesa-global.com, the applications with motivation letters to the head of recruitment, and the alerts about what you follow when you have switched them on	Sends from Ireland (EU)
Render	Runs the website and the server	Data centre in Frankfurt (EU)
Domeneshop	The domain name and e-mail for oesa-global.com	Norway

Supabase, Resend and Render are US companies. The data is stored in the EU, but the companies or their subprocessors may in some cases access it from countries outside the EEA, for example for support or operations. Any such transfer relies on a lawful basis under Chapter V of the GDPR, such as the European Commission’s standard contractual clauses (SCCs) in the data processing agreement, or the EU–US Data Privacy Framework where the provider is certified. You can ask us for more information about the basis for each provider.

Files fetched from others

To display the site, your browser fetches fonts from Google Fonts (Google) and code libraries from cdnjs (Cloudflare) and jsDelivr. These services see your IP address and browser, as every server does, and may process it outside the EEA. They are not our processors, and we send them no other data about you. We use them only to deliver files, not for tracking.

If you use the voyage calculator, your browser fetches weather and ocean data along the route directly from Open-Meteo. Open-Meteo then sees your IP address and the positions on the route you chose, but nothing else about you.

Data for the analysis page

OESA’s server itself fetches prices, weather, ship traffic, gas flows and continental shelf data from sources including Yahoo Finance, the Norwegian Meteorological Institute, the Norwegian Coastal Administration (Kystdatahuset), BarentsWatch (data delivered by BarentsWatch), Fintraffic, ENTSOG and the Norwegian Offshore Directorate. For “Follow”, prices, export figures and accounts come from Statistics Norway, Norges Bank, the World Bank, FRED (Federal Reserve Bank of St. Louis) and the Brønnøysund Register Centre, and the titles of stock exchange announcements from Oslo Børs (Newsweb). Nothing about you is included in these requests.

For the fleet under “Follow”, the server stores the positions of rigs and offshore vessels from the Norwegian Coastal Administration’s Kystdatahuset (AIS) and their departures from the supply bases. Only rigs and vessels registered with the Norwegian Offshore Directorate or with an offshore type in the Coastal Administration’s register are stored. Other ships are not stored, and we store nothing about the crew or anyone else on board. The file is overwritten every hour, a position is kept for at most six hours, and the departures cover the last 30 days.

The visit history is built every night from historical AIS positions from Kystdatahuset for the areas around the offshore installations. Only rigs and offshore vessels, selected as above, are included. When such a vessel has stayed still at an installation for at least 30 minutes, the visit is stored: the vessel’s name, MMSI number and type, the installation and the time span. The purpose is to show which rigs and vessels have been at the fields and installations you follow, and where rigs and vessels linked to a company have been. The visits are stored in the database at Supabase (EU) and deleted after 120 days. The pages show the last 30 days. Other ships are not stored, and the visits are not linked to persons.

5. Cookies and storage in your browser

OESA sets no cookies and uses no tools for visitor analytics, advertising or tracking. Your browser stores a few things locally so that features you choose to use work. This stays on your device and we cannot see it. Because the storage is necessary for the service you request, the cookie rules in the Norwegian Electronic Communications Act do not require consent.

Name	Where	What it does	How long
`sb-…-auth-token`	Local storage	Keeps you logged in on My page or as an editor	Until you log out or the login expires
`oesa-minliste`	Local storage	The stocks you added to “My list” on the analysis page	Until you clear the list or the site data
`oesa-folger`	Local storage	The companies, fields and projects you follow with “Follow” on the analysis pages. If you are logged in, the list is also stored in your account (see above).	Until you stop following them or clear the site data
`oesa-sammenlign`	Local storage	What you last chose to compare on the analysis page	Until you clear the site data
`oesa-ms-stillinger-sett`	Local storage	Which job listings you have seen on My page, so new ones can be marked	Until you clear the site data
`oesa-analyser-lokale`	Local storage	Analyses saved only in the browser when the site runs without a database (not used on oesa-global.com)	Until you delete them
`oesa-lest-…`	Session storage	Stops the same visit from counting an analysis twice	Until you close the tab
`oesa-folger-tabell`	Session storage	A technical marker that the list of what you follow cannot be stored in your account yet, so the page does not ask the database again	Until you close the tab
`oesa-v1`	Cache (service worker)	Copies of pages, styles, scripts and images so the site opens when you are offline	Until a new version replaces it, or you clear the site data

You delete all of this by logging out and clearing the site data for oesa-global.com in your browser settings.

6. Your rights

The GDPR gives you these rights. Using them is free of charge.

Access. You can find out what we store about you and get a copy.
Rectification. You can have incorrect or incomplete data corrected.
Erasure. You can have your data deleted, unless the law requires us to keep it.
Restriction. You can ask us to pause the processing for a period, for example while we check whether something is correct.
Data portability. You can get the data you have given us in a common machine-readable format.
Objection. You can object to processing we carry out on the basis of legitimate interest. We will then stop, unless we have compelling grounds to continue.
Withdrawing consent. Where we rely on consent (research by email, the member directory, the CV profile for companies, photos and contact details of board members), you can withdraw it at any time. This applies from then on.

How to do it: On My page (in Norwegian) you can see and correct your profile, choose whether to appear in the member directory, switch the CV profile for companies on and off, see and change what you follow and the e-mail alerts for it, cancel event sign-ups, leave the association, download your data and delete your membership. For anything else, e-mail philipstave@oesa-global.com. We reply as quickly as we can and within one month at the latest. If the request is complex, the deadline may be extended by up to two months, and we will tell you if so. We may ask you to confirm your identity, for example by writing from the e-mail address you are registered with, so that nobody else gets your data.

7. Complaints

We would like to hear from you first so that we can put things right. You always have the right to complain to the supervisory authority where you live or work, or where you believe the breach took place:

Norway: Datatilsynet
Denmark: Datatilsynet

8. Age

OESA is for students. You must be at least 16 to apply for membership or sign up for research by email. If we learn that we hold data about someone under 16, we delete it.

9. How we protect the data

The database has access rules on every row. The forms can only add new data, not read other people’s, and nobody can approve their own application.
Each person only gets the access their role requires. Editors can publish analyses but cannot see the member list. Company accounts have no access to the member features and only see the CV profiles members have made visible themselves; every view is logged.
Passwords are stored only in encrypted form by the login service. Membership is tied to the account, so an account created with someone else’s e-mail address gives no access to their membership.
All traffic is encrypted over HTTPS, and the providers encrypt what they store.
If a personal data breach occurs, we report it to Datatilsynet within 72 hours where the law requires it, and tell you if the breach is likely to pose a high risk to you.

No online system is completely secure, but we do what we can and fix weaknesses as soon as we find them. If you find a vulnerability, we would like to hear about it.

10. Changes to this notice

We update this notice when the website or the rules change. The date and version number at the top show which version applies. If the changes are significant, for example if we want to use data for something new, we will notify members by e-mail before the change takes effect. Earlier versions are available on request.

11. Contact

Send questions about privacy, or requests for access, correction or deletion, to philipstave@oesa-global.com.