Privacy Policy
Last updated: 17 October 2026
1. Who we are
CommoVision B.V. (“CommoVision”, “we”, “us”, “our”) operates this website and the CommoVision data service. We are the controller of the personal data described in this policy.
| Legal entity | CommoVision B.V. (Dutch private limited company / besloten vennootschap) |
|---|---|
| Registered office | Waldenlaan 91, 1093 NH Amsterdam, Netherlands |
| Chamber of Commerce (KvK) | 98777300 |
| Privacy contact | privacy@commovision.com |
We have assessed that we are not required to appoint a Data Protection Officer (our core product is oil-and-gas production data, which is overwhelmingly non-personal; we do not carry out large-scale monitoring of individuals or process special-category data). We will re-assess this if that changes.
2. What this policy covers
This policy explains how we handle personal data in three situations:
- When you visit our website — technical data your browser sends, and how we identify visiting organisations (Section 4).
- When you create an account, start a trial, or contact us — the data you give us and the data we generate about your use of the service (Section 5).
- Personal data that appears inside our datasets — a small amount of personal data (mainly names on public oil-and-gas regulatory filings) that we obtain from public records and commercial data providers, not from you (Section 6). This is our Art. 14 GDPR disclosure.
Our core product — oil-and-gas well and production data — is about wells, not people, so most of what we process is not personal data at all.
3. The short version
- We rely mainly on legitimate interests to run, secure and grow our business, and on your consent or our contract with you where the law requires it.
- We do not sell your personal data, and we do not use third-party advertising trackers.
- We do not fingerprint your device or build a profile that links your browsing to you as a named individual unless you give us consent.
- You can object, access, correct, delete or port your data, and complain to the Dutch data-protection authority. Section 8 explains how.
4. Website analytics and visitor data
When you visit our website we automatically collect technical information your browser sends: your IP address, browser and device type (user-agent), the pages you view, the site you arrived from, and timestamps. We use this to measure and improve our website and to keep it secure and prevent abuse, and we use it to identify the organisations (not individuals) that show interest in our service so that we can reach out to them. We also measure, in your browser, how quickly our pages load and respond (page-performance readings such as load time and layout stability), which we use only to improve the site.
Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in operating, securing and growing a business website. You have the right to object to this processing at any time (see Section 8), and where we use this data to decide who to contact for business development (direct marketing), your right to object is absolute — we will stop on request, with no balancing.
Organisation identification. Where we identify the organisations behind visiting IP addresses, we do so using a licensed IP-intelligence dataset that we hold and query on our own servers — we do not send your data to that dataset’s provider, and at this stage we do not identify individual visitors.
What we do NOT do without your consent. We do not fingerprint your device, and we do not link your browsing history to you as a named individual, unless and until you give us consent (for example when you start a trial or contact us — see Section 5). Our content-delivery and CAPTCHA provider (Cloudflare) runs standard anti-abuse checks in your browser to tell people from bots; we do not use those checks for analytics or to identify you.
Cookies and local storage. Our website works without advertising or cross-site tracking cookies. We use only strictly necessary cookies, which do not require consent: session and authentication cookies when you sign in to your account, security cookies set by our content-delivery network to protect the site against bots and abuse, and the anti-abuse check (Cloudflare Turnstile) that loads when you start using one of our enquiry forms. As of this version, no first-party analytics identifier is set.
Retention. Raw IP addresses in our logs are deleted or masked after 90 days. We keep the event records themselves for as long as they are useful for the purposes above; after the mask they hold the page viewed, the time, technical details sent with each visit (such as the browser type, its language, the country and the referring site), the network or organisation the address belonged to, and a derived label saying whether the visit behaved like an automated program — but no longer the IP address itself.
Backups. We keep backup copies of our systems for disaster recovery, for up to 12 months. A backup holds data as it stood when it was taken, so data that has since been deleted or masked can persist inside a backup until that backup expires. We use backups only to restore service and to test that restores work, never to read data past its deletion or masking date, and a test restore’s copy is deleted when the test ends.
5. Account, trial and contact data
When you create an account, start a trial, subscribe, or contact us, we process the data you give us and data we generate about your use of the service:
| Category | Examples | Legal basis |
|---|---|---|
| Identity & contact | name, work email, employer, job title | Contract (Art. 6(1)(b)); legitimate interest for enquiries before a contract exists |
| Authentication | login credentials / single-sign-on identifiers | Contract; our legitimate interest in account security |
| Billing | company billing details, transaction records (we do not store full card numbers — our payment processor does) | Contract; legal obligation (tax/accounting) |
| Usage | features used, queries run, API calls, records consumed | Contract; legitimate interest in improving and securing the service |
| Support | messages you send us | Legitimate interest / contract |
Contact form. When you use the contact form on our website we collect the message you give us, your name and work email address, the type of request (taken from the button or page you wrote from) and (optionally) the page you were asking about, and technical data sent with the submission — your IP address, browser type (user-agent), language, country, and the page you arrived from — together with a reference number and the time we received your message. On the trial-request form we also collect your company name and whether you want API access. We use this to answer you and to keep the form free of abuse — including, where you asked to be notified, telling you when what you asked about becomes available. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) where your enquiry concerns access to or a trial of the Service, and otherwise our legitimate interests (Art. 6(1)(f)) in responding to correspondence and preventing abuse. Retention: the IP address is deleted after 90 days (as in Section 4); the submission itself is deleted after 24 months — if your enquiry leads to an account, the account data we then hold is covered by the account retention below. Where your enquiry is answered by e-mail, that correspondence is retained as ordinary business correspondence. You can ask us to delete your enquiry earlier at any time via privacy@commovision.com.
Product updates (consent). If you ask us for product updates (the “Keep me posted” form, or the optional product-news choice when you create a portal account), we use your email address to send you product updates by email; your consent covers nothing else (the e-mails your account itself needs, such as sign-in codes, are covered by the table above). The technical data sent with the form (your IP address, browser type, language, country and the page you arrived from) is handled as described under Contact form above, on the same basis and for the same abuse-prevention purpose; with the sign-up choice we record the same kind of technical data, with the address of the sign-up page, to show that you consented (our legitimate interest, Art. 6(1)(f) GDPR). Legal basis for the updates: your consent (Art. 6(1)(a) GDPR), which you give by submitting the form or ticking the choice. You can withdraw it at any time by replying to any of our updates or by emailing privacy@commovision.com; we then stop sending, and withdrawing does not affect processing that already took place. Retention: we keep your address for the updates until you withdraw. After you withdraw, we keep the record of your consent and of your withdrawal, with your address, for five years, and a scrambled (hashed) form of your address for as long as we need it to make sure we do not write to you again. The form or sign-up submission itself is deleted after 24 months (the contact-form retention above).
Linking your activity to your account (consent). With your separate, opt-in consent, we may link your account to your activity on our website — including visits made before you signed up — to provide, personalise and improve the service and manage our relationship. This is optional, we ask for it distinctly (not bundled into acceptance of our Terms), and you can withdraw it at any time as easily as you gave it, via your account settings or by emailing privacy@commovision.com. Withdrawing consent does not affect processing that already took place.
Portal usage analytics (consent). In the portal you can choose to turn on usage analytics (the “Usage analytics and personal shortcuts” choice, also available in Settings). If you turn it on, we record the details of how you use the app: the view you are in, the filters and settings you apply there, and when. The records are linked to your account and to you as the signed-in user. We use them to improve the product and to suggest shortcuts; our own team reads them only for those purposes, and we never share them or use them for marketing. If you leave it off, nothing is recorded under this paragraph; the service records in the table above are kept either way. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give with the toggle and can withdraw at any time in Settings, as easily as you gave it; recording stops right away, and withdrawing does not affect processing that already took place. Retention: each record is deleted after 12 months; your consent choices themselves are kept with your account as evidence of them. You can ask us to delete the records earlier at any time via privacy@commovision.com.
Business contacts and correspondence. When you write to or call us, comment on or message us on LinkedIn, or when we contact you as a potential customer, we keep a short record of who you are (name, company, role, email address or LinkedIn profile), what we discussed, what we promised and what the next step is, so that we can follow up and keep our word from one conversation to the next. We keep the substance of each message, not the message itself; the original stays in the mailbox or LinkedIn thread it arrived in. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) where you asked about access to or a trial of the Service; performing our contract with you (Art. 6(1)(b)) while your account with us is on a plan, a trial or an agreed arrangement; and otherwise our legitimate interests (Art. 6(1)(f)) in managing our business relationships and in telling people who may benefit from the Service about it. Where we approach you first, you can object at any time and we stop, with no balancing. Retention: 36 months after you last contacted us; if we approached you and you never replied, 12 months after our last message. While your account with us is on a paid plan, a trial, or another arrangement we have agreed with you, we keep this record for as long as it runs, and the periods above resume when it ends. You can ask us to delete the record at any time via privacy@commovision.com.
Do you have to provide it? The identity, authentication and billing data above is required to create an account and provide the Service. Usage data is generated automatically as you use the Service.
Retention. We keep account data for the life of your account and then for as long as we are legally required to (Dutch law requires business and invoicing records to be kept for 7 years), after which we delete or anonymise it. The stored record of your account’s requests is deleted after 24 months; raw IP addresses in it are masked after 90 days as in Section 4. Records evidencing your acceptance of our terms (including the network address and browser details at acceptance) are kept as contract evidence for the life of your account and up to five years after it closes, or longer while a legal claim is pending.
6. Personal data inside our datasets (our Art. 14 disclosure)
Our product is built from oil-and-gas well, permit and production data. This data is overwhelmingly about wells and companies, not about people. However, a limited amount of personal data unavoidably appears in it, because it comes from public regulatory records:
- the name of an operator that is a sole trader or a one-person business (where the trading name is also a person’s name);
- names or signatures of agents, engineers or officers that appear on public permit, completion or production filings;
- natural-person mineral or lease owners where a public record names them.
Where it comes from (Art. 14(2)(f)). We obtain this data from publicly accessible sources — chiefly the public records of US state oil-and-gas regulators, Canadian provincial regulators, and comparable authorities in other producing jurisdictions — and, where relevant, from commercial oil-and-gas data providers. We do not collect it from you.
Why we process it and on what basis. We process it to build, verify and present an accurate oil-and-gas production dataset for our customers. Our legal basis is our legitimate interests (Art. 6(1)(f) GDPR) in providing accurate market-data, balanced against the limited privacy impact of using information that is already in the public record for the purpose it was filed.
How we give you this notice (Art. 14(5)(b)). Because our datasets are built from a very large number of public filings, contacting each named individual directly would involve disproportionate effort. In line with Art. 14(5)(b) GDPR we therefore provide the information required by Art. 14 by making this disclosure publicly available in this policy.
Your rights over this data. The rights in Section 8 apply. In particular you can ask us what personal data about you appears in our datasets, ask us to correct or delete it, or object to our processing of it. Where a legal obligation requires the underlying public record to remain, we will explain that in our response.
7. Who we share data with
We do not sell your personal data. We share it only with:
- Service providers (sub-processors) who process data on our behalf under a contract. A provider may also process data for its own service-security and abuse-prevention purposes, where its own terms say so. Our current and planned sub-processors are:
| Purpose | Provider | Location / transfer basis |
|---|---|---|
| Hosting / infrastructure | Hetzner (Germany) | EU — no third-country transfer |
| Content delivery / security (CDN / WAF) | Cloudflare (US) | EU–US Data Privacy Framework + Standard Contractual Clauses |
| Payment processing (paid tier) | Stripe (US) | EU–US Data Privacy Framework + Standard Contractual Clauses |
| Authentication (portal accounts) | WorkOS (US) | Standard Contractual Clauses |
| Document text extraction (OCR) from scanned public filings (Section 6 data) | Mistral AI (France) | France (EU); data EU-hosted by default; any transfer outside the EU by its sub-processors under an adequacy decision or GDPR safeguards such as Standard Contractual Clauses |
| Email / correspondence | Proton AG (Switzerland) | Switzerland — European Commission adequacy decision |
We also share data with authorities or advisers where we are legally required to, or to establish, exercise or defend legal claims; and with a successor or acquirer in the event of a merger, acquisition, reorganisation or sale of assets, subject to this policy.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data and complete incomplete data;
- erase your data (“right to be forgotten”) in the circumstances the law allows;
- restrict or object to our processing — and where we process your data for direct marketing (including deciding which organisations to approach), your right to object is absolute and we will always honour it;
- data portability — receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on consent, without affecting prior processing;
- not be subject to solely automated decisions with legal or similarly significant effects — we do not carry out such automated decision-making.
To exercise any right, email privacy@commovision.com. We respond within one month; for complex or numerous requests we may extend this by a further two months and will tell you if we do (Art. 12(3) GDPR).
Complaints. You can lodge a complaint with the Dutch data-protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in your EU country of residence.
9. International transfers
We process personal data in the European Union. Where a service provider processes data outside the EU/EEA (for example our US-based content-delivery network, our US-based authentication provider for portal accounts, or a US-based payment provider on our paid tier; see Section 7), we only allow this where the European Commission has decided the destination protects personal data adequately (for example Switzerland, or a US provider certified under the EU–US Data Privacy Framework), or under an appropriate safeguard recognised by the GDPR, such as the European Commission’s Standard Contractual Clauses, with supplementary measures where needed.
10. How we protect data
We use appropriate technical and organisational measures — including access controls, encryption in transit, and minimisation (we mask IP addresses in our analytics store and keep raw IPs only briefly, except where kept as contract-acceptance evidence (Section 5)). No system is perfectly secure, but we take reasonable steps to protect your data.
11. Children
Our website and service are aimed at businesses and professionals. They are not directed at children, and we do not knowingly collect data from children.
12. Changes to this policy
We may update this policy. We will post the new version here with an updated “Last updated” date and, where changes are material, take reasonable steps to notify account holders.
13. Contact
Questions about this policy or your data: privacy@commovision.com, or write to CommoVision B.V., Waldenlaan 91, 1093 NH Amsterdam, Netherlands.