This policy explains how [Company legal name] (“we”, “us”) handles personal data in connection with NRG-Drill: the web app, the NRG-Drill Transmitter, and this website. We follow the Nigeria Data Protection Act 2023 and, where it applies, the EU and UK General Data Protection Regulation (GDPR).
Who is responsible
- For personal data in your organisation’s NRG-Drill account (the people your organisation invites, and what they do in the app), your organisation is the controller and we process it on its behalf, as set out in our Data Processing Addendum. Some records, described below, we also use as a controller to run and administer the service.
- For this website and enquiries you send us, we are the controller.
Contact for privacy questions: [privacy-nrgdrill@alcings.com], [Registered address].
What we collect
Account and sign-in data
- Your name, email address, role, the wells you have access to, and your preferences (units, time zone, chart direction, quiet hours).
- A hash of your password (never the password itself).
- For each sign-in session: when it started and ended, the device and browser, the IP address and the country it resolves to. We use this to run single sign-in sessions (signing in on a new device ends the old one and tells the old device where), to lock accounts after repeated failed attempts, and to enforce your organisation’s location restriction if it has one.
Audit records
Sign-ins, failed sign-ins, password resets, session revocations, licence changes and data exports are recorded with the time, the person and, where relevant, the IP address. Your organisation’s administrators can read its audit log.
Usage records
While the NRG-Drill web app is open and visible, it records once a minute that you are viewing it, with the well and dashboard shown. Nothing is recorded while the page is hidden or closed. Wall displays and platform administrators do not report.
We use these records to produce usage reports for your organisation and to administer its licence. The basis is the performance of our contract with your organisation and our legitimate interest in operating the service.
Who sees them. Your organisation’s administrators see viewing time per person, day, well and dashboard. The platform operator ([Company legal name]) sees totals per organisation. We do not sell or share them with anyone else.
How long. Minute-by-minute records are deleted after 90 days. Daily totals are kept for as long as your organisation’s account exists [or for 2 years, if a limit is decided].
Drilling data
Drilling data and annotations sent by the Transmitter are generally not personal data. Annotations can contain names if people type them; they are handled as Customer Data under our Data Processing Addendum.
Website and enquiries
- When you send us a demo, trial or contact request, we receive the details you enter (name, work email, company, role and message) and use them to reply to you and to follow up on your request.
- This website uses privacy-friendly analytics that do not use cookies or collect personal data. See our Cookie Policy.
Why we use it (legal bases)
| Purpose | Legal basis |
|---|---|
| Providing the service to your organisation | Contract with your organisation; its instructions as controller |
| Security: sessions, lockout, location restriction, audit | Legitimate interest in keeping accounts and data secure; contract |
| Usage reports and licence administration | Contract; legitimate interest in operating the service |
| Replying to enquiries from this website | Your consent and our legitimate interest in responding |
| Meeting legal obligations | Legal obligation |
Who we share it with
- Your organisation’s administrators, as described above.
- Our subprocessors, who host and operate parts of the service for us under contract: see Subprocessors.
- Authorities, where the law requires it.
We do not sell personal data, and we do not use it for advertising.
International transfers
The service is hosted by [hosting provider] in [region]. Where personal data is transferred outside Nigeria or the EEA/UK, we rely on adequacy decisions or standard contractual clauses, as the law requires.
How long we keep it
| Data | Kept for |
|---|---|
| Account data | While the account exists, then deleted with the organisation’s data |
| Session records | [12 months] |
| Audit records | [24 months] |
| Minute-by-minute usage records | 90 days |
| Daily usage totals | While the organisation’s account exists [or 2 years] |
| Website enquiries | [24 months] after our last contact |
Your rights
Under the Nigeria Data Protection Act 2023 and, where it applies, the GDPR, you may ask for a copy of the records about you, or ask for them to be corrected or erased, and you may object to or ask us to restrict certain processing. Write to [privacy-nrgdrill@alcings.com].
If your data is in your organisation’s account, we may refer your request to your organisation, as the controller. Erasure may be limited where your organisation needs the records for its licence or its own records.
You can also complain to the Nigeria Data Protection Commission, or to your local data protection authority.
Security
See our Security overview for how we protect data, including tenant isolation, hashed keys and passwords, session controls and audit logging.
Changes
We will update this policy when how we handle personal data changes, and change the date at the top. If a change is significant, we will tell your organisation’s administrators.