Privacy Notice

As of May 2018

1. Introduction
This privacy notice applies to personal data processed by International Petroleum Corporation (“IPC” or the “Company”) including e.g. any information provided by you when you exchange emails with IPC employees or when you access www.international-petroleum.com.

IPC operates in several countries through subsidiaries and affiliate companies and references in this notice to “IPC”, the “Company”, “we” or “our” shall be references to International Petroleum Corporation or another IPC company that you have been in contact with. IPC is a corporation registered under the laws of British Columbia, Canada, with head office located at Suite 2000, 885 West Georgia Street, Vancouver, British Columbia, Canada V6C 3E8 and the registered and records office located at Suite 3500, 1133 Melville Street, Vancouver, BC V6E 4E5, Canada.

References in this notice to “you” or “your” are references to website visitors, investors, partners, suppliers, customers, agents and others IPC may be in contact with, including any individuals employed by, representing or otherwise acting on behalf of such entities or anyone accessing the website.

The website is not directed towards, or intended for, children and we do not knowingly process any personal data on children.

2. Purpose of the Notice
The purpose of this notice is to keep you fully informed about how we collect and process your personal data. Please read this notice carefully to ensure that you are informed about how and why we use your personal data. IPC may send you several notices and this notice shall be regarded as a supplement to other notices and is not meant to replace or override other notices you receive from IPC, except for previous versions of this notice.

3. Purpose of Data Processing
3.1. General
We only process personal data about you as necessary for the administration of the relationship with you, such as e.g. an investor, customer, supplier or partner relationship.

Specifically, this may involve processing personal data such as name, address, telephone number and other contact information, national identity number, position and role, employer, account number, customer/supplier history (what was purchased when, etc.), information about meetings, communication and correspondence with IPC representatives, logins and activity on the IPC website, complaints and disputes, payment history, credit checks and information required for e.g. KYC, contract execution or tax purposes. In some cases we will have to conduct due diligence reviews, and data from such reviews will be processed.

In general, the Company does not process special categories (sensitive) personal data related to you.

The personal data held by IPC is normally provided by you or by the companies/organisations on whose behalf you act. Personal data about you may also be generated through your own activities in the context of the relationship between IPC and you, including in connection with a purchase, sale or deliveries to/from IPC, or communication between you and IPC. In some cases, IPC may supplement such information with data from external sources, for example in connection with credit checks, agent due diligence, the collection of supplementary information on the internet, etc.

3.2. The Use of Cookies
We use cookies for the purposes of facilitating basic website functionality, enhancing the user experience and to collect statistics on our visitors. Cookies are used to store certain data, e.g. to keep track of pages you visit on our website, identify the device you use and remembering settings such as language preferences for your next visit. When you access the website we may receive information from you such as IP address, operating system and the browser you use, for example for statistical purposes or for system administration purpose. This information does generally not include data that allows for individual identification of the information to a specific user.

We may embed content from third parties, such as video content and application forms. These third parties may use cookies and receive information collected from those cookies. Please refer directly to each third party website for more information on how they use cookies.

Recent version of all major browsers gives you as a user control over cookies on your device. You can choose to accept all, certain or no cookies. Information about how to manage cookies should be provided under the help section of your browser.

4. Legal Basis
The Company will sometimes obtain your consent to the processing of personal data, and will then have legal basis to process the personal data based on your consent. Personal data may also be processed where the processing is necessary for the performance of a contract with you or your principal or in order to take steps at the request of you prior to entering into a contract. Legal basis may also be based on legitimate interests of IPC in each case ensuring that IPC (and all other parties involved) understand the conflicts of interests that may arise as a result of our processing of your personal data. Legal basis for the processing may also be based on IPC’s legal or regulatory requirement to process the data. Furthermore, we might in some instances process your personal data where such processing is required to protect the vital interest of you or of another person or where such processing is necessary for the performance of a task carried out in the public interest.

5. Information to You
IPC practices openness about its processing of personal data. You shall when required by law be informed of the processing of your personal data and this privacy notice.

6. Personal Data Relating to Other Individuals
We might receive personal data relating to third parties from you. In those circumstances, it might not be appropriate for us to provide them with a privacy notice detailing how we use their personal data. Before sending us any personal data on third parties, you must therefore ensure that you have provided the relevant third parties with any necessary privacy notices in connection with our processing of their personal data.

7. Recipients – Access Restrictions
IPC restricts access to your data to personnel who require such access for the purposes specified in section 4 above. IPC may also share such data with sub-suppliers and other partners and, when specifically required, with advisers, auditors, lawyers, IT consultants and others.

8. Use of Processors and Transfer Abroad
IPC may use suppliers (processors) to assist with the processing of the personal data about you. This may occur, for example, when IT operations or the back-up of data are outsourced to an external supplier or to subsidiaries of IPC. The Company may also transfer personal customer data abroad, including to non-EU/EEA countries whose data privacy laws do not offer the same level of protection as under the General Data Protection Regulation (“GDPR”). The typical reasons for such transfers include the use of external data storage services. The use of processors and transfers of data abroad may also occur because the controller Company is part of the IPC group, and that other parts of the IPC group may assist this entity with the processing of personal data. All of IPC’s use of processors and transfers of personal data abroad will comply with applicable statutory requirements and the Company’s guidelines. The transfer of personal data abroad will only take place if there is a legal basis for such transfer. An overview of the Company’s use of processors and transfers of personal data abroad is provided by the Company upon request.

9. Use of Third Party Links
The website may include links or registration forms to third party website. Clicking on those links and/or providing information in forms related to third parties may allow third parties to collect and/or share data about you. Data processed under this section are not controlled or accessible by IPC and we encourage you to read the privacy notice on each third party website you visit or access from our website.

10. Duration of Data Storage
Personal data related to you will only be stored for as long as necessary for the purpose of the processing.

11. Personal Data Protection
The Company has implemented the technical and organisational security measures to ensure that your personal data is processed in a secure manner. The security measures are considered adequate by IPC. The need for additional security measures shall be evaluated on an on-going basis to ensure that the Company’s security measures are adequate at all times and to ensure secure processing of your data.

12. Changes to Your Personal Data
IPC is committed to ensure that the personal data we process is accurate and up to date. Please inform us if the personal data we hold on you changes during our relationship. If you wish to update your personal data please contact the person you have regular contact with or send an e-mail to data.privacy@ipccorporate.com.

13. Your Rights
As a data subject you have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability and (vi) object to the processing of your personal data. If the processing of the personal data is based on consent, you have the right to withdraw the consent at any time with future effect.

The Company will meet its obligations in this regard, and if you wish to exercise such rights you can contact the Company through the contact details specified in section 14. If you disagree with a decision or reply from IPC in relation to your personal data or if you have other concerns in relation to IPC’s processing of personal data, you may lodge your complaints directly to IPC using the contact details specified below. You may also contact your local data protection supervisory authority directly, without first complaining to IPC, but we encourage you to contact us first and we will aim to address any concerns you may have regarding our processing of personal data as soon as possible.

14. Who is Responsible – How to Contact Us
Each of the IPC entities will be the “controller” as defined in the GDPR with respect to the processing of personal data undertaken on behalf of such individual legal entity.

IPC is committed to ensure compliance with all applicable laws relating to data protection. If you have any questions or requests related to our processing of your personal data or with regards to which IPC entity that is considered the “controller” in relation to your personal data, please contact us at:

International Petroleum Corporation
Att: Data Privacy
Suite 2800
1055 Dunsmuir Street
Vancouver, BC
V7X 1L2, Canada
data.privacy@ipccorporate.com
Tel +1 604 689 7842