Client Data Protection & Confidentiality Statement

Effective date: 12 July 2026
Document status: Public client-information statement

1. Purpose and scope

Petronaq supports organizations operating in technically complex and commercially sensitive upstream environments. Engagements may involve reservoir, geological, seismic, petrophysical, production, simulation, flow-assurance, process-system, field-development, asset, operational, contractor, commercial, and decision-record information.

Petronaq recognizes that this information may be strategically significant even where it does not constitute personal data.

This statement explains Petronaq’s general public principles for handling client technical and confidential information. Binding obligations are established through applicable NDAs, proposals, master agreements, statements of work, client instructions, project-specific data-handling requirements, and software or platform terms.

2. Distinction from personal-data privacy

This statement concerns client, asset, project, technical, commercial, and operational information. Petronaq’s separate Privacy Notice concerns personal information relating to identifiable individuals, including website visitors, contacts, and enquiry submitters.

Some project materials may contain both confidential technical information and personal information. Where that occurs, both confidentiality controls and applicable personal-data requirements may apply.

3. Client ownership and control

Client-provided technical and commercial information remains owned or controlled by the client or other lawful rights holder, subject to the applicable contract.

Petronaq does not claim ownership of client source data merely because the information is received, reviewed, transferred, hosted, processed, interpreted, incorporated into project work, or accessed by an authorized specialist.

Petronaq uses client information only for the agreed engagement, within the permitted scope, for approved technical, commercial, administrative, quality, or contractual purposes, and in accordance with applicable client instructions.

4. No unauthorized reuse or commercialization

Unless expressly authorized and legally permitted, Petronaq will not sell, publish, commercialize, or disclose client information; use it in public case studies; reveal client identity or asset details for marketing; reuse client-specific models for unrelated clients; place identifiable client information in public training material; or use client information to train public or external artificial-intelligence models.

Any use of anonymized, aggregated, generalized, or derived learning must be governed by the applicable contract and must not expose client identity, confidential information, proprietary methods, or asset-specific conclusions.

No residual-knowledge or reusable-methodology right is assumed unless addressed contractually.

5. Confidentiality and NDA discipline

Petronaq treats confidentiality as a core engagement principle.

Where appropriate, confidential exchanges are governed by a mutual or one-way NDA, confidentiality provisions in a proposal, MSA, or SOW, client procurement terms, project-specific access conditions, specialist confidentiality undertakings, and approved data-room or system rules.

Confidentiality obligations extend to authorized specialists, technical reviewers, subconsultants, and commercial support parties who require access for the engagement.

6. Purpose limitation and data minimization

Petronaq seeks to request and access only information reasonably required for opportunity assessment, scope development, technical delivery, peer review, quality control, contractual administration, or legally required recordkeeping.

Clients should not be asked to transfer complete datasets where a smaller, staged, or structured dataset is sufficient. Initial website enquiries should contain only a high-level requirement summary.

7. Authorized access

Client information is accessible only to persons who have a legitimate engagement-related need, have been authorized under the applicable project structure, are subject to appropriate confidentiality obligations, understand the handling restrictions, and use an approved technical environment or transfer method.

Access may be restricted by individual, role, discipline, project phase, country, system, folder, data category, or client instruction.

Petronaq’s distributed specialist model does not permit unrestricted network-wide access.

8. Specialists and subconsultants

Depending on engagement needs, authorized specialists may work from Türkiye, Malaysia, Singapore, Germany, Norway, France, or the United Arab Emirates.

A specialist receives client information only where the specialist is relevant to the engagement, access is permitted under the applicable contract or project arrangement, confidentiality obligations are in place, access is limited to what is necessary, any client-approval requirement has been satisfied, and relevant legal, sanctions, export-control, location, nationality, data-residency, and software restrictions have been reviewed.

Where appropriate, specialist identities may be disclosed privately to the client before access is granted.

9. Client and project environments

Petronaq may work through client-provided systems, client virtual desktops, approved data rooms, restricted cloud environments, client-controlled technical platforms, or other agreed systems.

Where a client requires information to remain within its environment, Petronaq will seek to structure the work accordingly.

Downloading, copying, exporting, printing, or locally storing client information is limited by client instructions, contractual terms, software restrictions, the approved workflow, and engagement needs.

10. Engagement collaboration tools

After an enquiry has been qualified and suitable confidentiality arrangements have been established, Petronaq may use common business collaboration and document-sharing services, including client-provided environments or agreed services such as Google Drive.

The platform used for an engagement depends on client instructions, information sensitivity, contractual requirements, permitted access locations, software and licensing restrictions, data-residency or transfer requirements, and the engagement scope.

Use of a general collaboration platform is not automatic authorization to upload all client technical information. Highly sensitive information may require a client-controlled data room, virtual desktop, restricted project environment, or another specifically approved transfer method.

Access to engagement folders must be limited to authorized participants and removed when no longer required.

11. Third-party services and tools

Technical consulting may require communication systems, document platforms, data rooms, modeling or simulation tools, productivity software, cloud services, client-provided platforms, and specialist applications.

Third-party tools are used only where their use is lawful, access is properly licensed or otherwise authorized, the tool is suitable for the information, relevant contractual restrictions are understood, client approval has been obtained where required, and the tool’s data-handling conditions are consistent with the engagement.

12. Licensing-aware workflows

Petronaq’s work may be performed through legally available tools, client-provided licensed environments, properly authorized partner environments, software-agnostic engineering workflows, or other engagement-approved systems.

Where proprietary software is involved, the proposal or SOW should identify who provides the licence, which users are authorized, where the software may be accessed, whether remote access and project-file transfer are permitted, who bears related costs, and how vendor restrictions affect delivery.

References to software such as Petrel from SLB do not imply ownership by Petronaq, affiliation with the provider, reseller or implementation-partner status, guaranteed licence availability, or authorization beyond applicable licence terms.

13. Artificial intelligence and automated tools

Any use of AI or automated analytical tools by Petronaq must be controlled, relevant to the engagement, consistent with client instructions, legally and contractually permitted, subject to appropriate human review, and approved by the client where required.

Client technical or confidential information must not be submitted to public or external AI systems for model training.

Petronaq will not knowingly use client information to train a publicly available model, improve a third party’s general-purpose model, create an unrelated commercial data product, generate public demonstrations, or prepare public marketing content.

Where AI-assisted analysis is proposed, engagement terms should address permitted tools, input restrictions, provider retention, training settings, confidentiality, output review, accuracy limitations, human accountability, and documentation.

AI-assisted output does not replace qualified technical judgment, validation, or client decision processes.

14. Cross-border collaboration

Cross-border access to client information is not automatically permitted.

Relevant considerations may include client approval, contract restrictions, data-residency requirements, petroleum-sector rules, personal-data transfer requirements, sanctions, export controls, software licence restrictions, critical-infrastructure restrictions, specialist location, nationality, and confidentiality obligations.

The applicable engagement should identify permitted locations and recipients where these matters are material.

15. Storage, transmission, and document control

Information-handling measures are proportionate to the sensitivity, volume, format, and contractual significance of the information.

Depending on the engagement, measures may include controlled user permissions, approved file-transfer channels, client-managed environments, restricted project folders, password and account controls, version identification, recipient verification, confidentiality markings, limited local storage, documented project closeout, and access removal when no longer required.

Petronaq does not claim a particular security certification, cybersecurity architecture, or control framework unless implemented and independently verified.

16. Retention, return, and deletion

Client information is not retained indefinitely without an engagement-related, contractual, legal, accounting, quality, or dispute-management reason.

The applicable contract should determine what must be returned or deleted, the relevant deadline, permitted archival or legal-defence copies, treatment of backups, specialist-held copies, working files and extracts, and whether deletion confirmation is required.

Where the contract is silent, Petronaq will seek written agreement at project closeout concerning the disposition of material client information.

17. Disclosure and public references

Petronaq will not publicly identify a client, asset, field, project, or engagement unless disclosure is factually accurate, contractually permitted, approved where required, consistent with confidentiality duties, and professionally and legally appropriate.

Prior-employer, prior-operator, contractor, or specialist experience must not be represented as a Petronaq corporate engagement unless Petronaq contracted, governed, and delivered the work.

Anonymization does not automatically make publication safe where the client, asset, or circumstances remain reasonably identifiable.

18. Incidents and concerns

Suspected unauthorized access, disclosure, loss, alteration, misdirection, improper download, compromised credentials, prohibited tool use, or breach of client instruction must be escalated promptly through the applicable project or contractual channel.

Notification duties, investigation procedures, response times, client communications, and regulatory obligations are defined by the applicable law and contract. Petronaq does not publish a universal incident-notification deadline because requirements differ by engagement and jurisdiction.

19. Contractual precedence

This statement describes Petronaq’s general public principles. It does not replace or amend an NDA, MSA, SOW, client procurement terms, data-processing agreement, security schedule, software licence, data-room conditions, or binding project instructions.

Where a binding agreement establishes more specific or more protective requirements, that agreement governs the relevant engagement.

20. Contact

Petronaq
Ali Hosseini, trading as Petronaq
Istanbul, Türkiye — Emaar Square Business Complex
Email: privacy@petronaq.com

Prospective clients should initially provide only a high-level requirement summary and request a confidential discussion before transferring sensitive technical files.