Privacy

We mostly process information that you have provided us for one of the following reasons:

• You have applied to us for student housing or a kindergarten place
• You have bought membership at one of our gyms
• You have made a purchase on credit at our cafés
• You have sent us a complaint
• You have asked for information about our services
• You have requested access pursuant to the Personal Data Act
• You have registered for a course or seminar
• You have applied to or made use of the Student Counselling Service or Student Health Clinic
• You have registered for a training session
• You have used our housing app
• You have applied for a job with us
• Your work for us
• You live in our student housing are require assistance, repairs, etc.
• Your child has a kindergarten place at one of our kindergartens
• You receive health care
• You have registered in one of our loyalty programmes
• You have created a user account on “Myspace” (Samskipnaden.no)
• You have saved your personal preferences on “My page”

We also receive information indirectly for the following reasons:
We have asked an organisation for a statement and information about you is included in this statement.

• A discrepancy report can contain information about you
• A complaint or supervision case can contain information about you
• Information about you is stored in connection with a supervisory matter
• We receive information about you from a government agency
• An employee has listed you as their next-of-kin
• A job applicant has listed you as a reference

We disclose your personal data:

• To comply with statutory requirements and tasks – the Norwegian Labour and Welfare Administration (NAV), Police, tax authorities, child welfare
• Collaboration partners who contribute to complying with our obligations – bank, insurance, pension, trade unions, UiT, system provider
• In other circumstances – but only after you have given your consent

You can exercise your rights by sending an e-mail to post@samskipnaden.no, or by contacting us in another way. You have the right to a response without undue delay and no later than one month after receiving the request.

Access to personal data about you:
You can request access to personal data we process about you.
Read more about the right of access

Rectification of personal data:
You can ask us to rectify or complete personal data about you that is inaccurate or incomplete.
Read more about the right to have inaccurate or incomplete data rectified or completed

Erasure of personal data:
In certain circumstances, you can ask us to erase information about you.
Read more about the right or erasure

Restriction of processing of personal data:
In certain circumstances, you can also ask us to restrict the processing of your personal data.
Read more about the right to restriction of processing

Object to processing of personal data:
If we are processing your personal data on the basis of performing our tasks or of a weighing of interests, you have the right to object to our processing of information about you.
Read more about the right to object

Data portability:
If we are processing your personal data on the basis of your consent or a contract, you can ask us to transmit the personal data about you to you or to another controller.
Read more about the right to data portability

You can complain about our processing of your personal data:

We hope you will tell us if you believe we do not comply with the provisions of the Personal Data Act. You can do so directly to us via post@samskipnaden.no or you can complain directly to the Norwegian Data Protection Authority.

Logging:
Samskipnaden has general security logs in the various task-specific systems we use, which the superuser/manager has delegated responsibility for. The logging concerns the employees’ use of the respective systems.

The lawfulness of processing for this is Article 6 (1) (f) of GDPR, which allows us to process data that is necessary for the purposes of a legitimate interest that overrides the individual’s privacy considerations. The legitimate interest is to secure Samskipnaden’s personal data against unauthorized access or access without a service-related requirement.

Samskipnaden’s use of data processors:
UiT The Arctic University of Norway contributes in the operation of a high proportion of our systems, such as several servers, file server, e-mail, Skype, active directory, laundry server, the technical system for housing, security company, intranet, access rights to UiT’s buildings and some of the key systems at the student housing.

Operation of the task-specific systems is left to the system providers during the transition to cloud solutions. All our providers are obliged to work in accordance with the General Data Protection Regulation (GDPR) and have subcontractors in compliance with the legislation.

Owing to UiT’s operation of Samskipnaden’s IT requirements, in some cases, named employees at UiT have access to personal data in some of our systems. In other cases, we must provide access to them or providers via split screen, remote access or in person when the need for assistance arises.

Personal data breaches:

Samskipnaden has established procedures for notifying the Norwegian Data Protection Authority in the event of personal data breaches.

This complies with the regulation concerning providing notification without undue delay and not later than 72 hours of becoming aware of it, in accordance with Article 33 of GDPR.

Administration and record management

Samskipnaden uses Business360 case, document and record management system for storing documents. The system is a cloud service provided by Tieto.

Various types of personal data are registered in the case, document and record management system. This information includes name, address, telephone number, e-mail address (basic data) and other relevant information and documentation depending on the inquiry. Registering, retaining and storing of data occurs in accordance with archive legislation, GDPR and the new Personal Data Act.

The lawfulness of processing for this is Article 6 (1) (f) of GDPR, which allows us to process data that is necessary for the purposes of a legitimate interest that overrides the individual’s privacy considerations. This is the documenting of the rights of individual people, as well as documents of significance for the organisation.

Information capsules (better known as cookies) are small text files stored on your computer when you download a website.

Storing of data and processing of these data is not permitted unless the user has been informed about such processing and has given his or her consent to this. The user shall be informed about and approve which data shall be processed, the purpose of the processing and who is processing the data, cf. Section 2-7b of the Electronic Communications Act.

The following cookies are used on samskipnaden.no.

Feed AS is Samskipnaden’s data processor, provider and developer for samskipnaden.no. When creating an account on “My page”, the user gives Samskipnaden the right to store his or her information on Samskipnaden’s database. Examples of the information the user shares with Samskipnaden include: their favourites stored on samskipnaden.no, name, e-mail address and phone number. If consent is given on “My page”, Samskipnaden collects information about purchases and use of Food & Beverages’ loyalty programme, and/or purchases, activity and history of use of Kraft sports centre. Information from Kraft sports centre is collected from the account created by the user on kraftsportssenter.no and services provided by Exceline and iBooking. In addition, Samskipnaden will store information about the user’s student status and campus if the user has logged in to Feide.

Retail Solution AS is Samskipnaden’s provider and data processor of user data in the cash register system RSPOS. Users are registered in Retail Solutions’ database when they register for Samskipnaden’s loyalty programme. Registration requires an approved declaration of consent on the user’s “My page”. By using the loyalty programme, information about purchases, use of QR code (membership card) and the time and place of the purchase is stored in the databases of both Samskipnaden and Retail Solutions. The name and personal data of the user are not stored in Retail Solutions’ user database. User identification between the services occurs via web tokens from Samskipnaden’s database to the Retail Solutions’ system.

iBooking AS is Samskipnaden's priovider of user data from Kraft Sportssenter to "My page". By giving consent to "My training", you give permission to collect your membership information from Kraft Sportssenter and iBooking. We use collected data to present your membership info on MyPage, provide customized offers and improved our services. The user consents to giving Samskipnaden the ability to retrieve your account information from Kraft and iBooking, store and present visits, payments and membership information. And analyze training data from Kraft and iBooking for the development of better services and adapted offers on Samskipnaden.no.

By consenting to receiving offers and news from Samskipnaden by email, the user email will be listed and label as receiver of marketing-emails from Samskipnaden. Other users will not be labeled or listed as recipients of marketing emails from Samskipnaden and will not receive this marketing.

Twilio is used to send two-factor verification codes via SMS to confirm a user’s mobile number. This is to secure a user’s access to their data on “My page” on samskipnaden.no. Twilio gets access to users’ phone numbers for the purpose of sending a verification code. Read about Twilio’s compliance with data protection requirements: https://www.twilio.com/gdpr.

By registering an account on “My page”, the user gives their consent to Samskipnaden using the user’s activity, data and details to offer a user profile on samskipnaden.no and to collect and compile data for the further development of the services.

The user’s account on “My page” and Samskipnaden’s loyalty programme will be anonymised when the user has deleted the account on “My page”. For users of Kraft sports centre, student housing and the other services, separate guidelines apply for storing data and deleting accounts.

By logging in with Feide (private use), you agree that Samskipnaden can retrieve information about your name, photo (if added), student status / status, place of study and email. This information will be used to create a user on "My Page" and give you as a student, the student perks we offer on "My Page". See your own privacy statement when you log in / register.

By logging in with Google, you agree that Samskipnaden can retrieve information about your name, photo (if added) and email. This information will be used to create a user on "My Page". See your own privacy statement from the supplier when you log in / register.

The user's account on “My Page” and Samskipnaden’s perks program will be anonymized when the user no longer has an active Feide account or has chosen to delete the account on “My Page”. For users of Kraft sports centre, housing services, and other services, there are separate guidelines for storing data and deleting accounts.

Samskipnaden will not sell user and personal information to external companies / organizations.

When using the Housing Service on Samskipnaden.no and "My Page", the user logs in or creates a user on the housing service provided by Ørn Software AS. At the same time, the user gives Samskipnaden the right to retrieve, view and store the housing information that the logged-in user has registered on UniAlltid, Samskipnaden's former housing portal (studentbolig.samskipnaden.no), on My Page. The housing information includes and is not limited to invoice information, living conditions, checklists, applications, information about children and cohabitants, status of studies and the like. The user also gives Samskipnaden the right to show and send inquiries (with and without attachments) to the housing service provided by Ørn Software AS, on My Page. Users logged in to Samskipnaden housing on My Page, and the housing service (UNI) provided by Ørn Software, also accept that the activity and user information can be used by Samskipnaden for further development of Samskipnaden's service delivery. See separate privacy agreement.

Searches on our website www.samskipnaden.no:
Samskipnaden stores data about search terms used by the users. The purpose of the storage is to improve our information provision. The usage pattern for searches is stored in aggregate form in a separate database. The search terms stored cannot be linked to other data about the users, such as the IP addresses. The search terms will be stored to generate statistics about search terms. Samskipnaden stores data about the search terms the users use on our websites.

The lawfulness of processing for this is Article 6 (1) (f) of GDPR, which allows us to process data that is necessary for the purposes of a legitimate interest that overrides the individual’s privacy considerations. The legitimate interest is to ensure services on the website work.

Registering for groups and courses arranged by Samskipnaden:
On samskipnaden.no you can register for groups and courses under the auspices of Samskipnaden. Such registrations occur in a system for course registration supplied Affy AS. Read more about course registrations at the end of this document.

Ordering of catering
Users can order catering on samskipnaden.no by filling out a form in Microsoft Forms developed by Samskipnaden. The form in Microsoft Forms was developed in Samskipnaden’s internal Office 365. When a form is registered in our systems, an e-mail is sent to the head chef, head of catering and executive officer at Food & Beverage to process the order and handle invoicing. The order is stored in the e-mail account catering@samskipnaden.no, and deleted from Microsoft Forms one year after the order date. Samskipnaden stores orders to analyse major ordering trends and customer requirements.

Use of Samskipnaden's app

To use Samskipnaden's app, a user on "My page" is required. Users can be created directly in the app or on samskipnaden.no. When creating a user, a login method is selected; e-mail and password (in house), Feide, Google or Apple. If you already have a user on My Page in samskipnaden.no, you can log in with it.

When you log in via a third party (e.g. Google or Apple), personal data may be shared with third parties at the user's own risk. Samskipnaden has no control or ownership over such sharing.

When using the app, Samskipnaden collects and stores information such as name, e-mail, phone number, place of study and student status. Our data processor (Feed AS) will have access to the collected information. Beyond this, we do not share information with external parties.

Future changes

The app will be in constant development, services and the need for data related to them may change. The text will therefore be updated if and when new functionality is added to the app. As long as we are not required to store data – e.g. in accordance with the bookkeeping laws - we will also endeavor that you as a user can withdraw any consent you have previously given us at any time.

Levelup 2.0 is Samskipnaden’s data processor, supplier and developer of kraftsportssenter.no. Level Up 2.0 is also the operations service provider for kraftsportssenter.no.

Ibooking AS is our provider and developer of the service for booking of group sessions and registration of membership on the website. Exceline is our operations service provider for purchase and management of memberships at our gyms.

EG Norge is Samskipnaden's data processor, supplier and developer of studentbolig.samskipnaden.no, which is the application where housing applications are created and sent. The personal information is registered by the applicant themself, and will later be included as part of an agreement to which the applicant himself is a party.

EG Norge is also a data processor for information provided by users in housing applications on samskipnaden.no, as well as messages and other housing data via My Page.

EG Norge has its own privacy policy for users of our housing system.

Personal data is shared with our data processors (Feed AS and EG Norge). In addition to this, Samskipnaden will not share personal data with external parties.

Telephone / Skype:
Skype calls (phone number from and to, as well as the time of the conversation) are logged in Skype for Business. The telephone number, time/date and duration of the call are stored in our telephone network. This log is necessary to manage and operate the system and provide a basis for statistics at aggregate level. The info in the call detail record (CDR) is deleted after one month. The complete log is deleted after three months. There is no other systematic registering of telephone calls that can lead to the identification of the caller.

The lawfulness of processing for this is Article 6 (1) (f) of GDPR, which allows us to process data that is necessary for the purposes of a legitimate interest that overrides the individual’s privacy considerations. The legitimate interest is to manage and operate the telephony system.

E-mail and written messages in Skype for business:
Samskipnaden utilises Microsoft Outlook E-mail; Microsoft Teams and Skype for Business as everyday digital tools. Relevant information that appears in telephone calls, e-mail exchanges and call logs, and which is part of administrative procedures, can be stored in the case, document and record management system (see the section about Administration and record management).

All employees have a responsibility to delete e-mail that is no longer relevant, including to review and delete unnecessary content in their Inbox at least once a year. E-mail accounts are deleted on terminal of employment and employees normally transfer relevant e-mail to colleagues before leaving.

Sensitive personal data must not be sent by e-mail. Please be aware that regular e-mail is unencrypted. Consequently, we encourage you not to send confidential, sensitive or other personal information via e-mail.

Purpose: Samskipnaden’s employees utilise Microsoft Teams, Skype and e-mail in general dialogue with internal and external contacts. The purpose is to have an efficient tool for communication between us and our customers.

The lawfulness of processing for this is Article 6 (1) (f) of GDPR, which allows us to process data that is necessary for the purposes of a legitimate interest that overrides the individual’s privacy considerations. The legitimate interest is general dialogue with internal and external contacts.

The purpose of video surveillance is to protect employees and prevent vandalism, theft, robbery and other criminal acts, as well as to have extended security control of entrances.

The lawfulness of processing for this is Article 6 (1) (f) of GDPR, which allows us to process data that is necessary for the purposes of a legitimate interest that overrides the individual’s privacy considerations. The legitimate interest is to protect employees and prevent vandalism, theft, robbery, undesirable people entering the building and other criminal acts.

Cameras at MIX Campus:
The design of the MIX kiosks present challenges when it comes to maintaining a constant overview of the entire premises. Consequently, we use several surveillance cameras at our premises. One of them is operated by UiT The Arctic University of Norway, while the other four are operated internally. The internal cameras only show real time images with sound and do not have recording capability.

The monitor for the internal cameras is mounted in kiosk manager’s office and shows the kiosk’s premises from different angles.

The last camera records images, but not sound. Recordings are deleted automatically after seven days. Two employees at the Department of Property Management at UiT have access to these recordings. The recordings are not disclosed to parties other than the Police/prosecuting authority and only when they hold a valid warrant issued by the prosecuting authority or courts.

Nokas is not responsible for the surveillance cameras at UiT. However, they have access to the real time images in connection with their service provision. They can also see recordings from the period before an incident or discrepancy so they can, for instance, get an image of any perpetrator(s). Nokas cannot copy/store recordings. Furthermore, they have been advised that caution must be exercised when using the ITV system.

Cameras at Kraft sports centre and Elverhøy student gym Tromsø:

During certain periods, the student gym at Elverhøy is unmanned.

Kraft sports centre and Elverhøy student gym have cameras without microphones/sound in access-controlled areas, as well as at some exterior doors/entrances. The images show who enters and exists the various places. These images are shown in real time and have recording capability.

Employees working at the reception at Kraft sports centre have access to see surveillance images of the doors at Elverhøy student gym since that centre is completely unmanned. Kraft sports centre has limited access to a monitor in the office of the Head of Section and Sports Adviser. The recording devices are situated in a secure location with a separate key and access control. The Head of Section has access to the recordings. The recordings are deleted/overwritten automatically after seven days. The recordings are not disclosed to parties other than the Police/prosecuting authority with a valid warrant issued by the prosecuting authority or courts.

Video surveillance – Gym and ‘private’ areas:
Student sports only has video surveillance in access-controlled areas. Areas such as cloakrooms, gym rooms and other places where one could expect privacy and discretion are not covered by video surveillance.

Video surveillance of Kraft sports centre Narvik:
The centre has a surveillance camera without microphones/sound at the entrance and five cameras in the gym rooms.

Employees working at the centre’s reception have access to see images from all the cameras. The recordings are done at reception. Three employees have currently undergone training and have access to see the recordings.

Employees:
Samskipnaden processes information about employees to attend to all aspects of an employment relationship. As a minimum, basic data (the employee’s name, personal identity number, address, telephone number and e-mail address) are registered. In addition, necessary information about payment of salary, salary level, time registration, tax details, trade union affiliation, next-of-kin, follow-up of absence, insurance and pension matters are also registered. The information is obtained from the organisation, public authorities and the employee himself/herself.

The lawfulness of processing for this is Article 6 (1) (b) of GDPR. The processing is necessary for the performance of a contract to which the data subject is party and to attend to an employment relationship.

Necessary and statutory personal data is disclosed to public bodies and partners in relation to the Norwegian Labour and Welfare Administration (NAV), Police, tax, tax assessment, enforcement office, bank, insurance, trade union, pension and the like to attend to employees’ interests and/or comply with statutory tasks.

Procedures related to deletion of personnel data comply with the provisions of the Accounting Act and the new Personal Data Act. Information about name, position and line of work are considered public information and can be published on our website.

All former and current employees have a personnel file in our records management system. When the employment relationship ends, all information that is no longer relevant is cleared from the files. Access to the files is limited to service-related requirements.

Job applicants
Samskipnaden utilises Visma EasyCruit as our recruitment solution.

The lawfulness of processing for this is Article 6 (1) (b) of GDPR. The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. If an application contains special categories of personal data, the lawfulness of processing is Article 9 (2) (b) and (h).

Only data about the person appointed to the job is transferred to the internal systems for employees. The other applicants are deleted automatically after six months.

Users of Samskipnaden’s loyalty programme:
Retail Solution AS is Samskipnaden’s data processor for user accounts in RSPOS Backoffice, while Feed AS is Samskipnaden’s data processor on samskipnaden.no.

Registration of a user account in Samskipnaden’s loyalty programme occurs via “My page” on Samskipnaden.no and given consent to “My perks”.

Samskipnaden processes personal data that are necessary for registered users, or to implement measures at the request of the registered user in relation to an agreement on the use of Samskipnaden’s loyalty programme. Samskipnaden does not share personal data with Retail Solution. Identification occurs via an identification code that can identify the users in Samskipnaden’s database.

Users of Samskipnaden’s kindergartens:
Admission occurs through the municipalities’ kindergarten systems and follows the municipality’s guidelines.

Samskipnaden processes personal data in accordance with Article 6 (1) (b) of GDPR – the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract concerning a kindergarten place.

Personal data is also processed in accordance with other legislation and statutory requirements from public bodies.

Users of Samskipnaden’s health services:
Services that are covered by health legislation (Health Records Act) are processed in accordance with this legislation and kept separate from Samskipnaden’s other data.

Use of counselling services and courses requires that when a user makes an appointment/registers for a course, he/she must consent to Samskipnaden collecting their personal data.

Users of Health & Counselling and Student Life’s course booking service:

AFFY is Samskipnaden’s data processor and provider for Health & Counselling, and Student Life’s course booking system. This is a web-based service where students can register for courses run by Samskipnaden. By attending courses, personal data provided at the time of registration will be stored for up to 90 days after the end of the course, after which personal data will be anonymized for historical reporting. When registering for Samskipnaden’s course, the user must consent to Samskipnaden collecting necessary personal data.