Privacy Policy

The policy contains information that you are entitled to receive when Norad collects your personal data from yourself or others. The policy provides general information about how Norad processes personal data in accordance with the Norwegian Personal Data Act and the General Data Protection Regulation.

 

The policy will be updated as necessary. Norad is the data controller. 

1.0 Data Protection Officer

You can contact Norad’s Data Protection Officer, Merethe Nedrebø, with any questions you may have regarding the processing of personal data. Enquiries should be sent to merethe.nedrebo@norad.no. 

2.0 Your rights

You have the right to request access to, correction or erasure of the personal data that we process about you. You also have the right to request restricted processing and to object to processing, as well as the right to data portability.

• You can read more about these rights on the Norwegian Data Protection Authority’s website.

To exercise your rights, please email postmottak@norad.no. Your request will be answered as soon as possible and within 30 days at the latest. Please contact the Data Protection Officer if you believe that Norad has failed to comply with the rules set out in the Norwegian Data Protection Act. You also have the right to complain to the Norwegian Data Protection Authority about processing that is in breach of the data protection legislation applicable at any time.

3.0 How we receive, collect and process personal data

3.1.0 Our websites norad.no and bistandsaktuelt.no

It is possible to register for events and contact us via norad.no.

Norad publishes the paper edition of Panorama Nyheter, as well as an online edition at panoramanyheter.no. You can subscribe to the magazine here.

Providing personal data in connection with our services is voluntary for Norad website visitors.

The legal basis for processing is individual consent, unless otherwise specified. Consent is provided when registering data and can be withdrawn by de-registering from the service.

Knowit is the data processor and supplier for the development, operation and maintenance of our websites. Norad and Knowit have entered into a data processing agreement that governs the data the supplier requires access to and how such data will be processed. The data processing agreement also covers subcontractors used by Knowit when providing services to Norad.

Data collected in connection with the operation of the website is stored on dedicated servers that are administered by the supplier. Both Norad and Knowit have access to the data that are collected.

Apsis, a subcontractor of Knowit, is responsible for the email marketing solution Norad uses to send out newsletters.

3.1.1 Event registration

Norad’s open events are advertised at norad.no. When you register for an event arranged by Norad, you will provide your name, place of work, mobile phone number and email address. Other information may be requested for larger events. Providing information about allergies or food intolerances is voluntary.

We ask for this information in order to manage registrations and attendees, as well as for safety reasons. In connection with events, we may send you information both before and after the event. You can also consent to participate in evaluating the event.

Personal data submitted when registering for events will be stored in Trippus, according to a data processing agreement entered into with Norad.

The legal basis for processing is Article 6(1)(a) of the GDPR, i.e. consent.

The data you provide will be deleted by Norad after the event has ended, unless you have consented to such data being stored.

If you would like to receive emails about upcoming Norad events, you can provide your consent during registration. We will then copy your name and email address to a separate list of individuals who have asked to receive information about upcoming Norad events. You can unsubscribe from this list at any time by sending an email to webdesk@norad.no. Your consent will then be considered to have been withdrawn.

See also Section 3.3.3 Visitors to Norad below.

3.1.2 Ordering publications

You can order Norad publications from norad.no. Anyone wishing to order a publication must provide their name, postal address and email address. Whether you want to provide the name of your organisation, your phone number and any comments is voluntary.

The order information will be processed by Norad, which is responsible for shipping.

The personal data we collect when you order publications will not be used for any purposes other than to fulfil your order. All personal data will be deleted after the order has been shipped. 

The legal basis for processing is Article 6(1)(b) of the GDPR, the processing is necessary to fulfil an agreement to which the data subject is a party.

3.1.3 Newsletter

Norad may issue external newsletters via email and these can be sent from different departments.

In order to subscribe to newsletters, you need to provide your email address.

• Newsletters from Panorama Nyheter are regularly issued in accordance with Panorama Nyheter’s own privacy policy.
• Newsletters from Norad’s Department of Evaluation are issued one to three times each month. You can also choose whether you want to receive information about invitations to events and notifications of tenders with the newsletter. You need to subscribe to the newsletter to receive this information.

Invalid email addresses are deleted automatically over time.

The information you provide when you subscribe to one or more newsletters will be stored in separate lists in a dedicated database and will not be disclosed to anyone other than the data processor Knowit and its subcontractor and will be erased when you unsubscribe.

The legal basis for processing in connection with newsletters is Article 6(1)(a) of the GRPR, i.e. consent.

3.1.4. Sharing posts on Norad websites

When you share posts from norad.no or panoramanyheter.no, the data will be posted there and then to the online community you choose. How the online community processes the data will be governed by the agreement you have entered into with the online community. We do not store information about you having shared a post.

3.1.4 Searching

For norad.no, Norad will store data relating to the search terms used by users in the Find search tool.

The purpose of storing such data is to improve the information we offer. Usage patterns for searches are stored in a dedicated database in aggregated form only. Only the search terms are saved and these cannot be linked to other data relating to users, e.g. IP addresses.

The legal basis for processing is Article 6(1)(f) of the GDPR, which permits processing that is necessary for the purposes of the legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest in question is to ensure that the services on the website work as intended.

3.1.5 Web statistics

Norad collects anonymised statistics relating to norad.no visitors. The purpose of this is to generate statistics that are used to improve and further develop the information available on our websites. Some of the answers we can derive from statistics include the number of visitors to different pages, how long each session lasts, the websites users originate from and the web browsers they use.

The legal basis for processing is Article 6(1)(f) of the GDPR, which permits processing that is necessary for the purposes of legitimate interests, except where such interests are overriden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest in question is to improve our services.

3.1.6 Use of cookies

Norad uses cookies on all of its websites.

Cookies are small data files that are stored on your computer so that the service works as well as possible for you as a user.

This does not entail any security risk but you can decline to consent to the storing of cookies in your web browser at any time. See Section 3.1.8

The legal basis for processing is Article 6(1)(f) of the GDPR, which permits processing that is necessary for the purposes of legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest in question is to ensure that the service on the website works as intended.

We also use pixels for Facebook and LinkedIn. 

• Learn more about how to manage cookies at nettvett.no

 Further information about cookies

Further information about Norad’s use of cookies can be found in the cookie banner, where you can choose how to use cookies. 

3.1.7 Logging of media inquiries

The communications department at Norad processes questions and inquiries from the press. In order to provide a good service for the media, all press inquiries are logged. This means that Norad will process and store the personal information of journalists who contact us. This information  consists of name and contact information, media affiliation, and the content of questions and answers that are exchanged by phone and e-mail.
You have the right to request that personal data not be logged. You can specify this to one of the press contacts or by sending an e-mail to presse@norad.no.
Norad manages the information in accordance with the Personal Data Act.
Norad's privacy statement is here: Privacy statement (norad.no)
Act on the processing of personal data (Norwegian Personal Data Act) 

Lov om behandling av personopplysninger (personopplysningsloven) - - Lovdata (Norwegian)

 

3.2 Publications

3.2.1 Panorama Nyheter

Norad is the publisher of the paper and online editions of the news magazine Panorama Nyheter.

If you wish to subscribe to the free paper edition of Panorama Nyheter, your name, postal address and postcode will be registered in the Endurico subscriber registry so that we can send you your copy of the magazine.
Your name and address will be shared with the courier Helt hjem, which distributes the newspaper. They use the latest information available from the subscriber registry at all times.

Endurico Media is the data processor for the subscriber registry for the paper edition of Panorama Nyheter and Helt hjem is the data processor responsible for the distribution of the newspaper.

You can change the registered data or unsubscribe at panoramanyheter.no. Your data will be deleted from the registry when you unsubscribe.

The legal basis for processing is Article 6(1)(b) of the GDPR, the processing is necessary for the performance of a contract to which the data subject is a party.

The online edition of Panorama Nyheter can be found at panoramanyheter.no. You can also subscribe to the newsletter there. Further information about the processing of personal data can be found in Section 3 about our websites and in the privacy policy at panoramanyheter.no. 

3.3 Communicating with Norad

3.3.1 Messaging Norad employees

It is possible to contact Norad employees using the contact form for each department at norad.no. You will need to provide your name, email address, subject and a message body to send a message. The message will be sent via email to the individual you have selected. The message will not be stored at norad.no but is treated as a received email. See Section 3.3.3 Email and phone .

3.3.2 Visitors to Norad

All visitors to Norad must register at reception on arrival and must provide their first and last name, mobile telephone number and employer in the OnVisit system. The data will be anonymised after 15 days.

Visitors are issued with name tags that are shredded after use. 

Visitors to major events must pre-register via norad.no to speed up visitor check-in.  The individual with administrative responsibility for the event will create an overview of visitors and send this to reception. The overview will be deleted by reception after the event. 

The building is equipped with external CCTV and recordings are retained for seven days.  

The legal basis for processing is Article 6(1)(f) of the GDPR, which permits processing that is necessary for the purposes of legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest in question is to ensure access to Norad premises.

3.3.3 Email and phone

Norad uses email and phones as part of its day-to-day work to discharge our duties as an agency. This applies to communication with both internal and external contacts. Relevant data that transpires as a result of telephone calls and email exchanges as part of case management will be archived. This data is processed as described in “Case management and archiving”.

Please note that regular email is unencrypted. We therefore encourage you not to send confidential, special (sensitive) or other secret data via email.

3.3.4 Case management and archiving

Different types of personal data are recorded in the archive and case management system depending on the matter at hand. Names and email addresses are stored in the contact registry.

Information such as name, address, telephone number, email address and other relevant information from applications for grants and other enquiries associated with such applications, as well as correspondence in connection with the follow-up of aid projects, board activities and other matters, is archived as part of the respective case documents.

Norad uses the Public 360 archiving and case management system for electronic archiving and record-keeping. Registration, storage and retention take place in accordance with archives legislation. Special measures and procedures have been established for information that must be protected.

Public 360 is an archiving and case management system from the supplier Tieto and complies with the Norwegian standard for document management (NOARK). 

Information necessary for the consideration of appeals will be issued to the Norwegian Ministry of Foreign Affairs, which is Norad’s appeals body.

The legal basis for processing is Article 6(1)(b), (c) and (e) of the GDPR; necessary for implementing measures at the request of the data subject prior to entering into an agreement, fulfilling a legal obligation, cf. Sections 6 and 7 of the Public Administration Regulations. 

3.3.5 Whistleblowing

Norad has established a whistleblowing service to receive reports of suspected fraud, harassment and other misconduct relating to Norad’s activities. The whistleblowing team has a dedicated email address managed solely by the Norad whistleblowing team. Norad has also entered into a data processing agreement with Ernst & Young relating to an external whistleblowing channel. Contact details for the various whistleblowing channels can be found at norad.no/varsling.

Whistleblowing reports submitted to Norad may contain any form of personal data. Whistleblowing reports are registered in a protected area of Public 360, to which only employees affiliated with Norad’s whistleblowing team and a very limited number of archiving/ICT employees have read access. Personal data is archived in accordance with the Norwegian Archives Act but is deleted from other storage locations as soon as there is no longer any official need for such data.

3.3.6 eAccess (public record)

Norad carries out systematic and ongoing registration of all inbound and outbound case documents. The record contains details of dates, senders, recipients and the title of case documents. The daily records are transferred to eInnsyn. Individual names cannot be looked up in eInnsyn when a record is older than one year.

Please note that access requests via eInnsyn will be stored and logged.

The legal basis for processing is Article 6(1)(c) of the GDPR, necessary for compliance with a legal obligation, cf. Sections 6 and 7 of the Public Administration Regulations.

3.3.7 Surveys

Norad uses the Questback tool for surveys. When conducting surveys, we will always provide information about the purpose of the survey and whether or not it is anonymous. We will not share your data with anyone other than Questback Essentials or use the data you provide for purposes other than those stated.

• Anonymous surveys: If the survey is anonymous, neither Norad nor Questback Essentials will collect any data that can be linked to you.
• Identifiable surveys: If the survey is not anonymous, Norad may be able to identify who responded to the survey. We may also use Questback Essentials to issue surveys.

The legal basis for processing is Article 6(1)(a) of the GDPR, under which you consent to our processing of your personal data.

3.3.8 Job applicants and employment

If you apply for a job with Norad, we will need to process your personal data in order to consider your application.

The legal basis for processing is Article 6(1)(b) of the GDPR, processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. If your application contains special categories of personal data, the legal basis for processing will be Article 9(2)(b) and h) of the GDPR.

Applications are submitted via the recruitment portal WebCruiter. Applicants will receive information about Norad’s data protection practices as part of the written confirmation of the application having been received.
Recommendations with extended applicant lists and advertisement texts are stored in a separate physical employment archive.

Applications and attachments submitted by the individual appointed by Norad will be stored in the individual’s HR folder. 

The legal basis for processing is Article 6(1)(b) of the GDPR, processing is necessary for the performance of a contract to which the data subject is party.

4.0 Data processing agreements

We have entered into data processing agreements with all of our suppliers that process personal data according to an agreement with us.

5.0 Other relevant legislation

In addition to the Norwegian Personal Data Act, the following legislation also has an impact on Norad’s processing of personal data.

The Norwegian Public Administration Act and associated regulations contain the rules for when a document is made publicly available and when a document can be exempt from public disclosure. Norad practices high levels of public disclosure, which means that Norad strives to ensure that documents are publicly available wherever possible.

The Norwegian Public Administration Act includes case management rules that apply to how cases are managed at Norad. As a party to a case, e.g. as an applicant for a grant scheme, you will have special rights, including rights relating to access to case documents.

The Norwegian Archives Act sets out the rules for how archive creators must process and store case documents and how these are delivered to archiving institutions.