Website under construction
Website under construction
hkdir.no/en is still being filled with content and functionality. There will be missing content and you may experience that something is not working as it should.
This privacy policy provides information on how The Directorate for Higher Education and Skills (HK-dir) collects and uses personal data about you when you use our various services, or otherwise are in contact with us.
Recently edited : 8. juni 2023Below is an overview of contexts in which HK-dir collects and processes personal data , which purposes and legal basis apply to our processing, how we process the data, and what rights you have when we process personal data relating to you.
In general, personal data about you may be received and processed by HK-dir when:
For some of our service areas, we have specific privacy policies that provide more concrete information about how your privacy is safeguarded:
If you have questions about whether we process your personal data in contexts other than those mentioned above, please contact our data protection officer.
When you visit websites/online services that HK-dir operates, we use various digital tools to analyse your use of the websites/services. This may involve us logging the IP address of the device you use when you visit our websites, as well as information about how the websites/services are used (e.g. which pages are visited, how long the visit lasts, which links are opened, which search terms are used, etc.). This kind of logging takes place i.a. via the use of "cookies", which you may choose whether to be used during your visits to our website .
The purpose of such logging/use of cookies is to collect usage statistics that can help us to facilitate good functionality, and to further develop our websites/services. The information is not linked directly to you as a person and is deleted after the shortest possible interval.
The legal basis for this processing is the General Data Protection Regulation (GDPR) article 6, para. 1, letter f), which allows processing of information necessary to safeguard a legitimate interest that outweighs the individual's need for privacy. The legitimate interest is to operate and develop our websites/services.
Cameras and microphones are installed at the entrances to our various premises, which are activated when the doorbell is rung. The image of the entrance is displayed in real time and is not saved. In addition, visitors will have to register with their name, organisational affiliation and telephone number. The information is stored on HK-dir's servers and used to ensure a safe and efficient reception of visitors, as well as to protect them in the event of fire etc. The information is deleted after the shortest possible interval.
The legal basis for this processing is GDPR article 6, para. 1, letter d) and f), which allows the processing of information that is necessary to safeguard the data subject's vital interests (in the event of a fire etc.), as well as to safeguard a legitimate interest that outweighs the individual's need for privacy. The legitimate interest is to secure access to HK-dir's premises.
When organising courses, seminars and conferences, HK-dir uses various registration systems to manage registration. In such registration systems we may collect inter alia names, e-mail addresses, titles/organisational affiliations, payment details, health information (food allergies, need for accommodation) and information related to hotel reservations. The information is exclusively used to manage registration and implementation of the events in question and is deleted when the event has been completed. Various system and service providers' access to such personal data is secured through data processing agreements.
The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of information necessary in order to take steps at the request of the data subject prior to entering into a contract. For processing of special categories of personal data , the legal basis is GDPR art. 9, para. 2, letter g).
When newsletters and various forms of information material are ordered, HK-dir registers e-mail addresses, postal addresses and the necessary contact information to ensure due delivery of such letters/such material. Access to such information is restricted and the information is not shared with others, and it is deleted when it is no longer needed. HK-dir enters into data processing agreements with suppliers of systems/services we use to ensure such deliveries.
The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of data necessary for the performance of a contract to which the data subject is party/in order to take steps at the request of the data subject prior to entering into a contract.
When we carry out surveys, we will always provide information about their specific purpose, as well as other relevant information for you as a data subject. Information that is statistically relevant may be stored for later use by us or others, cf. Personal Data Act § 8. In the event of such later use, we ensure that the processing is limited as far as possible (data minimisation), and that the information is no longer linked to you as person (pseudonymisation/de-identification), cf. art. 5, para. 1, letter c) and art. 89, para. 1. Various system and service providers' access to personal data in connection with the implementation/analysis of such investigations, is secured through data processing agreements.
The legal basis for this processing is GDPR article 6, para. 1, letter a), which allows processing of data that the data subject has consented to being processed. Consent in line with art. 7 is obtained in connection with individual surveys. Consents may be withdrawn in line with the same provision.
HK-dir administer several different application-based public services, which inter alia may lead to the granting of grants/benefits, approvals of various kinds, prizes/awards, etc. In order to ensure proper administration of such public services, it is necessary to collect various information and personal data. Which data is needed will depend on the specific aims of the individual service.
For services aimed at organisations, the processing will typically involve personal information and contact details for the persons involved in the application, their positions/roles, organizational affiliations, as well as information relating to their relevant work experience and competence (CV) and various opinions/assessments expressed in applications. For services aimed at private individuals, the processing will typically involve personal information/contact details of the applicant, information on his/her educational background, work experience, position/role, account information and personal opinions/assessments expressed in the application. For services aimed at people under 18 years of age, we will also obtain personal details/contact details and various assessments/consent etc. from their legal guardians. More specific information about the data processed will be provided through information/application forms etc. made available in connection with the service in question.
Data that is processed in connection with such services will be stored in various electronic application and reporting systems and archived in line with applicable Norwegian archive regulations. In matters where we use automated decisions, we will provide more detailed information about this to those affected by such automation, cf. arts. 13, para. 2, letter f) and 22. Information of statistical relevance may be stored for later use by us or others, cf. Personal Data Act § 8. In the case of such later use, we will ensure that the processing is limited as far as possible (data minimisation), and that the information is no longer linked to you as a person (pseudonymisation/de-identification), cf. arts. 5, para. 1, letter c) and 89, para. 1. Various system and service providers' access to personal data in connection with case handling etc., is secured through data processing agreements.
The legal basis for this processing is GDPR article 6, para. 1, letter e), which allows processing of data necessary in the exercise of official authority vested in the controller. The supplementary legal basis for this processing is the Public Administration Act § 17. For some services, there may also be other supplementary legal bases in other acts/regulations. In cases where the processing also covers special categories of personal data , the legal basis is art. 9, para. 2, letter g).
When you contact us for information or guidance, we process such personal data that is necessary for us to be able to respond to your inquiry. If you call us, we will save your telephone number and the time of the call and archive our notes if the call concerns a specific matter. If you contact us via e-mail or via an online system, we will store your inquiry in our e-mail servers/online system until the handling of the relevant matter has been resolved and it has been archived in accordance with the applicable Norwegian archive regulations. We also use TLS encryption for our email communications.
The legal basis for this processing is GDPR article 6, para. 1, letter e), which allows processing of data necessary in the exercise of official authority vested in the controller. The supplementary legal basis for this processing is the Public Administration Act § 11.
When HK-dir receives requests for access to information and formal complaints, we process personal data in order to be able to carry out our statutory duties related to such requests/complaints. This includes, among other things, contact information and other information that is necessary to be able to process the matters. For requests for access to public documents, we provide access to personal data in accordance with the Freedom of Information Act and the Public Administration Act. Such matters are archived in accordance with the applicable Norwegian archive regulations.
The legal basis for this processing is GDPR article 6, para. 1, letter e), which allows processing of data necessary in the exercise of official authority vested in the controller. The supplementary legal basis for this processing is the Public Administration Act §§ 18 ff. and 32, and the Freedom of Information Act § 29, cf. § 2.
When we engage experts to assist us with case management or participate in selection and the like, we will collect relevant various personal data to manage the engagements (personal information, contact details, educational background, account information etc.). The purpose of the processing of such information is to ensure that you receive good working conditions, that remuneration may be paid out, etc. We have data processing agreements with the suppliers of systems that we use to administer such engagements, and we never share such information with anyone other than those who have a legitimate need to access them or persons who have a right to access them. Information beyond what we have your consent to store for later use, or which we are obliged to store for purposes of archiving, bookkeeping and accounting, will be deleted when the engagements come to an end.
The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of data necessary for the performance of a contract to which the data subject is party, and art. 9, para. 2, letter b) and g) if special categories of personal data are involved.
If you apply for a job at HK-dir, we process information such as name, age, education, work experience and competences (CV), as well as such information that you provide about yourself in your application and potential interviews. All job applications are recorded in HK-dir's official archive journal, where access to personal data is limited to personnel involved in the employment process and other applicants who are entitled to such access. The applications and other documents involved in the process are archived in line with the applicable Norwegian archive regulations.
The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of data necessary in order to take steps at the request of the data subject prior to entering into a contract. If the applications include special categories of personal data , the legal basis is art. 9, para. 2, letters b) and h).
On the basis of various data sources, HK-dir prepares a wide variety of statistics relevant to our various service areas. When producing statistical analyses, we may reuse information available from previous cases and surveys etc., as well as from various external sources (e.g. Statistics Norway and Lånekassen).
The legal basis for this processing is GDPR article 6, para. 1, letter e), and the Personal Data Act § 8, jf. art. 89, para. 1 and art. 5. Unless we have a separate legal basis, we will ensure that the processing is limited as far as possible (data minimisation), and that the information is no longer linked to you as a person (pseudonymisation/de-identification), cf. arts. 5, para. 1, letter c) and 89, para. 1.
Our processing of personal data takes place almost exclusively through the use of various electronic systems for which we purchase a license from other suppliers. The information is stored either on our own servers or using servers operated by such providers (cloud services) and is deleted according to routines in line with GDPR art. 5, para. 1, letter e) and any special statutory provisions that apply to the data in question.
In connection with the operation and maintenance of such systems, the supplier who owns the system will often have to be given a certain amount of access to the data processed in the system. The processing of such suppliers is secured through data processing agreements with each individual supplier.
HK-dir only permit transfer of personal data to actors located outside the EU/EEA in exceptional cases, and only when there is a sufficient legal basis for the transfer and after we have made sure that the privacy of data subjects is adequately safeguarded in line with the requirements of GDPR chapter V.
Apart from such instances as mentioned above, HK-dir does not share your personal data with anyone unless we have a legal obligation to do so. Such obligations to share personal data may for instance exist towards the Norwegian tax authorities, NAV, Statistics Norway, the police, the armed forces, UDI, IMDi, various ministries and municipalities/county municipalities.
When HK-dir stores and processes your personal data, you have several rights that is intended to enable you to control that our processing is legitimate and correct:
For more infomation on your rights, please see the European Commissions’ information pages .
We kindly ask that questions and requests concerning our processing of personal data is directed to our Data Protection Officer. Requests will be answered free of cost and latest within 30 calendar days.