Privacy policy

Below is an overview of contexts in which HK-dir collects and processes personal data, which purposes and legal basis apply to our processing, how we process the data, and what rights you have when we process personal data relating to you.

When does HK-dir collect and process personal data?

In general, personal data about you may be received and processed by HK-dir when:

• You visit our websites or use our online services
• You visit us at our premises
• You register for courses, seminars, webinars, conferences etc. which we arrange
• You order newsletters or information material from us
• You answer surveys we carry out
• You apply under various public services/programmeswe administer
• You request information or guidance from us
• You notify us of information that we should be aware of
• You request access to documents or file a complaint in an administrative matter
• You are engaged to assist with administrative matters, participate in various committees, etc.
• You apply for employment with us
• You or your organization wish to enter into a contract with us
• We produce analyses/statistics related to our service areas

For some of our service areas, we have specific privacy policies that provide more concrete information about how your privacy is safeguarded:

• The Diploma Registry
• The Registry for approvals of foreign education
• Recognition of foreign education
• The Norwegian Universities and Colleges Admission Service (Samordnaopptak.no)
• Information service on education opportunities in Norway (Utdanning.no)
• The Norwegian Committee On Skill Needs (Kompetansebehovsutvalget)
• Data repository for the Norwegian knowledge sector (KUDAF)
• The National Coordinator of Accessibility of Higher Education in Norway (universell.no)

If you have questions about whether we process your personal data in contexts other than those mentioned above, please contact our data protection officer.

What purposes and legal basis does HK-dir have for processing your personal data?

Visits to our website/use of our online services

When you visit websites/online services that HK-dir operates, we use various digital tools to analyse your use of the websites/services. This may involve us logging the IP address of the device you use when you visit our websites, as well as information about how the websites/services are used (e.g. which pages are visited, how long the visit lasts, which links are opened, which search terms are used, etc.). This kind of logging takes place i.a. via the use of "cookies", which you may choose whether to be used during your visits to our website.

The purpose of such logging/use of cookies is to collect usage statistics that can help us to facilitate good functionality, and to further develop our websites/services. The information is not linked directly to you as a person and is deleted after the shortest possible interval.

The legal basis for this processing is the General Data Protection Regulation (GDPR) article 6, para. 1, letter f), which allows processing of information necessary to safeguard a legitimate interest that outweighs the individual's need for privacy. The legitimate interest is to operate and develop our websites/services.

Visits to our premises

Cameras and microphones are installed at the entrances to our various premises, which are activated when the doorbell is rung. The image of the entrance is displayed in real time and is not saved. In addition, visitors will have to register with their name, organisational affiliation and telephone number. The information is stored on HK-dir's servers and used to ensure a safe and efficient reception of visitors, as well as to protect them in the event of fire etc. The information is deleted after the shortest possible interval.

The legal basis for this processing is GDPR article 6, para. 1, letter d) and f), which allows the processing of information that is necessary to safeguard the data subject's vital interests (in the event of a fire etc.), as well as to safeguard a legitimate interest that outweighs the individual's need for privacy. The legitimate interest is to secure access to HK-dir's premises.

Registration for courses, seminars, webinars, conferences etc.

When organising courses, seminars and conferences, HK-dir uses various registration systems to manage registration. In such registration systems we may collect inter alia names, e-mail addresses, titles/organisational affiliations, payment details, health information (food allergies, need for accommodation) and information related to hotel reservations. The information is exclusively used to manage registration and implementation of the events in question and is deleted when the event has been completed. Various system and service providers' access to such personal data is secured through data processing agreements.

The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of information necessary in order to take steps at the request of the data subject prior to entering into a contract. For processing of special categories of personal data, the legal basis is GDPR art. 9, para. 2, letter g).

Ordering of newsletters or information material

When newsletters and various forms of information material are ordered, HK-dir registers e-mail addresses, postal addresses and the necessary contact information to ensure due delivery of such letters/such material. Access to such information is restricted and the information is not shared with others, and it is deleted when it is no longer needed. HK-dir enters into data processing agreements with suppliers of systems/services we use to ensure such deliveries.

The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of data necessary for the performance of a contract to which the data subject is party/in order to take steps at the request of the data subject prior to entering into a contract.

Data collected via surveys

When we carry out surveys, we will always provide information about their specific purpose, as well as other relevant information for you as a data subject. Information that is statistically relevant may be stored for later use by us or others, cf. Personal Data Act § 8. In the event of such later use, we ensure that the processing is limited as far as possible (data minimisation), and that the information is no longer linked to you as person (pseudonymisation/de-identification), cf. art. 5, para. 1, letter c) and art. 89, para. 1. Various system and service providers' access to personal data in connection with the implementation/analysis of such investigations, is secured through data processing agreements.

The legal basis for this processing is GDPR article 6, para. 1, letter a), which allows processing of data that the data subject has consented to being processed. Consent in line with art. 7 is obtained in connection with individual surveys. Consents may be withdrawn in line with the same provision.

Processing of data in connection our administration of public services

HK-dir administer several different application-based public services, which inter alia may lead to the granting of grants/benefits, approvals of various kinds, prizes/awards, etc. In order to ensure proper administration of such public services, it is necessary to collect various information and personal data. Which data is needed will depend on the specific aims of the individual service.

For services aimed at organisations, the processing will typically involve personal information and contact details for the persons involved in the application, their positions/roles, organizational affiliations, as well as information relating to their relevant work experience and competence (CV) and various opinions/assessments expressed in applications. For services aimed at private individuals, the processing will typically involve personal information/contact details of the applicant, information on his/her educational background, work experience, position/role, account information and personal opinions/assessments expressed in the application. For services aimed at people under 18 years of age, we will also obtain personal details/contact details and various assessments/consent etc. from their legal guardians. More specific information about the data processed will be provided through information/application forms etc. made available in connection with the service in question.

Data that is processed in connection with such services will be stored in various electronic application and reporting systems and archived in line with applicable Norwegian archive regulations. In matters where we use automated decisions, we will provide more detailed information about this to those affected by such automation, cf. arts. 13, para. 2, letter f) and 22. Information of statistical relevance may be stored for later use by us or others, cf. Personal Data Act § 8. In the case of such later use, we will ensure that the processing is limited as far as possible (data minimisation), and that the information is no longer linked to you as a person (pseudonymisation/de-identification), cf. arts. 5, para. 1, letter c) and 89, para. 1. Various system and service providers' access to personal data in connection with case handling etc., is secured through data processing agreements.

The legal basis for this processing is GDPR article 6, para. 1, letter e), which allows processing of data necessary in the exercise of official authority vested in the controller. The supplementary legal basis for this processing is the Public Administration Act § 17. For some services, there may also be other supplementary legal bases in other acts/regulations. In cases where the processing also covers special categories of personal data, the legal basis is art. 9, para. 2, letter g).

For programmes og actions under Erasmus+, HK-dir acts as a data processor for the European Commission as the data controller. This means that the European Commission is responsible for personal data collected and processed under Erasmus+. For more information om how matters of privacy are secured under Erasmus+, please be referred to the European Commission’s privacy notice.

Requests for information and guidance

When you contact us for information or guidance, we process such personal data that is necessary for us to be able to respond to your inquiry. If you call us, we will save your telephone number and the time of the call and archive our notes if the call concerns a specific matter. If you contact us via e-mail or via an online system, we will store your inquiry in our e-mail servers/online system until the handling of the relevant matter has been resolved and it has been archived in accordance with the applicable Norwegian archive regulations. We also use TLS encryption for our email communications.

The legal basis for this processing is GDPR article 6, para. 1, letter e), which allows processing of data necessary in the exercise of official authority vested in the controller. The supplementary legal basis for this processing is the Public Administration Act § 11.

Submittal of requests for information and complaints

When HK-dir receives requests for access to information and formal complaints, we process personal data in order to be able to carry out our statutory duties related to such requests/complaints. This includes, among other things, contact information and other information that is necessary to be able to process the matters. For requests for access to public documents, we provide access to personal data in accordance with the Freedom of Information Act and the Public Administration Act. Such matters are archived in accordance with the applicable Norwegian archive regulations.

The legal basis for this processing is GDPR article 6, para. 1, letter e), which allows processing of data necessary in the exercise of official authority vested in the controller. The supplementary legal basis for this processing is the Public Administration Act §§ 18 ff. and 32, and the Freedom of Information Act § 29, cf. § 2.

Engagements for assistance with administrative matters, participation in committees, etc.

When we engage experts to assist us with case management or participate in selection and the like, we will collect relevant various personal data to manage the engagements (personal information, contact details, educational background, account information etc.). The purpose of the processing of such information is to ensure that you receive good working conditions, that remuneration may be paid out, etc. We have data processing agreements with the suppliers of systems that we use to administer such engagements, and we never share such information with anyone other than those who have a legitimate need to access them or persons who have a right to access them. Information beyond what we have your consent to store for later use, or which we are obliged to store for purposes of archiving, bookkeeping and accounting, will be deleted when the engagements come to an end.

The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of data necessary for the performance of a contract to which the data subject is party, and art. 9, para. 2, letter b) and g) if special categories of personal data are involved.

Participation in employment processes

If you apply for a job at HK-dir, we process information such as name, age, education, work experience and competences (CV), as well as such information that you provide about yourself in your application and potential interviews. All job applications are recorded in HK-dir's official archive journal, where access to personal data is limited to personnel involved in the employment process and other applicants who are entitled to such access. The applications and other documents involved in the process are archived in line with the applicable Norwegian archive regulations.

The legal basis for this processing is GDPR article 6, para. 1, letter b), which allows processing of data necessary in order to take steps at the request of the data subject prior to entering into a contract. If the applications include special categories of personal data, the legal basis is art. 9, para. 2, letters b) and h).

Production of analyses/statistics

On the basis of various data sources, HK-dir prepares a wide variety of statistics relevant to our various service areas. When producing statistical analyses, we may reuse information available from previous cases and surveys etc., as well as from various external sources (e.g. Statistics Norway and Lånekassen).

The legal basis for this processing is GDPR article 6, para. 1, letter e), and the Personal Data Act § 8, jf. art. 89, para. 1 and art. 5. Unless we have a separate legal basis, we will ensure that the processing is limited as far as possible (data minimisation), and that the information is no longer linked to you as a person (pseudonymisation/de-identification), cf. arts. 5, para. 1, letter c) and 89, para. 1.

When and how is personal data stored, and which actors may HK-dir share such personal data with?

Our processing of personal data takes place almost exclusively through the use of various electronic systems for which we purchase a license from other suppliers. The information is stored either on our own servers or using servers operated by such providers (cloud services) and is deleted according to routines in line with GDPR art. 5, para. 1, letter e) and any special statutory provisions that apply to the data in question.

In connection with the operation and maintenance of such systems, the supplier who owns the system will often have to be given a certain amount of access to the data processed in the system. The processing of such suppliers is secured through data processing agreements with each individual supplier.

HK-dir only permit transfer of personal data to actors located outside the EU/EEA in exceptional cases, and only when there is a sufficient legal basis for the transfer and after we have made sure that the privacy of data subjects is adequately safeguarded in line with the requirements of GDPR chapter V.

Apart from such instances as mentioned above, HK-dir does not share your personal data with anyone unless we have a legal obligation to do so. Such obligations to share personal data may for instance exist towards the Norwegian tax authorities, NAV, Statistics Norway, the police, the armed forces, UDI, IMDi, various ministries and municipalities/county municipalities.

Which rights do you have when HK-dir store and process your personal data?

When HK-dir stores and processes your personal data, you have several rights that is intended to enable you to control that our processing is legitimate and correct:

• You may request access to personal data that we store/process in relation to yourself
• You may request that personal data concerning your person is corrected/supplied if they otherwise would be erroneous or incomplete
• You may, in certain circumstances, request that personal data about yourself is deleted
• You may, in certain circumstances, request that our processing of your personal data shall be limited
• You may, in certain circumstances, request that our processing of your personal data shall cease
• You may, in certain circumstances, request that personal data we store is transferred to yourself or another data controller
• You may appeal our decisions to process personal data concerning yourself

For more infomation on your rights, please see the European Commissions’ information pages.

We kindly ask that questions and requests concerning our processing of personal data is directed to our Data Protection Officer. Requests will be answered free of cost and latest within 30 calendar days.