Privacy policy for recognition of foreign education

The managing director of The Directorate for Higher Education and Skills (HK-dir) is responsible for the processing of personal data (eur-lex.europa.eu) that we carry out in connection with such applications.

What personal data do we process when you apply for approval of foreign education?

When you apply for approval of your foreign qualifications, you must create a profile and an application in our application portal for recognition of foreign education, which both forms part of our case management system "eSam". Both when creating your own user profile and when creating applications, you will have to provide various personal details about yourself and your education. We will not ask you to provide any sensitive personal data (eur-lex.europa.eu).

In the application portal, we also ask for a power of attorney to be able to verify your education documents with the institutions you have studied at. It is voluntary to give such a power of attorney, and you may thus apply for approval without giving us this power of attorney. However, it is important to note that without such a power of attorney, uncertainty relating to your educational documents could result in your application being rejected. The reason for this is that we are not able to approve education unless we are able to ascertain that the education documents are genuine. In many cases, this may only be verified by the educational institution that issued your educational documents.

All the personal data we receive and process in connection with our processing of your application will be archived in HK-dir's archive system, in line with the Norwegian Archive Act with regulations.

Applicants for approval of higher education are kindly advised that there is a designated message function in the application portal, to be used to communicate with the case handler about your case. We encourage that all communication concerning your application take place via the use of this function, and not via e-mail or telephone. The reason for this is that this ensures proper identification of you as an applicant before we provide case related information, and that it reduces the risk of unauthorized access to personal data.

The basis for our processing of your personal data in connection with such cases is the General Data Protection Regulation article 6, para. 1) c). Processing of such information is necessary to fulfill HK-dir's statutory duties under Section 9-7 of the Act relating to Universities and University Colleges, Section 7 of the Act relating to tertiary vocational education, Section 23-3 of the Act relating to primary and secondary education (the Education Act), Section 17-3 of the regulations to the Education Act and Section 3 of the regulations on the approval of professional qualifications for foreign administrative and pedagogical managers in kindergartens.

Applicants who, for various reasons, cannot document their foreign qualification, will be offered to obtain approval of their education through an interview-based method. In order for this method of approval to be used, you will have to consent to HK-dir’s processing of personal data that you provide us with in connection with such interviews. The basis for our processing of additional personal data that we receive through such interview-based methods, is the General Data Protection Regulation article 6, para. 1) a).

What personal data do we process when organizations seek advice and “turbo assessments” from us?

When people employed in various organizations seek advice and information through our portal for advice and “turbo assessments”, we will process certain personal data that is necessary for us to be able to provide such advice (name, date of birth, contact details and institution).

The processing basis for our processing of your personal data in such case processing is the General Data Protection Regulation article 6, para. 1) c). Processing of such information is necessary to fulfill HK-dir's statutory obligations under Section § 6-1 (4) of the regulations concerning quality assurance and quality development in higher education and tertiary vocational education and Section 11 of the Public Administration Act.

What personal data do we process when you use the confirmation service for regulated professions?

When you ask us to provide confirmation of your professional qualifications, we process the personal data necessary to handle your request and issue the confirmation. This may include your name, contact details and information about your education and professional qualifications. Information about your education may be obtained from documentation that you submit or share with us, for example through the Diploma Registry (Vitnemålsportalen).

We process your personal data in order to assess your qualifications and issue the relevant confirmation. In the current information concerning confirmations for architects, teachers and kindergarten teachers, HK-dir asks for consent to process personal data for this purpose.

The information we receive and process is handled in accordance with HK-dir's procedures for the processing and archiving of personal data. The legal basis for our processing of personal data is Article 6(1)(a) of the GDPR.

What personal data do we process when you use the Ask Recognition chatbot?

Ask Recognition is a chatbot that answers general questions about the recognition of foreign education. Its answers are based on content published on hkdir.no and supplement the information available there. The chatbot is not part of our case processing. It cannot make decisions, and you cannot use it to submit or follow up an application. If you have an application with us, you should use the messaging function in the application portal.

We process the information that you enter in the conversation. This may, for example, include questions and information about your education, professional background or employment situation. It may also include names, contact details or other information about you or other people if you choose to enter such information. If you provide feedback on an answer, we also process that feedback.

You do not need to provide personal data to receive an answer. We therefore ask you not to enter names, national identity numbers, contact details, health information or other information that could identify you or other people.

We use the information for two purposes. The first is to provide the service, which means enabling the chatbot to understand your question and provide a relevant answer, as well as operating, monitoring and improving the chatbot. The second is to improve our website. The conversations show us what users have questions about and where our information is difficult to understand or incomplete. The information is not used when processing applications.

The legal basis for our processing of personal data in Ask Recognition is Article 6(1)(a) of the GDPR and supplementary legal grounds.

Storage of and access to the information

The conversations are stored for 28 days and are then deleted. The information is processed by HK-dir and by Microsoft, which provides the service through Microsoft Azure and Microsoft Copilot Studio.

Microsoft is a data processor for HK-dir and processes the information on our behalf in accordance with Microsoft's Data Protection Addendum (Microsoft Products and Services Data Protection Addendum). Microsoft uses subprocessors. An overview of these is available in Microsoft's list of subprocessors.

The information is stored and processed in Microsoft's data centres within the EU/EEA. In limited circumstances, Microsoft may transfer information outside the EU/EEA, for example for operational and security purposes. Such transfers are carried out in accordance with EU data transfer rules, including the EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

The conversations are not used to train the language models, and OpenAI does not have access to them. To detect misuse, Microsoft may retain questions and answers for up to 30 days, separately from HK-dir's own storage. We impose requirements for the secure processing of personal data.

Which rights do you have when HK-dir store and process personal data concerning yourself?

When HK-dir store and process personal data concerning yourself, you have several rights put in place to enable you to control that our processing is legitimate and correct:

• You may request access to personal data that we store/process in relation to yourself;
• You may request that personal data concerning your person is corrected/supplied if they otherwise would be erroneous or incomplete;
• You may, in certain circumstances, request that personal data about yourself is deleted;
• You may, in certain circumstances, request that our processing of your personal data shall be limited;
• You may, in certain circumstances, request that our processing of your personal data shall cease.
• You may, in certain circumstances, request that personal data we store is transferred to yourself or another data controller; and
• You may appeal our decisions to process personal data concerning yourself.

The rights available to you depend on the legal basis and purpose of the processing. When you use Ask Recognition, we do not ask you to identify yourself. This means that we will often be unable to link a particular conversation to you. If you wish to exercise your rights in relation to a conversation with the chatbot, you must therefore provide enough information for us to locate the conversation, such as the time of the conversation and its content.

See more information on your rights (eur-lex.europa.eu).

We kindly ask that questions and requests concerning our processing of personal data is directed to our Data Protection Officer. Requests will be answered free of cost and latest within 30 calendar days.