1.Introduction
This privacy policy applies to the Inland Norway Students’ Union (StInn) and its processing of personal data as the data controller. StInn generally does not collect personal data about individuals who do not have a relationship with StInn. Data collection typically occurs when a student is an elected representative, holds a position, or in similar situations, or when registering for an event.
Where entities other than StInn process your personal data, it will be done in accordance with this privacy policy (for further details, see the data processing agreement between StInn and INN).
This privacy policy explains how personal data is collected and how it is processed. For any questions, you can contact the Data Protection Officer at the University of Inland Norway.
2. What are personal data
Personal data refers to any form of data, information, details, or assessments that can be linked to an individual. The determining factor for whether a piece of information qualifies as personal data is whether it can identify a specific person. Information that cannot, on its own, be linked to an individual may, in cases where it appears alongside other data, constitute personal data.
3. What type of information is collected.
StInn generally does not collect personal data. Personal data that is stored is submitted by individuals who take on positions, act as elected representatives, or in similar roles, as well as during registration for events and activities.
The personal data that is collected and processed includes:
- Name
- National identification number
- Address
- Bank account number
- Student number
- Study affiliation
- Phone number
- Position/role
- Photo
Personal data collected in connection with registration for events/activities and similar:
- Name
- Email/phone
- Study affiliation
- Dietary and/or food preferences
- Position held/body represented
- Other
4. Purpose and Legal Basis for Processing
There are several purposes for the collection and processing of personal data. The purpose of StInn's processing of personal data is to carry out its mission and services in a secure and appropriate manner. This includes, among other things:
- Maintaining an overview and being able to communicate (training, meetings) with those who are or have been elected representatives, held positions, etc., and providing elected representatives with access to the necessary IT systems used
- Payment of salaries and honorariums
- Registration for events
- Processing submitted inquiries to StInn
- Marketing, publishing of text and photos in the media
- Maintaining an overview of former participants with positions and similar roles, and being able to verify these within a reasonable time after their term has ended
The legal basis for StInn's processing of personal data for those holding roles (elected representatives, positions, etc.) is that the processing is necessary to fulfill the agreement to which the data subject is a party, pursuant to GDPR Article 6(1)(b).
Furthermore, the legal basis for processing personal data for verification purposes follows GDPR Article 6(1)(f).
Personal data will not be used for marketing purposes without explicit consent, pursuant to GDPR Article 6(1)(a). Only photos for which StInn has obtained written consent will be published, shared, or archived in StInn's photo database.
5. How long personal data is stored
Personal data is not stored longer than necessary. Data that is no longer needed for the purpose for which it was collected is deleted.
6. Your Rights
When StInn has processed personal data about you, you have the right to:
- Access the information stored about you and have it provided to you
- Have incorrect personal data corrected or deleted
- Withdraw any consent given
- File a complaint with the appropriate authority (the Norwegian Data Protection Authority) if the data controller does not process personal data in accordance with applicable laws
7. Changes
Minor changes may be made to the privacy policy. Notifications will be provided in the event of significant and substantial changes.