Privacy Policy for Noroff

For applicants, students and customers

Last amended: 25.06.2018

Contents:

  1. To whom does this document apply?
  2. What is a privacy policy?
  3. What is personal data?
  4. The purpose of, and legal basis for processing of personal data in SIS
  5. What personal data are processed in SIS and how long do we store your personal data?
  6. In some cases we conduct automated processing
  7. How long do we store your personal data?
  8. Disclosure of your personal data to third parties
  9. Security concerning your personal data
  10. Your rights
  11. Amendments
  12. Contact


1) To whom does this document apply?

The document applies to Noroff Fagskole AS and Noroff University College AS (hereinafter referred to as “Noroff”). Noroff uses the Common Student System (Felles Studentsystem, FS) and ECS (Education Community System) as its study administration systems (hereinafter SIS, when both FS and ECS are referred to).

Several applications are linked to the study administration system FS. This means that data registered in these applications are also stored in FS. Data in FS are reported to several parties/companies in various contexts. We have case officers at Noroff who process the customer’s data, while they are registered as students at our institution.


2) What is a privacy policy?

This Privacy Policy describes how Noroff manages your personal data in SIS. The purpose of this Privacy Policy is to inform you of what personal data is processed, how they are processed, who is responsible for processing, what rights you have and who you can contact.


3) What is personal data?

Personal data means all forms of data, information and assessments that can be linked to you as an individual. Crucial to whether data constitutes personal data is whether the data can identify a specific person.

In some cases, data which, on its own, cannot be linked to an individual person, may constitute personal data if it is used in combination with other data.


4) The purpose of, and legal basis for processing of personal data in SIS Purpose

The purpose of processing personal data in SIS is to protect your rights as an applicant, student or course participant, and to fulfil the institution’s tasks and obligations pursuant to the Act relating to Universities and University Colleges and Act on Vocational Colleges.

For example, processing of personal data in SIS is necessary, in order for Noroff to be able to:

  • process your application for admission to studies/exams/courses
  • conduct necessary administration regarding your studies and you as a student
  • document your educational results

Legal basis

Noroff is subject to the Act relating to Universities and University Colleges and Act on Vocational Colleges. The basis for processing is found, inter alia, in the Personal Data Act of 15 June 2018 no. 38 Section 1, cf. the General Data Protection Regulation (GDPR) (EU 2016/679), Article 6, no. 1 e and no. 3, letter b, cf. Act relating to Universities and University Colleges Section 4-15. Processing is necessary for the exercise of official authority, and to fulfil and adhere to provisions in the Act relating to Universities and University Colleges. The processing also occurs in order for the institution to be able to protect your interests as a student in the best possible manner and to fulfil its agreement with you, cf. the GDPR Art. 6, no. 1 b and Art. 6 no. 1 f. In certain cases, the institution has also chosen to supplement the legal basis with declarations of consent for the processing of certain types of data.


5) What personal data are processed in SIS?

We only process data that you have registered. Besides what you have registered, there is currently no storage or processing of sensitive personal data about you in SIS.

The following personal data may be processed in FS: profile information (such as your name, national identity number, D number/S number (11 digits), gender, contact information, information regarding your background, native language, photo, application information, consents you have provided, status (such as residence permit and police certificate where this is relevant), semester registration information, invoice information and information regarding studies and courses.

Inter alia, your personal data are obtained from:

  1. You, via the Norwegian Universities and Colleges Admission Service’s Application Portal
  2. You, via your personal pages on ECS
  3. The National Diploma Database (Nasjonal vitnemålsdatabase (NVB))
  4. Other universities/university colleges
  5. The Contact and Reservation Register
  6. Case officers at Noroff, e.g. through contact by phone
  7. The Norwegian National Registry
  8. The Norwegian State Educational Loan Fund

Optional registrations

  1. You, via the Norwegian Universities and Colleges Admission Service’s Application Portal
  2. You, via your personal pages on ECS

It is optional for you to register personal data in the Application Portal for the Norwegian Universities and Colleges Admission Service and SIS, though without your personal data, we may be unable to process your applications. In the Application Portal for the Norwegian Universities and Colleges Admission Service, you can register information about yourself regarding applications for studies/enrollment in courses. These data may be necessary in order for us to process your application and for you to be able to study at Noroff. It is stated in the Application Portal what personal data you must provide in order for us to be able to process your application.

  1. The National Diploma Database (Nasjonal vitnemålsdatabase (NVB))

If you apply for admission to Noroff via the Norwegian Universities and Colleges Admission Service, you can consent to us obtaining personal data about you from the National Diploma Database. The National Diploma Database contains most electronic diplomas from secondary schools issued in the year 2000 or later. If you give consent, we will obtain your name, national identity number (11 digits), name of school, subjects and marks.

  1. Other universities/university colleges

If you apply for admission to Noroff, and have achieved results at a different university/university college that also uses FS, you can consent to an exchange of results. If you give consent, a case officer can obtain all your results from all institutions in Norway that use FS. In practice, this means most universities and university colleges in Norway, with the exception of the Norwegian Business School BI. For more information regarding the processing of your personal data conducted by such other institutions, we refer you to the privacy policy of the concerned institution.

If you have achieved results at a university/university college outside of Norway, which participates in the EMREX cooperation, you can personally retrieve your results and forward them to Noroff. This can be done via FS and ECS.

If a Norwegian educational institution has made a decision to impose a sanction/sanctions against you which also affects your application or student situation at other Norwegian educational institutions (with a basis in the Act relating to Universities and University Colleges Sections 3-7 (8), 4-8 (1) to (3) or 4-10 (3)), Noroff will obtain personal data about you via RUST (Register for Banned Students). Only a small number of individuals at Noroff will have access to these personal data. Please see the privacy policy for RUST.

  1. The Contact and Reservation Register (KORR)

FS can obtain your email address and mobile phone number from the Contact and Reservation Register (KORR). If you do not want anyone to be able to obtain your contact information from KORR, you can make reservations against this in KORR. You can find more information on the Agency for Public Management and eGovernment website.

Registrations made without your express consent

  1. The National Diploma Database (Nasjonal vitnemålsdatabase (NVB))

If you apply for admission to Noroff via the Norwegian Universities and Colleges Admission Service, we will obtain personal data about you from the National Diploma Database. The National Diploma Database contains most electronic diplomas from secondary schools issued in the year 2000 or later. We will then obtain your name, national identity number (11 digits), name of school, subjects and marks.

  1. Case officers at Noroff

In some cases, it is necessary that case officers at Noroff register data about you related to your studies. Examples of this include assessments related to applications for admission, justifications for and complaints regarding marking or registrations related to completion of studies.

  1. The Norwegian National Registry

In order for your name and address to be correctly registered in FS, we will obtain your name and your address from the Norwegian National Registry.

  1. The Norwegian State Educational Loan Fund

The Norwegian State Educational Loan Fund lists all individuals who are customers with the Norwegian State Educational Loan Fund. They do this in order for us to know which individuals’ data should be returned to the Norwegian State Educational Loan Fund in connection with payment of loans. Please see Section 8.4 below.

  1. User administration system

In order for you to receive an online account with Noroff, and access to our IT services, your personal data are registered in a user administration system called Active Directory. We register your name, class, email and username, in addition to where you are a student (faculty/department).

  1. Finance system

At Noroff, tuition payments, course fees and other student fees are processed in Visma Software. This entails that the following data about you are sent from FS to Visma Software: Student number, name, customer group, all phone numbers, all addresses, email addresses and URLs (web addresses), if you are registered with this.


6) In some cases we conduct automated processing

When you apply for admission to Noroff, several processes in the processing of your application will be partially or entirely performed by automatic means. This may apply in the following situations:

  • assessment of whether you qualify for admission
  • calculation of credits for admission
  • offer of admission
  • control of study plan
  • creation of invoices
  • when you complete a study; calculation of achieved qualification
  • withdrawal of admission in case of low progress of studies
  • calculation of overall mark for subjects with multiple exams

You may have the right to demand that decisions based on automated processing are reviewed manually by Noroff.


7) How long do we store your personal data?

As a starting point, all your personal data in SIS are stored indefinitely. There are some exceptions:

Documents for applicants who apply via the Norwegian Universities and Colleges Admission Service and who are not offered admission to a field of study, will be deleted when the admission process is completed.

Personal data related to sanctions cf. the Act relating to Universities and University Colleges Sections 3-7 (8), 4-8 (1) to (3) or 4-10 (3), will be deleted automatically from SIS six months after the sanction period has lapsed.

If Noroff receives information that you have deceased, we will delete your contact information. Potential applications for admission, registrations for studies, courses and exams etc, will automatically be withdrawn.


8) Disclosure of your personal data to third parties

We do not disclose your personal data to third parties unless there is legal basis for such disclosure. Examples of such a legal basis may be that it is necessary in order to fulfil an agreement with you, that we use data processors who deliver services on our behalf or a basis in law requiring us to disclose the information.

Disclosure or exporting of data is defined as any surrendering of data with the exception our system/processing or to the data subject or someone who receives data on behalf of the data subject. Noroff may disclose or export data that contains personal data to other systems, i.e. to an external data processor in cases where this is considered necessary.

Your personal data will not be transferred to countries outside the EU/EEA, or to international organisations.

You personal data may be disclosed to the following parties/companies:

  1. The Norwegian Directorate for ICT and Joint Services in Higher Education and Research (Unit)
  2. The Student Welfare Organisation of Agder and Stavanger
  3. The Norwegian National Registry
  4. The Norwegian State Educational Loan Fund
  5. Bitpro (user administration systems supplier)
  6. Webstudent (LMS supplier)
  7. Effera (supplier of integration services for LMS, timetable system)
  8. Visma Software (finance system supplier)
  9. Other universities/university colleges
  10. NOKUT - Norwegian Agency for Quality Assurance in Education
  11. Micromark
  12. Statistics Norway (SSB)
  13. Norwegian Centre for Research Data (NSD), Database for Statistics on Higher Education (DBH) and the Database for Statistics on post-secondary vocational education and training (DBH-F)
  14. Other parties which, according to the Norwegian Freedom of Information Act, are entitled to access to your personal data

 

  1. The Norwegian Directorate for ICT and Joint Services in Higher Education and Research (Unit)

FS is developed by Unit. Employees at Unit who require access to your personal data as part of their job will have access to your personal data stored in FS.

  1. The Student Welfare Organisation of Agder and Stavanger

If you have paid tuition fees for the current semester, or have received an offer of admission within the past two months, the student welfare organisations in Norway can obtain personal data about you from Noroff. This is in order for them to know that you are a student and that you are entitled to student discounts on the student welfare organisations’ services. The student welfare organisation can obtain your national identity number (11 digits), your name, when you last paid tuition and the ID of your student card.

  1. The Norwegian National Registry

Noroff sends the following personal data about you to the Norwegian National Registry: name, national identity number (11 digits) and address. We do this twice a year in order to ensure that your personal data are updated.

  1. The Norwegian State Educational Loan Fund

If you are a customer with the Norwegian State Educational Loan Fund, information about you will be sent to the Norwegian State Educational Loan Fund as soon as it is registered that you are a student. The following personal data will be transferred to the Norwegian State Educational Loan Fund once every 24 hours: national identity number/D number (11 digits) and the university/university college where you have been admitted.

If you have written an exam, and/or received a pre-approval of foreign education or stays abroad, information about you will be sent to the Norwegian State Educational Loan Fund. The following personal data will be transferred to the Norwegian State Educational Loan Fund once every 24 hours: national identification number/D number (11 digits), the university/university college where you have written the exam, the result of the exam (passed/failed/not marked, if passed: also mark).

We transfer your personal data to the Norwegian State Educational Loan Fund in order for you to avoid having to document your status as a student and completed education.

  1. Bitpro (user administration systems supplier)

In order for you to receive an online account with Noroff, and access to our IT services, your personal data are registered in a user administration system called Active Directory. This system is developed and operated by Bitpro, which supplies services to Noroff. We register your name, class, email and username, in addition to where you are a student (faculty/department).

  1. Webstudent (Moodle supplier)

At Noroff, Moodle is used in the context of teaching and sometimes also for exams. This means that Webstudent, which develops and operates Moodle through supplying services to Noroff, will have access to first and last name, national identity number, gender, email address, mobile phone number, subjects and marks.

  1. Effera (supplier of integration services for LMS, timetable system)

In order for it to be possible use systems such as Moodle, personal data are transferred from SIS to the mentioned systems. Effera, which develops and operates such integration services that transfer data between systems, and which supplies services to Noroff, will have access to your personal data including first and last name, national identity number, gender, email address, mobile phone number, subjects and marks.

  1. Visma Software (finance system supplier)

At Noroff, tuition payments are processed in Visma Software. This entails that Visma Software, as a service provider for Noroff, gains access to the following personal data about you: national identity number, name and address.

  1. Other universities/university colleges

-Application for admission via the Norwegian Universities and Colleges Admission Service

When you apply for admission to Noroff via the Norwegian Universities and Colleges Admission Service, your application will in almost all cases be processed by Noroff. If you have applied for admission to one or several other universities/university colleges, it is possible that they will process your application on behalf of all the universities/university colleges to which you have applied. In such cases, they will process and store personal data about you related to your application(s). Your application will primarily contain personal data that you personally register in the Norwegian Universities and Colleges Admission Service’s application portal. The information is only stored in the portal, and we will not share your data with others.

-Consent for exchange of results

If you have achieved results from assessments and degrees from a university/university college and wish to use these results in connection with an application for admission to a different Norwegian university/university college, you may consent to an exchange of results. As soon as consent has been given, a case officer can obtain all you results from all institutions in Norway that use FS. In practice, this means most universities and university colleges in Norway, with the exception of the Norwegian Business School BI. We refer you to the institution’s privacy policy for more information regarding processing of your personal data.

-Approval of foreign studies

If you have applied for approval of foreign education, case details related to the application, including personal data about you, may be transferred to GAUS - a search service for approval of foreign studies. Other universities/university colleges in Norway have access to searching for and viewing personal data about you in GAUS. Please see the privacy policy for GAUS.

-In case of decisions regarding sanctions related to conduct

In cases where it has been registered that Noroff has made decisions regarding sanctions against you, this decision will in many cases be sent to RUST (Register for Banned Students). Sanctions may be issued as a result of one or more of the following: use of a false diploma, disruptive/harassing conduct, dangerous conduct, aggravated breach of confidentiality, gross negligence during internship or clinical instruction, cheating, attempted cheating, aiding in cheating or expulsion based on a suitability assessment. If you have applied for admission to a different Norwegian university/university college, your personal data will be sent to this university/university college. A few select staff members at this institution will be able to access your personal data. In some cases, this applies if you are registered for exams: Please see the privacy policy for RUST.

  1. NOKUT - Norwegian Agency for Quality Assurance in Education

Approval of foreign studies

If you have applied for approval of foreign education, case details related to the application, including personal data about you, may be transferred to GAUS - a search service for approval of foreign studies. NOKUT has access to searching for and viewing personal data about you in GAUS.

  1. Micromark

In order for you to be registered as a borrower at Noroff, we send personal data about you to Micromark, which supplies library services to Noroff. This only occurs when you are registered for the semester and have paid tuition. The data registered in Micromark are name, class, phone and email.

  1. Statistics Norway (SSB)

In many cases, Noroff sends redacted personal data about you to Statistics Norway for statistical purposes. This is personal data related to

  • your semester registration
  • you exam result(s)
  • your completed study programme
  • your achieved qualification(s) towards a diploma
  1. Norwegian Centre for Research Data (NSD) and Database for Statistics on Higher Education (DBH) and Database for Statistics on post-secondary vocational education and training (DBH-F)

In many cases, Noroff sends personal data about you to NSD, DBH and DBH-F for research purposes and statistics. This is personal data related to

  • your application for studies
  • your semester registration, paid tuition and enrollment(s) subject(s)
  • your completed exams
  • your achieved qualification(s)
  • your exchange(s)
  • whether you have completed credits as planned in accordance with your study plan
  1. Disclosure of personal data pursuant to the Norwegian Freedom of Information Act

If cases where Noroff receives requests for access pursuant to the provisions of the Norwegian Freedom of Information Act, the provisions in the Norwegian Personal Data Act will not necessarily limit the right of access when the request concerns personal data. It may therefore occur that Noroff sends personal data about you to parties other than those mentioned in this Privacy Policy.


9) Security concerning your personal data

Noroff conducts regular risk and vulnerability analyses to secure your personal data in SIS. Security measures have also been implemented such as access controls to ensure that only those employees who require access to your personal data are granted access. All registrations are logged with the case officer’s ID and time.


10) Your rights

Right to information and access

You have the right to receive information regarding how Noroff processes your personal data. This Privacy Policy is meant to contain the information you have the right to receive. If you would like more information than what is contained in this Privacy Policy, you may contact us (see contact information in Section 12 below).

You also have the right to view/gain access to all personal data that is registered about you at Noroff. If you so wish, you also have the right to receive a copy of personal data about you.

Right to correction

You have the right to have corrected incorrect data about you. You also have the right to supplement incomplete data registered about you. Please contact us if you believe we have registered incorrect or incomplete personal data about you. It is important that you justify and possibly document why you believe the personal data registered is incorrect or incomplete.

Right to limit processing

In certain circumstances, you have the right to demand limited processing of your personal data. Limiting the processing of personal data means that your personal data will still be registered, but the opportunities for further processing are limited.

If you believe that your personal data are incorrect or incomplete, or you have filed a complaint regarding the processing (read more about this below), you have the right to demand a temporary limitation of the processing of your personal data. This means that processing will be limited until, if applicable, we have rectified your personal data, or until we have been able to assess whether your complaint is justified.

In other circumstances you may also demand a more permanent limitation on the processing of your personal data. In order to qualify for the right to limit processing of your personal data, the conditions established by the Personal Data Act and Article 18 of the GDPR must be met. If we receive a request from you to limit processing of your personal data, we will assess whether the statutory conditions have been met.

Right to erasure

In certain circumstances you have the right to demand that we erase your personal data. The right to erasure is not unconditional, and whether this applies to your situation must be assessed in light of relevant privacy legislation, i.e. the Personal Data Act and GDPR. Please contact us if you want to have your personal data erased. It is important that you justify why you want the personal data erased, and, if possible, that you also specify which personal data you want erased. We will then consider whether the conditions for erasure, as established by law, have been met. Please be advised that in certain circumstances the law allows for us to make exceptions to your right to erasure. For example, we may need to store personal data for the purpose of performing a task in compliance of the Act relating to Universities and University Colleges, or for reasons of public interest, such as archiving, research and statistics.

In certain circumstances, you may also have the right to receive personal data we have about you in a structured, commonly used and machine-readable format and also have the right to transfer personal data about you from Noroff to different data controller (data portability).

The right to object

You may have the right to file an objection against the processing, i.e. object to the processing, on grounds that you have a specific need to stop the processing. This includes if you have a need for protection, have a secret address, etc. The right to object is not unconditional, and it is contingent upon the legal basis for the processing, and whether you have a specific need. The conditions are established by Article 21 of the GDPR. If you object to processing of your personal data, we will consider whether the conditions for filing an objection have been met. If we find that you have the right to object to the processing and that your objection is justified, we will discontinue processing, and you will also have the right to demand erasure of the data. Please be advised that we may under certain circumstances make exceptions from erasure, e.g. if we have to store your personal data for the purpose of performing a task in compliance with the Act relating to Universities and University Colleges, or for reasons of public interest.

Right to file complaint against processing

If you believe we processed your personal data incorrectly or unlawfully, or if you believe we failed to protect your rights, you have the right to file a complaint against processing. You will find more information on how to contact us under Section 12.

If we dismiss your complaint, you may file your complaint with the Norwegian Data Protection Authority (DPA). You will find information on how you can contact the Norwegian Data Protection Agency on the Data Protection Agency’s website: www.datatilsynet.no. There you can also read more about the contents of your rights.


11) Amendments

We reserve the right to amend or update the contents in this Privacy Policy. We therefore encourage you to review this Privacy Policy regularly.


12) Contact

Data controller

Noroff is the data controller of personal data in the Common Student System cf, GDPR Art. 4, no. 7.

If you wish to invoke your rights as discussed in Section 10 above, you may contact This email address is being protected from spambots. You need JavaScript enabled to view it. We will process your request without undue delay, and at the latest within 30 days.

Data protection officer

Noroff has a data protection officer who works to protect the privacy of both students and employees at Noroff. The data protection officer for administrative processing of personal data at Noroff can be reached by email: This email address is being protected from spambots. You need JavaScript enabled to view it.

 

Top