This privacy statement was last updated on 2 October 2018.
1. About this privacy statement
The Student Welfare Organisation of Southeast Norway (SSN) is a standalone legal entity subject to the Student Welfare Organisations Act (LOV-2007-12-14-116 with subsequent amendments). Pursuant to this act, SSN’s purpose is to take care of students’ welfare needs at individual educational institutions. Student welfare organisations must offer services to students. Student welfare organisations may also offer services to non-students in a limited capacity.
In order to conduct its business, SSN may, pursuant to the Student Welfare Organisations Act, form or play a part in a company. Companies where SSN owns sufficient shares or interests that they have a majority of the votes are considered subsidiaries. This privacy statement applies to SSN and SSN’s subsidiaries.
This privacy statement covers how data collected by SSN, including personal data, is processed, shared and stored in connection with SSN’s communications with you, including your use of My Page (accommodation system, medical expense refunds), specialist systems for our business areas and on our website www.ssn.no, all hereinafter referred to as “SSN services”.
Personal data processing manager (data processor):
Student Welfare Organisation of Southeast Norway (SSN)
Organisation no. 914 458 811
Raveien 189 B
2. Purpose of collecting personal data
To offer all our customers the best services possible, make service offerings and information on these accessible, and make it easy for customers to manage their overall customer relationship with SSN, SSN collects, processes and stores personal data about its customers.
The purpose of collecting this data is to offer you the best possible level of service and give you an overview of and data on your student offers, membership, applications, agreements and rental terms through SSN. SSN services allow you to organise your student life digitally, including services linked to student accommodation, kindergartens, fitness and other student activities.
This privacy statement explains how we process your personal data in order to fulfil the aforementioned objectives. It is important that you familiarise yourself with this statement, as your use of SSN services requires us to process personal data about you.
Your personal data will be processed in compliance with the Personal Data Act, the EU General Data Protection Regulation, the Accounting Act and any other applicable laws. Where collection, processing and storage is prohibited by law or regulations, or is specified in the agreements and contracts you enter into as a customer, we will obtain your consent.
3. Your rights
SSN is required to follow applicable data protection rules. These rules give you the right to:
• Withdraw and modify your consent.
• Have personal data we no longer need deleted from our records and systems.
• Have incorrect personal data corrected.
• Know what personal data we have stored about you in our computer systems.
• Request that the data SSN holds on you be transferred to a third party of your choice.
• Complain to the Norwegian Data Protection Authority if you believe that SSN is not processing your data legally.
You can arrange to find out what data we hold on you, request correction and deletion of data, and modify your consent through your user account at www.ssn.no or by contacting SSN Student Services.
4. Which data we collect and process
If your customer relationship with SSN extends beyond paying semester fees, a brief overview of the personal data we collect, process and store in relation to the agreements, contracts and customer relationships you have entered into with us is given below.
• Tenants in student accommodation: By signing a tenancy agreement, you give SSN the right to process and store personal data. This data will be stored for three years after termination of your tenancy. If you apply for accommodation but do not receive an allocation, we will store your application until you delete it yourself and for a maximum of two months. Detailed information about how we process your data if you are a tenant of SSN Accommodation can be found separately under information on our processing of tenants’ data.
• Members of SSN Moov: By signing a fitness agreement, you give SSN the right to process and store personal data about your customer relationship. This data is stored with our member system contractor Online EDB AS. If we need to store fitness data on you, we will ask for your specific consent to do so.
• Users of SSN health services: Services subject to health regulations (the Health Records Act) are treated in accordance with these regulations and kept separate from SSN’s other data. Users of health services and courses consent to SSN collecting necessary personal data through agreements or by signing up to courses.
• Users of SSN kindergartens: Admissions are made through the respective municipality’s kindergarten system, and follow municipal guidelines. Everyone who is a customer of our childcare services consents to SSN collecting personal data relevant to their customer relationship at our kindergartens.
• Registering for My Page: When you register for My Page, you will be asked to open a user account and provide data such as your name, address, telephone number and email address. SSN will be able to collect data on your subsequent use of your user account, geographic location, IP address, data from cookies and diagnostic data. This data is used for statistical and data analysis purposes.
We store historic data related to your responses (opening and clicking on links) to digital marketing, emails, text messages and activity while logged into My Page. You can request that your history be deleted at any time by contacting us (email). Data will be automatically deleted as per item 6 (archiving and deletion of personal data).
SSN uses Google Analytics, which collects data on activity in SSN’s web-based services. This data is used for statistical and data analysis purposes.
5. How SSN uses your data
Data we collect, data you have submitted yourself and data that emerges over the course of the customer relationship is used to fulfil our agreements with you and improve and develop SSN services.
SSN uses data to provide you with offers and communications in accordance with the consent you have given. You can withdraw your consent at any time. We will then delete the data that was stored in connection with your previous consent for the purpose in question. We may, through active consent, or as part of the relevant customer relationship:
• Use your contact details to send you information and invite you to evaluate how satisfied you were with SSN services.
• Send offers for SSN services and other enquiries from SSN for marketing purposes directly in SSN services and to other contact channels you have registered with SSN services such as your email address and telephone number.
• Use your personal data and anonymised data on your use of our services to help us make decisions about sales, marketing and product development.
6. Archiving and deletion of personal data
If you no longer pay semester fees to SSN and no longer use any of SSN’s services, SSN will hold your personal data for a limited period once the customer relationship has been terminated. After that, all data about you will be deleted, apart from data required to be stored by the Accounting Act and any other legislation.
Deletion will take place automatically and is verified annually by the data controller.
7. Data controller
Under the Personal Data Act, SSN has the role of a data controller. SSN’s CEO is authorised to act as data controller on behalf of SSN and its subsidiaries. Data controller duties for different service offerings may be delegated to the managers of the relevant service areas.
If data on you is provided to SSN’s service providers, the service provider will be the data processor for the data in question, and SSN will take responsibility for the data processor’s processing of personal data through separate data processor agreements.
8. Who SSN shares data with (transfer)
SSN may, in certain cases and as governed by law, provide data to the authorities and associated educational institutions. SSN will not share your personal data for commercial or marketing purposes without your prior consent.
9. Who processes your data (data processors)
SSN may use contractors to deliver, develop and improve SSN services. These contractors are not permitted to use personal data for other purposes. In these cases, the contractor will act as data processor and SSN as data controller. SSN will enter into data processor agreements with all data processors who receive, process or store personal data supplied by SSN.
We use multiple different IT systems and techniques to keep your data secure when it is sent from you online to our servers. All data and files uploaded to SSN services are encrypted when uploaded to our databases.
11. Social media
SSN publishes news on Facebook and at www.ssn.no. SSN will not post personal data on these sites. SSN will be able to use feedback from customers to further refine our services.
Social media features are run by either a third party or directly on our website. Your use of such features is subject to the privacy statement of the company providing them.
SSN may amend its consent terms and conditions and privacy statement in order to comply with new legal requirements, and on the basis of changes to our own personal data collection and processing procedures. For amendments that require consent, you will be asked to agree to our new terms and conditions when you log in to ssn.no before the amendments take effect. Data about other amendments will be published at www.ssn.no.
13. Your rights
As an SSN user, you can rest assured that SSN takes responsibility for protecting your personal data. You can be confident that we collect, use and protect your personal data in a secure and safe manner.
• To be open about how we collect, use and store your personal data.
• To only use your personal data for the purpose for which we collected it.
• To not collect or process more data on you than we need to be able to offer you SSN services, or for anything other than what you have consented to.
As a registered SSN user and pursuant to the Personal Data Act, you have the right to know what personal data we hold on you and to have your data corrected, deleted or transferred as long as this does not violate other laws.
You can manage your consent and options under options and enquiries on My Page when you are logged in to ssn.no. While logged in, you can also view your personal data and customer history.
To view any other stored data, contact SSN customer services. You should also contact SSN customer services if you wish to have your personal data corrected, deleted or transferred.
14. Personal data for employees
SSN processes data about employees in order to safeguard all aspects of an employment relationship. The purpose of the processing of personal data in the central system is to safeguard your employment rights, to fulfil our obligations and duties as an employer, and to enable you to be able to do the job you are employed to do.
As a minimum, our systems record basic data (name, social security number, address, telephone number and email address). In addition, data essential for the payment of wages is recorded, as well as data about salary level, time keeping, tax information, and trade union affiliations, next of kin, absence monitoring, insurance and pension issues. The data is collected from the business, public authorities and the employee themselves
The basis for this is Article 6, no. 1 b) of the Regulations relating to personal data: The processing is essential in order to fulfil an agreement the data subject is party to, as well as to safeguard an employee relationship. Essential and statutory personal data is disclosed to public authorities and to partners concerning the Norwegian Labour and Welfare Administration, police, tax, tax assessment, enforcement, bank, insurance, trade union, pension, and the like in order to safeguard the interests of employee and/or to comply with statutory obligations.
Routines for the deletion of personal data are in accordance with the Accounting Act and the new Personal Data Act. Data such as name, position and work area are considered to be public information, and can be published on our website.
All previous and current employees have a personnel folder in our archive system. Content that is no longer relevant is removed when the employment relationship is terminated. Access is limited on a need-to-know basis
15. Personal data for job seekers
SSN uses Jobbnorge as a recruitment system.
The basis for this is Article 6, no. 1 b) of the Regulations relating to personal data: The processing is essential in order to fulfil an agreement the data subject is party to, or to implement measures on the request of the person registered prior to signing an agreement. If your application contains special categories of personal data, the basis is Article 9 no. 2 B) and h) of the Regulations relating to personal data.
Only the person who gets the job will be transferred to the internal systems for employees.
If you have any questions about our processing, you can send an email to [email protected] with the subject line “Personal data”.
If you have any queries about the processing of personal data at SSN, you can contact us on [email protected]
You can file a complaint about how SSN is processing your personal data with: