Summary of the contents of the statement
1. When does The Norwegian Helsinki Committee (NHC) collect personal information?
2. Your rights
3. What is registered when you use our website?
4. What is registered when you contact us?
5. Processing of information when in contact with us
6. Information about employees and jobseekers
7. Partner organizations
8. Financial information
9. Notifications
10. Supporters
11. Violations
12. Events
13. Retention of information
1. When does the NHC collect personal information?
We deal with information you’ve provided to us mainly for one of these reasons:
* You have signed up for an event
* You subscribe to our newsletter
* You are a supporter
* You have applied for a job with us
* You are a partner
2. Your rights
You can exercise your rights by sending an e-mail to [email protected] or by contacting our Privacy Policy Ombudsman. You are entitled to a response without undue delay and within no later than 30 days.
Access to own information
You can request a copy of all the information we process about you.
For more on the right of access: www.datatilsynet.no/en/
Correction of personal data
You may ask us to correct or supplement information that is incorrect or misleading.
For more on the right to correct or provide supplementary information: www.datatilsynet.no/en/
Deletion of personal data
In certain situations, you can ask us to delete information about yourself.
For more on the right of deletion: www.datatilsynet.no/en/
Limitation of processing of personal data
In some situations, you may also ask us to limit the processing of your personal information.
For more on the right to limit processing: www.datatilsynet.no/en/
Protest against processing of personal data
In some situations, you may have the right to object to our processing of your personal information.
For more on the right to protest against processing: www.datatilsynet.no/en/
Data portability
In some situations, you may have the right to transfer your personal information.
For more on the right to data portability www.datatilsynet.no/en/
We hope you will inform us if you believe we are not in compliance with the rules of the General Data Protection Regulation (GDPR). Please contact our Ombudsman first.
You can also object to our processing of your personal information by filing a complaint to The Norwegian Data Protection Authority (DPA). The complaint will be forwarded to the Ministry of Local Government and Modernization, which will establish a supervisory authority to deal with the matter.
3. What is recorded when using our website and social media?
Web analytics
When you visit www.nhc.no, we employ Google analytics to analyze your use of the website. The purpose of this is to develop statistics that are used to improve and further develop our information services on the site. Examples of what the statistics provide are how many people visit different pages, how long the visit lasts, which websites users come from, and which browsers they are using.
The information is processed in an unidentified and aggregated form. Unidentified means that we cannot trace the information we collect back to the individual user. In addition, IP addresses are processed at aggregated level, that is, all data is merged into a group and not processed individually.
The basis for this is the General Data Protection Regulation Article 6(1)(f), which allows us to process the information necessary to safeguard a legitimate interest which weighs heavier than the consideration of the individual’s privacy. The legitimate interest is to improve our services.
Cookies
Cookies are small text files that are placed on your computer when you download a webpage. The NHC uses cookies for different services on our website to work.
The basis for this is the General Data Protection Regulation Article 6 (1)(f), which allows us to process the information necessary to safeguard a legitimate interest which weighs heavier than the consideration of the individual’s privacy. The legitimate interest is to enable services on the website to function.
The storage of information and processing of information from cookies is not permitted unless the user of the website has been informed and has consented to the processing. The user must know and approve which information is being processed, what the purpose of the treatment is, and who is processing the information, cf. Electronic Communications Act § 2-7b. This is done in the user’s browser.
Read more about how to manage cookies (in Norwegian – nettvett.no)
Search Engine
NHC stores information about which keywords the users use. The purpose of the storage is to improve our information service. The search usage pattern is stored only in aggregate form. Only the search terms are saved and they cannot be linked to other information about the users, such as IP addresses.
The basis for this is the General Data Protection Regulation Article 6(1)(f), which allows us to process the information necessary to safeguard a legitimate interest which weighs heavier than the consideration of the individual’s privacy. The legitimate interest is to enable our website services to work.
4. What is recorded when you contact us?
Telephone
When calling the NHC, or making a direct call to one of our employees, a summary of the call will be stored in the phone log of the person you are calling. No systematic registration of phone calls is made in instances when the caller can be identified.
The basis for this is the General Data Protection Regulation Article 6 (1)(f), which allows us to process the information necessary to safeguard a legitimate interest which weighs heavier than the consideration of the individual’s privacy. The legitimate interest is to manage and operate the telephone system.
We use TLS encryption to secure our email communications. Most webmail services support this, and your e-mail communication with us will be secured. However, we ask that you do not send sensitive personal information or confidential information by email, as we cannot guarantee that your email provider supports TLS.
We scan all inbound and outbound email for viruses and malware.
The basis for this is the General Data Protection Regulation Article 6(1)(f), which allows us to process the information necessary to provide a legitimate interest that weighs heavier than the privacy of the individual. The legitimate interest is to safeguard NHC’s ICT infrastructure.
Visitors to our premises: Doorbell camera
At the street level entrance to the Helsinki Committee’s premises there is a camera with a microphone installed, which are activated when you ring the doorbell. An image of the entrance area is displayed in real time, but this cannot be recorded.
The basis for this is the General Data Protection Regulation Article 6(1)(f), which allows us to process the information necessary to safeguard a legitimate interest which weighs heavier than the consideration of the individual’s privacy. The legitimate interest is to safeguard the access to our premises.
5. Processing of information when in contact with us
When you contact us, we process information in order to reply to your question. We store the information that is necessary to respond to your enquiry. If you call us, we will record your phone number and time of the call. If you contact us by e-mail, we will record your inquiry, our reply and your e-mail address.
The basis for this is the General Data Protection Regulation Article 6(1)(e), which allows us to process information necessary for the exercise of public authority. If your inquiry contains special categories of personal information, the treatment basis of our privacy regulation is Article 9(2)(g).
This information can be shared with NHC’s sub-contractors, partners or state authorities in order to provide the services or information necessary to respond to your enquiry.
Subscribe to newsletter
NHC sends out e-mail newsletters to those who subscribe. The newsletter contains news items, information about our activities and events.
In order for us to send you e-mail newsletters, you must register an e-mail address. The email address will only be used to send newsletters, and any user surveys about the newsletter, in order to obtain feedback about what the readers need and what they think is interesting.
The email address is stored in a separate database, not shared with others, and is deleted when you choose to unsubscribe from the newsletter. You can sign up by clicking the link for this in the newsletter or by contacting us. We use a tool called Mailchimp to manage and send out the newsletter, and it is Mailchimp that manages the database where the email addresses are stored.
The processing basis for processing your e-mail address in connection with our newsletter is the General Data Protection Regulation Article 6(1)(a), i.e. consent.
When you sign up for the newsletter you will be informed about what we collect and why. By signing up for the letter you agree to our processing of your personal information.
6. Jobseekers
If you apply for a job at NHC, we need to process information about you to evaluate your application.
The basis for this is the privacy regulation Article 6(1)(b). The processing is necessary in order to fulfil an agreement to which the data subject is a party, or to act at the data subject’s request prior to contractual conclusion.
7. Partner organizations
If you belong to one of our partner organizations, we can process the following information about you: contact information and details about the partnership collaboration. The purpose is to manage the collaboration, respond to enquiries, keep an overview of our communications, and report on or otherwise promote results of joint activities.
The legal base is the General Data Protection Regulation article 6(1)(a) on consent, article 6(1)(f), on the legitimate interest in properly carrying out our obligations as a partner, and our legitimate interest in reporting and otherwise making visible the results of our collaboration, or article 6(1)(b) on the performance of a contract, to which the data subject is party; or the steps to be taken, at the request of the data subject, prior to entering into a contract.
Partner information can be shared at professional meetings, events, workshops, presentations or conferences where the NHC is engaged. Partner information can be published in NHC’s official reports, annual report, on the NHC website or the websites of projects affiliated to the NHC. In addition, we may disclose this information insofar as it may be necessary to report activities to the funders of the NHC.
8. Financial information
If you belong to a partner organization or participate as an individual in NHC activities, we may process information related to our financial transactions with you, such as contact information, bank or credit card details, and transaction details.
The purpose is to keep track of and perform agreed activities. The legal basis for this processing is Article 6(1)(b) on the execution of contracts and Article 6(1)(f) on effectively performing financial obligations.
Financial information can be shared insofar as it may be necessary to conduct audit and report on our activities. Financial information can also be shared with external platforms that process payments to the extent this is necessary in order to process NHC’s payments.
9. Notifications
We may process your personal information when we send notifications about upcoming meetings, guest visits or projects. The information may include your name, e-mail, address, place of employment or the organization that you represent. The legal basis for this processing is article 6(1)(f), on the legitimate interest in providing information relating to relevant events of professional or public interest.
10. Supporters
If you donate, we may process the following information about you: name, e-mail, address, place of employment or the organization that you represent, phone number, bank information, information relating to your donations to the NHC.
This data may be processed for the purpose of maintaining our list of supporters, communicating with you about your membership, as well as informing you about the results of our activities. The legal basis for this processing is article 6(1)(b), on the performance of a contract, to which the data subject is party, or the steps required prior to entering into a contract.
11. Human rights violations
We may process information about violations of human rights, victims, witnesses and perpetrators as part of our work.
This data may include name, date of birth, profession, passport data, photo, e-mail, address, ethnicity, religion, political views, other biographical information. Violation data may include the description and circumstances of violation, information about the extent of injury or loss, motivation behind the violation, state of health, measures of redress undertaken after the violation, legal representatives and relative’s information.
The source of violation information may be the victim or his/her legal representative, the witness to the violation, or NHC partner. We may also obtain reliable information from open sources. We may process this information to the extent necessary for the establishment, exercise or defense of legal rights and claims of the victim, or other victims in similar situations, whether in national court proceedings, administrative proceedings, international bodies or through relevant mechanisms of “soft law” (e.g. for the production of reports, declarations, letters, recommendations). The legal basis for this processing may be article 6(1)(d), on protecting vital interests, article 6(1)(e) on public interest, or article 6(1)(a) of the General Data Protection Regulation on consent.
This information can be shared with state officials and international organizations to the extent necessary for upholding the legal rights and claims of the victim or other victims in similar situations. This information may be disclosed to the public insofar as it may be necessary to demand the protection of the victim or other victims of human rights abuses. We may disclose such information insofar as it is necessary in order to provide reports on the NHC’s activities.
12. Events
If you join one of events, we may process the following information about you: name, e-mail, address, place of employment or organization, phone number, birthdate, passport data, job title or role, country, language or your preferences for the event.
This data may be processed for the purposes of arranging the event, your trip, providing relevant services, communicating with you, keeping records of these registrations, and communicating with you regarding the event.
The legal basis for this processing is the General Data Protection Regulation article 6(1)(b), on the performance of a contract, to which the data subject is party, or the steps required prior to entering into a contract.
Event information can be published in the NHC’s official reports, the NHC website, the websites of projects affiliated to the NHC. Event information can be shared with external service providers (hotels, travel agencies, airline companies) or immigration authorities insofar as it may be necessary for arranging the event or your trip.
13. Retention of information
We will keep your personal information for as long as it is necessary for the relevant project/activity/partnership to fulfil its purposes, or as long as it is set out in any agreement you may have with the NHC. In addition, the information may be retained for as long as it is necessary in order to fulfil our reporting and transparency obligations.