Privacy statement
Volda University College processes a range of personal data about students and employees. The Personal Data Act sets requirements for how this should be done. The law also has requirements for everyone who comes into contact with personal data and all systems that handle such information. Personal data is defined in Article 4 of the GDPR, point 1.
A privacy policy explains how we process personal data about you. The university director is responsible for Volda University College’s processing of personal data. The responsibilities of the data controller are delegated to system owners/middle managers and leaders. Privacy policies for various systems are published on the systems’ pages. In addition, there are specific declarations for students and employees.
Your rights related to the processing of personal data.
Right to information and access
You can request a copy of all information about you, including electronic traces and metadata.
You also have the right to receive information about how we process your personal data, as outlined in this privacy policy.
It is free to access this information, and you can contact the data controller.
Right to correction
If your personal data is incorrect or incomplete, you have the right to have it corrected or supplemented.
If you believe we have registered incorrect or incomplete personal data about you, please contact the data controller.
It is important that you provide reasons or, if possible, documentation for why you believe the personal data is incorrect or incomplete.
Right to restrict processing
In some cases, you may have the right to request that the processing of your personal data be restricted. Restriction of personal data means that the personal data will still be stored, but further processing will be limited, either for a specific period or permanently. To have the right to request the restriction of your personal data, the conditions in the Personal Data Act and GDPR Article 18 must be met. This is assessed on a case-by-case basis. Please contact the data controller.
Right to deletion
In some cases, you have the right to request that we delete personal data about you. It must be assessed in each individual case whether personal data can be deleted. It is important that you provide reasons for why you want the personal data to be deleted. Please note that the legislation may allow us to make exceptions to the right to deletion, for example, the Archives Act, the Accounting Act, and the University and College Act.
Right to object to processing
You may have the right to object to processing if you have a specific need to stop the processing. This could be, for example, if you have a need for protection, a confidential address, or similar. The right to object depends on the legal basis for the processing and whether you have a specific need. The conditions are outlined in GDPR Article 21.
Right to complain about processing
If you believe that HVO has not processed your personal data correctly and legally, or if you believe that we have not been able to fulfill your rights, you have the opportunity to complain about the processing. Please contact the data controller. If we do not uphold your complaint, you have the opportunity to submit the complaint to the Data Protection Authority. The Data Protection Authority is responsible for ensuring that Norwegian businesses comply with the provisions of the Personal Data Act and GDPR when processing personal data.
Public administration - Duty of case processing
Volda University College is a public body and subject to the rules of public administration. This means that we must have a public archive that ensures that case processing is correct and efficient. Students, employees, and others associated with HVO will have personal data in our case/archive and professional systems. The information will vary depending on the type of case.
The legal basis for this processing is GDPR Article 6.1 c and e, PPL §8/ GDPR Article 9.2 j and g. Personal data processed in case/archive and professional systems can range from contact information to sensitive information. We have an archive plan that shows what the archive contains. Data registered in case/archive and professional systems are obtained from you when you contact HVO. All data in the case-archive system is stored in Norway. The length of storage is determined by the preservation and disposal plan that HVO has and follows the Archives Act. Data that has lost its administrative significance will be deleted/disposed of. There is strict access control of the case/archive and professional systems, which only allows those who need the personal data to see it. Logs are also kept of who accesses the systems for the various cases.
Processing of personal data about you, based on your affiliation
Data controller
Volda University College is the data controller for personal data collected and processed at HVO.
You can contact the data controller at HVO via email: ann.kristin.emblem@hivolda.no.
Data protection officer
HVO has a data protection officer who is responsible for safeguarding the privacy interests of both students and employees. The data protection officer at Volda University College is Cecilie Røeggen.
Contact via email: personvernombod@hivolda.no