Cookie Policy

13. Additional information for data subjects under Norway — Personopplysningsloven (Norwegian Personal Data Act) + GDPR (EEA)

13.1 Scope of this section

This section provides additional information for individuals whose personal data is processed under the Norwegian Personal Data Act (personopplysningsloven), which makes the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), as incorporated into the Agreement on the European Economic Area (the "EEA Agreement"), applicable as Norwegian law. It applies in addition to, and not in substitution of, the rest of this Cookie Policy and our Privacy Policy.

Norway is not a member of the European Union but applies the GDPR through the EEA Agreement. References in this section to the GDPR are to the Regulation as it applies in Norway, and references to Member States include the EEA EFTA States (Iceland, Liechtenstein and Norway).

In line with the territorial scope of the GDPR, this section also applies where we offer goods or services to data subjects in the European Economic Area, or where our processing relates to monitoring the behaviour of data subjects taking place in the European Economic Area, even if we are established outside of the European Union.

13.2 Lawful bases for processing under GDPR and Norwegian law

In accordance with Article 6 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), we process your personal data only where one or more of the following lawful bases applies:

• You have given consent to the processing of your personal data for one or more specific purposes (Article 6(1)(a));
• The processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract (Article 6(1)(b));
• The processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(c));
• The processing is necessary in order to protect your vital interests or those of another natural person (Article 6(1)(d));
• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e));
• The processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms (Article 6(1)(f)).

Where we rely on legitimate interests, we have carried out a balancing exercise documented in our internal records. You may request further information about this assessment at any time.

Where we rely on Article 6(1)(c) or (e) of the GDPR, the legal obligation or public task concerned must have a basis in Norwegian law, as required by Article 6(3) of the GDPR. Where such national rules apply to a processing operation, they apply in addition to the GDPR baseline above.

13.3 Consent

Where we rely on consent as the lawful basis for processing your personal data, that consent is requested and recorded in accordance with Article 7 of the GDPR. Consent is freely given, specific, informed and unambiguous, given by a clear affirmative act, and the request is presented in a manner clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.

You may withdraw your consent at any time. Withdrawal is as easy as the original consent and does not affect the lawfulness of processing carried out before the withdrawal. Where the processing is based on consent, you will be informed before giving consent of your right to withdraw it.

13.4 Cookies and similar technologies under Norwegian law

Storing information on, or accessing information already stored on, your device (for example through cookies, pixels, local storage or similar technologies) is regulated in Norway by section 3-15 of the Norwegian Electronic Communications Act (ekomloven, LOV-2024-12-13-76), which entered into force on 1 January 2025.

In accordance with that provision, we store or access such information only with your prior consent, which must meet the requirements for consent under the GDPR, except where the storage or access is solely for the purpose of transmitting a communication over an electronic communications network or is strictly necessary to provide a service you have expressly requested. Consent can no longer be inferred from pre-set browser settings.

Compliance with this provision is supervised by the Norwegian Communications Authority (Nasjonal kommunikasjonsmyndighet, Nkom), while Datatilsynet assesses whether the information provided and the consent obtained meet the requirements of the GDPR.

13.5 Special categories of personal data, criminal convictions and national identity numbers

In accordance with Article 9 of the GDPR, we process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning sex life or sexual orientation, only where one of the conditions in Article 9(2) applies.

In Norway, the Norwegian Personal Data Act supplements those conditions. Personal data relating to criminal convictions and offences are processed only in accordance with Article 10 of the GDPR and section 11 of that Act.

Norwegian national identity numbers (fødselsnummer) and other unique means of identification are processed only where there is an objective need for secure identification and the method is necessary to achieve such identification, in accordance with section 12 of the Norwegian Personal Data Act.

13.6 Children's consent for information society services

Article 8 of the GDPR provides that, where information society services are offered directly to a child and consent is the relied-upon basis, processing is lawful only where the child is at least 16 years of age. Member States may by law provide for a lower age, provided that it is not below 13.

Section 5 of the Norwegian Personal Data Act currently sets the digital age of consent in Norway at 13 years; the Norwegian Government has proposed raising it to 15 years, and we apply the threshold in force at the time of processing. Where the data subject is below that age and consent is the relied-upon basis, we obtain consent from the holder of parental responsibility over the child and make reasonable efforts to verify it, taking into account available technology.

13.7 Information provided at collection

In accordance with Articles 13 and 14 of the GDPR, before or at the time of collecting personal data we inform you of: the identity and contact details of the controller and, where applicable, the data protection officer; the purposes of the processing and the lawful basis; the legitimate interests pursued where applicable; the recipients or categories of recipients; any intention to transfer personal data to a third country and the safeguards relied on; the retention period (or the criteria used to determine it); your rights under the GDPR; and your right to lodge a complaint with a supervisory authority.

A consolidated description of our processing activities, retention periods, recipients and your rights is set out in our Privacy Policy.

13.8 International transfers of personal data

In accordance with Articles 44 to 49 of the GDPR, we may transfer your personal data to countries or international organisations outside the European Economic Area (EEA) only where one of the following conditions is met:

• The European Commission has decided that the destination country, territory, sector or international organisation ensures an adequate level of protection (Article 45);
• The transfer is subject to appropriate safeguards under Article 46, such as Standard Contractual Clauses adopted by the European Commission, Binding Corporate Rules approved by a competent supervisory authority, or an approved code of conduct or certification mechanism;
• A specific derogation under Article 49 applies, including your explicit informed consent to the proposed transfer, the necessity of the transfer for the performance of a contract, important reasons of public interest, the establishment, exercise or defence of legal claims, or the vital interests of the data subject.

Following the Schrems II judgment of the Court of Justice of the European Union (Case C-311/18), where we rely on Standard Contractual Clauses or other safeguards we also assess the laws and practices of the destination country and apply supplementary measures where necessary to ensure an essentially equivalent level of protection.

Adequacy decisions and Standard Contractual Clauses adopted by the European Commission apply in Norway through the EEA Agreement.

13.9 Your rights under the GDPR

In accordance with Articles 15 to 22 of the GDPR, you have the following rights in respect of your personal data:

• Right of access (Art 15): to obtain confirmation of whether your personal data are being processed and, where that is the case, access to the data and to the information listed in Article 15.
• Right to rectification (Art 16): to obtain the rectification of inaccurate personal data and the completion of incomplete data.
• Right to erasure (Art 17): to obtain the erasure of your personal data without undue delay where one of the grounds in Article 17(1) applies.
• Right to restriction (Art 18): to obtain restriction of processing in the cases listed in Article 18(1).
• Right to data portability (Art 20): to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means.
• Right to object (Art 21): to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f); and at any time to object to processing for direct marketing purposes.
• Automated decision-making (Art 22): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in the cases set out in Article 22(2).
• Right to lodge a complaint (Art 77): to lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement.

These rights may be restricted where permitted by Article 23 of the GDPR and section 16 of the Norwegian Personal Data Act, for example where information is subject to a statutory duty of confidentiality or must be kept secret in the interests of national security, defence or the prevention and investigation of criminal offences.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, extendable by two further months where necessary, in accordance with Article 12 of the GDPR.

13.10 Data Protection Officer

Articles 37 to 39 of the GDPR require the designation of a Data Protection Officer where the processing is carried out by a public authority or body, where the core activities consist of processing operations which by their nature, scope or purposes require regular and systematic monitoring of data subjects on a large scale, or where the core activities consist of large-scale processing of special categories of data or data relating to criminal convictions and offences.

Where we are required (or have voluntarily chosen) to designate a Data Protection Officer, the contact details of that officer are published in our Privacy Policy and notified to the competent supervisory authority. The Data Protection Officer is the point of contact for data subjects on all issues related to the processing of their personal data and the exercise of their rights under the GDPR.

13.11 Breach notification and impact assessments

In accordance with Article 33 of the GDPR, in the event of a personal data breach we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

In accordance with Article 34, where the breach is likely to result in a high risk to your rights and freedoms, we will also communicate the breach to you without undue delay, in clear and plain language, together with the information listed in Article 34(2). Communication is not required where one of the exceptions in Article 34(3) applies.

In accordance with Article 35, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons (in particular, using new technologies, taking into account the nature, scope, context and purposes of the processing), we carry out a Data Protection Impact Assessment (DPIA) prior to the processing. Where the DPIA indicates a residual high risk that we cannot mitigate, we consult the competent supervisory authority before commencing the processing.

13.12 Penalties for non-compliance

For information only: the GDPR provides for administrative fines of up to twenty million euros (€20,000,000) or, in the case of an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83). Lower-tier fines of up to ten million euros (€10,000,000) or 2% of worldwide turnover apply to the breaches listed in Article 83(4).

In Norway, administrative fines (overtredelsesgebyr) are imposed by Datatilsynet and may also be imposed on public authorities. Decisions of Datatilsynet may be appealed to the Privacy Appeals Board (Personvernnemnda).

13.13 Supervisory authority

The supervisory authority responsible for monitoring the application of the GDPR and the Norwegian Personal Data Act in Norway is:

Datatilsynet (Norwegian Data Protection Authority)
Postboks 458 Sentrum, 0105 Oslo, Norway
https://www.datatilsynet.no/

Without prejudice to the above, you have the right to lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement, where you consider that our processing of your personal data infringes the GDPR (Article 77).