1) Brief presentation of EVUweb
EVUweb is a web application that allows you to register for courses and other events and to apply for admission to Inland Norway University of Applied Sciences.
EVUweb is linked to the study administration system Common Student System (FS). This means that any data registered in EVUweb will also be stored in FS. In various contexts, data stored in FS is shared with a number of different parties/institutions. Please cf. the privacy policy for FS.
2) What is a privacy policy?
This privacy policy describes how Inland Norway University of Applied Sciences manages your personal data in the EVUweb. The purpose of this privacy policy is to inform you of the types of personal data processed, how it is processed, who is responsible for the processing, your rights and whom to contact.
3) What is considered personal data?
The term personal data includes any data, information and assessment that can be linked to you as an individual, cf. GDPR Article 4 no. 1. The determining factor in whether data is considered personal information, is whether it is fit to identify a specific person.
In some cases, data which, on its own, cannot be linked to an individual person, may constitute personal data if it is used in combination with other data.
4) The purpose of and legal basis for the processing of personal data in EVUweb
Purpose
The purpose of data processing in EVUweb is to enable you to register for courses and apply for admission to programmes of study.
Legal basis
When you apply for admission to a programme of study or course, the legal basis for data processing is Section 4-15 of the Act Relating to Universities and University Colleges and Article 6, no. 1, litra e), and no. 3, litra b), of the GDPR. This primarily applies to programmes of study and courses for which admission requirements apply, and where the institution must actively decide which applicants get an offer of admission to the programme of study or course.
When you register for a course or other events where no admission requirements or ranking of applicants apply, the legal basis for the processing is Article 6, no. 1, litra b), of the GDPR. This means that processing is necessary for the performance of a contract concerning courses etc. between you and the institution.
When someone else has registered you for a course or other event on your behalf, e.g. an employer or organization, we presume that this party has done so in agreement with you. EVUweb does allow for registration on behalf of others (enterprise registration). When you are admitted to a course in accordance with an contract between the institution and the enterprise, the legal basis for the processing of personal data will be Article 6, no. 1, litra b), of the GDPR. This means that processing is necessary for the performance of a contract to which you are a party.
5) Which kinds of personal data are processed in EVUweb, and how long do we store your personal data?
Currently, no sensitive personal data about you is stored or processed in EVUweb.
We store information about your actions in EVUweb, as well as any errors related to your actions. This data is erased after a period of 6–12 months.
EVUweb may process the following information: profile information (e.g. your name, national identity number/D-number/S-number (11 digits)), contact information, information about your background, native language, application information, consents you have given, information about application options and any documents you may upload in connection with your application, admissions results and replies to offers of admission to courses or programmes of study to which you applied, and information about whether you have withdrawn your application. If your employer or any other organization has registered applications on your behalf, data about your affiliation with said organization will also be processed.
In certain circumstances, data related to your activity in the application will be logged with your participant number and, if relevant, your national identity number. This is for Unit to be able to provide assistance and troubleshooting should the need arise.
Your personal data may come from:
- You, submitted via EVUweb
- Any person or organization who has a contract with Inland Norway University of Applied Sciences. to register applications or sign up for courses or events on your behalf.
- The Common Student System (FS)
Voluntary registration
- You, submitted via EVUweb
Registration of personal data in EVUweb is voluntary, but without your personal data, we may not be able to process your applications.
Information registered without your expressed consent
2. Any person or organization who has a contract with Inland Norway University of Applied Sciences to register applications or sign up for courses or events on your behalf.
In some cases, other persons or organizations may register applications or sign up for courses or events on your behalf. This may be the case if you are doing a programme of study or course through your employer.
3. The Common Student System (FS)
In certain circumstances, it is necessary for administrative staff at Inland Norway University of Applied Sciences to register information about you in connection with your applications. Examples include assessments related to your application for admission. The actual registration will be done in the study administration system FS, and the conclusion is transferred from FS to EVUweb so that you can get access to your personal data.
6) In some cases, we process cases automatically
When you use EVUweb at Inland Norway University of Applied Sciences to apply for admission to examination-oriented courses, the administration process may be fully or partially automatic. Automatic processing is used in the following circumstances:
- calculation of eligibility for courses
- registration for lectures and examinations
7) We disclose your personal data to third parties
Disclosure or export of data is defined as any transfer of data save for use in the controller’s own systems/processing or to the data subject itself or any other party receiving data on the data subject’s behalf.
Inland Norway University of Applied Sciences may disclose or export data including personal data to other systems, i.e. external data processors, whenever it is deemed necessary.
Your personal data will not be disclosed to countries outside of the EU/EEA, or to any international organizations.
Your personal data may be disclosed to the following parties/agencies:
1) Sikt - Norwegian Agency for Shared Services in Education and Research
EVUweb is developed by Sikt. Staff at Sikt who need to access your personal data as part of their job will be granted such access. They need this access in order to provide user support and, if relevant, correct errors as part of their duties.
2) University Center for Information Technology (USIT) at the University of Oslo (UiO)
EVUweb is operated by USIT at UiO. USIT staff who need to access your personal data as part of their job will be granted such access. They need this access in order to provide user support and, if relevant, correct errors as part of their duties.
3) Other parties
Any personal data you register in EVUweb is shared with the study administration system Common Student System (FS). Please see the privacy policy for FS for more detailed information about who the recipients of personal data from FS are.
8) Personal data safety
Inland Norway University of Applied Sciences regularly perform risk and vulnerability analyses to protect your personal data in EVUweb. In addition, various security measures have been implemented, such as access control, to keep the number of people who have access to your personal data as low as possible.
9) Your rights
Right to information and access
You have the right to information about how Inland Norway University of Applied Sciences processes your personal data. The purpose of this privacy policy is to provide you with any and all information you have the right to get.
You also have the right to view/access any and all personal data registered about you at Inland Norway University of Applied Sciences. You also have the right to request a copy of the personal data registered about you if you so wish.
Right to correction
You have the right to have corrected any and all incorrect personal data about you. You also have the right to supplement any and all incomplete data registered about you. Please contact us if you believe we have registered incorrect or incomplete personal data about you. It is important that you justify and, if relevant, document why you believe the personal data registered is incorrect or incomplete.
Right to limit processing
In certain circumstances, you have the right to demand limited processing of your personal data. Limiting the processing of personal data means that your personal data will still be registered, but the opportunities for further processing are limited.
If you believe that personal data about you is incorrect or incomplete, or you have filed a complaint against the processing of your data (read more about this below), you have the right to demand to demand that the processing of your personal data be limited temporarily. This means that processing will be limited until, if relevant, we have rectified your personal data, or until we have been able to assess whether your complaint is justified.
In other circumstances you may also demand a more permanent limitation on the processing of your personal data. In order to qualify for the right to limit processing of your personal data, the conditions established by the Personal Data Act and Article 18 of the GDPR must be met. If we receive a request from you to limit processing of your personal data, we will assess whether the statutory conditions have been met.
Right to erasure
In certain circumstances you have the right to demand that we erase your personal data. The right to erasure is not unconditional, and whether this applies to your situation must be assessed in light of relevant privacy legislation, i.e. the Personal Data Act and GDPR. Please contact us if you want to have your personal data erased. It is important that you justify why you want the personal data erased, and, if possible, that you also specify which personal data you want erased. We will den consider whether the conditions for erasure, as established by law, have been met. Please be advised that the law allows for us to make exceptions to your right to erasure. For example, we may need to store personal data for the purpose of performing a task in compliance of the Act Relating to Universities and University Colleges, or for reasons of public interest, such as archiving, research and statistics.
Right to object
You may have the right to file an objection against the processing, i.e. object to the processing, on grounds that you have a specific need to stop the processing, e.g. if you have a need for protection, have a secret address, etc. The right to object is not unconditional, and it is contingent upon the legal basis for the processing, and on your particular circumstances. The conditions are established by Article 21 of the GDPR. If you object to processing of your personal data, we will consider whether the conditions for filing an objection have been met. If we find that you have the right to object to the processing and that your objection is justified, we will discontinue processing, and you will have the right to demand erasure of the data. Please be advised that we, under certain circumstances, may make exceptions from erasure, e.g. if we have to store your personal data for the purpose of performing a task in compliance with the Act Relating to Universities and University Colleges, or for reasons of public interest.
Right to file complaint against processing
If you believe we processed your personal data incorrectly or unlawfully, or if you believe we failed to protect your rights, you have the right to file a complaint against processing. Please see item 10 below for how to contact us.
If we dismiss your complaint, you may file your complaint with the Norwegian Data Protection Authority (DPA). The DPA is responsible for making sure Norwegian enterprises comply with the provisions of the Personal Data Act and the GDPR in their processing of personal data.
10) Contact information
Data controller
Inland Norway University of Applied Sciences is the data controller of personal data in EVUweb, cf. GDPR Article 4 no. 7.
If you wish to exercise your rights as established in item 9 above, please contact us at saft@inn.no. We will process your request as soon as possible and within 30 days at the latest.
Data protection officer
Inland Norway University of Applied Sciences has appointed a data protection officer whose responsibility it is to protect the personal data interests of both students and staff at Inland Norway University of Applied Sciences. You may contact the data protection officer about the administrative processing of personal data at Inland Norway University of Applied Sciences via e-mail: personvernombud@inn.no
Service provider
Sikt - Norwegian Agency for Shared Services in Education and Research is the provider of EVUweb. This means that Sikt develops and maintains EVUweb, and Sikt is also responsible for the day-to-day operation of EVUweb. As part of this task, a select few staff at Sikt have access to all personal data registered in EVUweb.
Contact information for Sikt: kontakt@sikt.no