NILU’s privacy policy

1. Contact persons at current and potential corporate and institutional clients

We process information about contact persons at established and potential future corporate and institutional clients to follow up on tenders, applications, orders and projects/deliveries.

Personal information is processed based on our legitimate interest, namely the need to offer and follow up on our services and products. We archive and share information when we are legally obliged to do so, for example under the Bookkeeping Act and the Tax Administration Act.

Providing us with contact details is voluntary for contact persons, but we occasionally require certain information prior to entering into an agreement. If we request personal information from a third party, it is usually contact details, position, function, and employer. The source of this information is usually the contact person’s employer.

We can save information as long as we consider that we may have use for it, for instance to document circumstances related to tenders, applications, and project implementation.

2. Contact persons at current and potential suppliers

We process information about contact persons at established and potential future suppliers for preparation, administration, documentation and follow up.

Personal information is processed based on our legitimate interest, namely the need to purchase goods and services. We archive and share information when we are legally obliged to do so, for example under the Bookkeeping Act and the Tax Administration Act.

Providing us with contact details is voluntary for contact persons, but we occasionally require certain information prior to entering into an agreement.

We can save information as long as we consider that we may have use for it, for instance to document circumstances around purchasing.

3. Contact persons at agencies in the public sector

We process personal information about some contact persons at some public sector agencies, for instance in connection with our possible obligations and rights in public matters (e.g. vis-a-vis NAV, the Norwegian Labour and Welfare Service).

Personal information is processed based on our legitimate interest, namely the need to follow up on our obligations and rights.

We can save information as long as we consider that we may have use for it, for instance to document circumstances surrounding the handling of cases.

4. Persons included in research projects

NILU will occasionally be responsible for research projects in which various types of personal information are collected. This can range from conventional personal data such as contact details (name, address, email, telephone number) and “background variables” such as age and sex, to tracking of movements and health data. All research projects involving plans to collect personal data must, according to our policy guidelines, be reported to the Norwegian Centre for Research Data (NSD) before the project is initiated. NSD will evaluate whether NILUs data processing is lawful. NSD gives advice according to an agreement between NILU and NSD for privacy protection services aimed at ensuring that research projects are carried out in compliance with the General Data Protection Regulation, personal data regulations, and regulations pertaining to privacy within health care.

5. Employees

We process personal information about our employees to administrate our personnel, organise our operations, and comply with Norwegian law.

Personal information is processed based on our legitimate interests arising from our capacity as employer. We also process information because we are legally required to do so, for example to share and archive information according to the Bookkeeping Act, the Tax Administration Act and the laws regarding reporting of employment, salary, etc. We must process a few types of personal information to live up to obligations set forth in contracts with employees.

Employees are required to provide the information we need for the purposes described above.

NILU stores this information in electronic and paper archives. The information is available only to the Human Resource Department and the employee’s immediate supervisor. Information about name and contact details is available to other employees. We store this information as long as the person is employed at NILU.

Personal information required to administer payment of salaries, holiday benefits, reimbursements and other benefits, and for reports to public authorities concerning our personnel’s employment and income is archived electronically in our payroll and HR system, which is managed by Evry.

6. Former employees

We process personal information about former employees to enable documentation of how we fulfil our obligations as employer, should it become necessary. Information about former employees will also be evident from contracts, correspondence, and other documentation we archive and use for our operations.

Personal information is processed based on our legitimate interest in documenting case management in our capacity as employer. We also process information because we are legally required to do so, for example to share and archive information according to the Bookkeeping Act, the Tax Administration Act and the laws regarding reporting of employment, salary, etc.

We archive information related to individuals’ employment for up to two years after their employment ends. The information that an individual has been employed at NILU, and for what duration, is archived indefinitely.

7. Applicants for positions

We process personal information about job applicants to assess whether they are suitable candidates for the position they have applied for.

Personal information is processed based on our legitimate interest, namely to employ staff and document the employment process.

Providing us with information is voluntary. The information you provide will have impact on our assessment of your job application.

We archive this information for up to six months after the hiring process has been completed.

8. Your rights

Learn more about your rights concerning your personal data at the Norwegian Data Protection Authority (Datatilsynet) website.

9. Managers in charge of data handling – contact information

The HR Manager is responsible for day-to-day data processing, and the Managing Director has overall responsibility for NILU’s privacy policy.

Contact us:

NILU (company registration number 941 705 561)
Postboks 100
2027 Kjeller

You can also contact us by email nilu@nilu.no  or phone +47 63 89 80 00

Our data management partners:

NILU uses the following data management systems and firms to process personal data: