Personvernerklæring

Last updated: 2023-06-04

User Rights

According to The Personal Data Act article 15-21, any user has rights concerning their personal data. Regarding UKA’s processing of personal data, you have the right to:

• Ask for further information about how we process your personal data.
• Delete your personal data before our deleting process, which is described below, starts.
• Limit or stop the processing of your personal data.
• Withdraw previously given consents.
• Ask for a copy of your personal data.
• Update your personal data.

If you think we process personal data that is violating The Personal Data Act, you have the right to complain to the Norwegian Data Protection Authority. You can find more information about this on the webpages of the Norwegian Data Protection Authority. Before doing this, we kindly ask you to contact us such that we may answer your questions or clear up any misunderstanding.

Information about Photography

To promote or document activities during UKA, there may be taken pictures and recorded videos at Samfundet and in Dødens dal. If you have questions or inquiries concerning this, you may contact nestleder-pr@uka.no. If you want to remove a picture from foto.samfundet.no, you may address Fotogjengen directly at fg-arkiv@samfundet.no.

Data administrator

UKA is the administrator of all data which are collected at uka.no if nothing else is described here.

Contact Information

If you have questions regarding privacy at uka.no, you may send an e-mail to personvern@uka.no.

Changes to the Privacy Statement

If the privacy statement is changed significantly, all existing consents will be invalidated.

Collected Data

Data collected from uka.no are not shared with any third party other than what is described here unless it is required by Norwegian law. Details about the collected data are given below.

Ticket Purchase

At a ticket purchase, the card number and CVC2 are processed in a PCI DSS-certified environment operated by Stripe. If you wish to read more about how Stripe processes personal data, please see Stripe’s privacy statement. We store the last four digits of the card number, the item which has been purchased, IP-address, web browser version, and e-mail address. These are stored for five years according to the Bookkeeping Act. The personal data we store are accessible to volunteers in UKA who engage in selling tickets, customer support for ticket sales, marketing research, and or developing the technical systems.

Tracking Tools

We use the data collection and analysis tool Matomo Analytics. If you consent, the tool will collect information about your visit to uka.no. This gives us statistics which makes it easier for us to target our advertising. In addition to the data processors mentioned below, the information is available to volunteers in UKA who engage in marketing research or web page development. You may at any time give or withdraw your consent by navigating to the bottom of this page.

Matomo Analytics

Our relation to Matomo as a data processor is regulated by terms for service of Matomo Analytics (2023-06-04). Data we collect are processed by InnoCraft Ltd, and are governed by Matomo’s cloud data processing agreement.

• InnuCraft is subject to the data protection rules.

• Matomo Analytics collects information about IP-addresses, website, previous website, time of visit, visit start, visit end, clicks on links for external websites, approximate position in addition to information about the web browser. Collected data are correlated with unique identificators to create a profile of the user. You may read more about what Matomo Analytics collects and why here.

• UKA owns all collected data. InnoCraft has no right to use collected data for their own purposes.

• InnoCraft relies on a few subcontractors, who are subject to the same terms in the data processing agreement as InnoCraft.

Application Process

What Data Are Collected

• All data filled in by the user during the application process are stored. This includes contact information to enable communication with the applicant and information related to the application itself to be able to conduct the interviews.

• Data about what campus the applicant is attending are collected. This is done in order to get an overview of the number of applications from each campus, which in turn enables us to make sure that all students receive sufficient information about the application to UKA, no matter what campus.

Data Storage Location

• Personal data concerning the application process are primarily stored at servers which are administrated by the IT-committee at Studentersamfundet.

Who Has Access to the Data

• Personal data are accessible to a select few volunteers in UKA who distribute the applications or develop the information retrieval system. Additionally, volunteers working with the interview process will be granted access to personal data.

• Access to this data is administered by the IT-committee and HR.

When and How the Data Are Deleted

• All personal data will be deleted from UKA’s internal systems within one week after the selection process is finished. Note that data might be stored in backup systems for up to 3 months after deletion.

Admittance

What Data Are Collected

• All data filled in by the user during an application process are stored. This includes personal information about the people for whom admittance is applied. In addition, it includes contact information of the person sending the application, such that we can communicate with the applicant. The data are collected to make admittance possible.

• Applications for admittance are rated by the application’s G-/H-weekend score. Therefore, information about senior year and/or score and score calculation is collected.

Data Storage Location

• Personal data concerning admittance applications are primarily stored at servers which are administered by the IT-committee at Studentersamfundet.

Who Has Access to the Data

• Personal data are made accessible to a selection of UKA volunteers who manage admittance or develop the application system.

• Access to this data is administered by the IT-committee.

When and How Are the Data Deleted

• All collected personal data regarding admittance will be deleted from UKA’s internal systems after the end of UKA. The deadline for deletion is 7. November in the same year that UKA is hosted.

Package Deals

What Data Are Collected

• All data filled in by the user during a package deal order are stored. This includes contact information to communicate with the user and home address to send an invoice. In addition, we store order details, including food allergies and other special requests to enable us to provide the package deal the user wants.

• For orders during G-/H-weekend data such as last year of study, field of study, and/or score and score description are stored. Orders for these dates are ranked and granted by G-/H-weekend score.

Data Storage Location

Personal data concerning package deal orders are stored primarily at servers which are administered by the IT-committee at Studentersamfundet. Furthermore, parts of the personal data are exported to spreadsheets in Google Suite. This means that the data are subjected to Google Suite’s privacy terms.

• Personal data used to generate invoices will be exported to the accountancy program Visma. The data consist of given name, surname, e-mail address, telephone number, address, postal number and order details.

Who Has Access to the Data

• Personal data are accessible for a selection of UKA volunteers who use them to organize the package deal and develop the ordering service. Personal data are never shared with a third party other than what is described here.

• Access to data stored in internal systems is administered by the IT-committee, and the spreadsheets stored on Google’s servers are restricted by the invitation system of Google Sheets. This means that one must be explicitly invited by the party manager or accounting manager to be granted read-only access, which is only given if it is necessary to organize the package deal.

When and How Are the Data Deleted

• All personal data will be deleted from UKA’s internal systems and from the Pakketilbud-gjengen's spreadsheets stored on Google operated servers when UKA ends. The deletion deadline is 1. November in the same year UKA is organized. Production databases are emptied and the spreadsheets at Google’s servers are deleted or anonymized. Note that data might be stored in backup systems up to 3 months after deletion.

• Spreadsheets processed by the Accountancy group and stored servers operated by Google will be anonymized on the 31. of May the year following UKA.

• Data stored in Visma will be stored for 5 years in accordance with the Bookkeeping Act