Privacy Notice & Data Protection

Last updated: November 2026

1. Data Controller Information

The data controller responsible for the processing of your personal data on this portal is:

2. Principles of Data Processing

We adhere strictly to the fundamental principles of data protection set out in Article 5 of the GDPR: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

3. Data We Collect and Why

Depending on your interaction with our research portal, we collect the following categories of data:

• Server Log Files: IP address (anonymized where feasible), browser user agent, requested URL, HTTP status code, and timestamp. Lawful basis: Legitimate interest (Art. 6(1)(f) GDPR) for network security, DDoS prevention, and server performance monitoring.
• Inquiry Form Submissions: Full name, email address, selected department, subject, and message content submitted via our contact desk. Lawful basis: Performance of pre-contractual measures or legitimate interest in responding to user communications (Art. 6(1)(b) and Art. 6(1)(f) GDPR).
• Technical Preferences: Cookie consent preference tokens stored in your browser's localStorage. Lawful basis: Compliance with legal obligations under ePrivacy regulations.

4. Data Retention Periods

We store personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Server access logs: Automatically purged after 30 days.
• Inquiry communications: Retained for up to 12 months following resolution of the query.
• Local browser preferences: Stored locally until cleared by the user.

5. Your Rights as a Data Subject

Under Articles 15 through 22 of the GDPR, you possess comprehensive rights regarding your personal data:

• Right of Access (Art. 15): You may request confirmation and a copy of personal data processed about you.
• Right to Rectification (Art. 16): You may request prompt correction of inaccurate personal data.
• Right to Erasure / Right to Be Forgotten (Art. 17): You may request deletion of your personal data where retention is no longer justified.
• Right to Restriction of Processing (Art. 18): You may request limitation of data processing under certain statutory circumstances.
• Right to Data Portability (Art. 20): You may receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You may object at any time to data processing based on legitimate interests.

To exercise any of these rights, please email our Data Desk at [email protected].

6. Right to Lodge a Complaint with a Supervisory Authority

If you believe our data processing violates applicable data protection laws, you have the right to lodge a formal complaint with the Norwegian Data Protection Authority (Datatilsynet):

Datatilsynet
Postboks 458 Sentrum, 0105 Oslo, Norway
Website: www.datatilsynet.no

7. Security Measures

We implement robust technical and organizational security measures including TLS/SSL encryption, input sanitation, strict HTTP security headers, and regular server maintenance to protect your personal data from unauthorized access, alteration, or disclosure.