Privacy Policy

This Privacy Policy explains how Sparebankstiftelsen DNB processes personal data when you interact with us, for example when you apply for funding, receive a grant, attend an event, carry out an assignment on our behalf, or act as a contact person for a partner or supplier.
It also describes your rights and how you can contact us.

Sparebankstiftelsen DNB is the data controller for the personal data described in this Privacy Policy. Questions concerning privacy may be directed to post@sparebankstiftelsen.no.

Why we process personal data and our legal basis

We process personal data only where we have a lawful basis under applicable data protection legislation. This may, for example, be because the processing is necessary to enter into or perform a contract with you, because we are required to comply with a legal obligation, such as accounting requirements, because you have given your consent, or because we have a legitimate interest that is not overridden by your privacy interests.

Where we rely on consent, you may withdraw your consent at any time. If we process personal data relating to children under the age of 16 where consent is required, consent must be given by a parent or guardian.

Applications, case management and grants

When you apply for funding from us, we process personal data in order to receive your application, communicate with you, assess the application and carry out the case management and decision-making process. If you receive a grant, we process personal data in order to administer the grant, follow up reporting and make payments.

As part of the application process, we may in some cases share the application and any attachments with an expert committee. The committee may include external experts who assist us in assessing the application. Information is shared only where necessary for the processing of the application. Recipients are given access only to information relevant to the assessment and are subject to confidentiality obligations.

Payments, accounting and compliance with legal requirements

We process the information necessary to make payments, including grants and any fees, manage accounting, bookkeeping and tax reporting, and document and comply with relevant legal requirements.

Events, invitations and participant administration

When we invite people to or organise events, we process personal data in order to send invitations, administer registrations and manage the practical arrangements. This may include your name and contact details, as well as information about any accessibility or other special requirements where you choose to provide it.

Contact with partners and suppliers

In order to administer partnerships and deliveries, we process contact details relating to contact persons at our partners and suppliers, such as names, email addresses, telephone numbers and places of work.

What personal data we process

The personal data we process depends on the nature of your contact with us. This may include:

Identification and account information: Your name, mobile telephone number and any other identification details you provide. For users of our application portal, BankID is used solely for login and identity verification.

Contact information: Your email address, postal address, telephone number and any relevant role or affiliation, such as the organisation you represent.

Financial and payment information: Bank account details and other information required for payments, bookkeeping and reporting, such as your date of birth. Where a fee is paid, your date of birth and/or national identity number may be required.

Images and media content: Photographs may be taken or collected as documentation of grants and events. Where photographs are to be used for purposes other than application processing, such as publication, we obtain consent where required.

Application and case information: The contents of applications, attachments, correspondence, reports, references and any other relevant information that you provide or that we receive as part of the case management process.

We ask that you do not send us special categories of personal data, also known as sensitive personal data, unless this is necessary and relevant. If such information is nevertheless included in an application or other enquiry, it will be treated confidentially and access will be restricted to persons with a legitimate work-related need.

Sources of personal data

We mainly receive personal data directly from you, for example when you submit an application, register in the application portal, register for an event or contact us.

This may include data received:

Directly from you through forms, email, telephone or other communication.
From our electronic application portal, Insights Grants, when you register and submit applications.
From third parties where relevant, such as references or information relating to payments or bookkeeping.
From public sources where necessary to verify information or comply with legal requirements.

Where we rely on consent, for example for the use of photographs beyond documentation or case management, we obtain consent before the processing takes place.

We do not use your personal data for marketing or communications you would not reasonably expect, unless you have consented to this or we have another lawful basis.

As a general rule, we do not share personal data with others except where necessary to process applications, administer grants, organise events or comply with legal obligations.

We use suppliers that process personal data on our behalf as data processors. We enter into data processing agreements and ensure that suppliers process the information only in accordance with our instructions and with appropriate information security measures.

Data processors

Examples of data processors we use include:

Machina AS – supplier of the Insights Grants application portal, which is used for registration, submission and administration of applications.

Microsoft – supplier of Microsoft 365, including email, document storage and Copilot, which is used in our internal case management and administration.

Matomo – analytics tool used on sparebankstiftelsen.no. See also the section on cookies.

Mailchimp – used to distribute newsletters.

SurveyMonkey – used to conduct surveys.

Automated decision-making and profiling

We do not use automated decision-making that produces legal effects or similarly significantly affects you, as described in Article 22 of the GDPR.

Applications are assessed and grant decisions are made by our employees. Artificial intelligence is, however, used as part of the application process, including in the application portal, to provide additional decision support to our case officers. This means that AI may assist with analysis and structuring, but the final assessment and decision are always made by people.

Use of artificial intelligence

We may use Microsoft 365 Copilot as an internal support tool, for example to prepare draft text, summarise content and work more efficiently with documents, emails and meetings.

Copilot and other AI tools may process personal data where such information forms part of the content we are working with, such as applications, attachments, correspondence or reports. AI is also used in the application portal to provide additional decision support during the application process.

Our use of Copilot and artificial intelligence is governed by our agreements with Microsoft as a data processor. Access controls are used to ensure that only persons with a legitimate work-related need have access. Content processed by Copilot is not used to train general, publicly available language models.

We are present on social media platforms such as Facebook and Instagram. When you visit or communicate with us through these platforms, the platform provider will process personal data about you for its own purposes.

We may also receive aggregated statistics and insights relating to the use of our pages. For more information about how the platform providers process personal data, please refer to their privacy policies.

Transfers outside the EU/EEA

We aim to ensure that personal data is processed within the EU/EEA.

Where personal data is transferred outside the EU/EEA in certain cases, for example through the use of subcontractors, the transfer will be based on a valid transfer mechanism under the GDPR, such as the European Commission’s Standard Contractual Clauses.

Retention and deletion

We retain personal data for as long as necessary for the purposes for which it was collected and/or for as long as we are required to retain it under applicable laws or regulations. Access to the information is restricted to persons with a legitimate work-related need.

Examples of retention periods arising from legal requirements include:

Tax reporting: At least five years where relevant.
Bookkeeping: Retention in accordance with applicable bookkeeping legislation, normally for up to ten years after the end of the financial year.

Users of the Insights Grants application portal who have shown no activity for a period of five years will be deleted.

If you no longer wish to receive invitations, you may let us know and we will remove you from the invitation list. You may also be removed from the list if you have not responded to any invitations during the previous three years.

Photographs may be stored in our image database as documentation of the Foundation’s activities, including grants and events. The retention period depends on the purpose of the image, such as documentation, historical record or publication, and on any consent obtained. Where publication is based on consent, you may withdraw your consent.

Where processing is based on consent and you withdraw your consent, or where you object to processing based on legitimate interests, we will assess your request and delete or restrict the processing where the applicable conditions are met.

Your rights

You have a number of rights under data protection legislation. The rights that apply depend on the processing and the legal basis relied upon.

These may include:

The right to access the personal data we hold about you.
The right to correct inaccurate personal data.
The right to erasure in certain circumstances.
The right to restriction of processing in certain circumstances.
The right to data portability where the applicable conditions are met.
The right to object to processing based on legitimate interests.
The right to withdraw consent where processing is based on consent.

To exercise your rights, please contact us at post@sparebankstiftelsen.no. We may ask you to verify your identity to ensure that information is provided to the correct person.

Cookies

We use cookies on sparebankstiftelsen.no to ensure that the website functions properly, improve the user experience and produce statistics.

You can manage cookies through your browser settings and delete stored cookies. For cookies that are not strictly necessary for the website to function, we ask for your consent before they are stored. You may change or withdraw your consent at any time through your browser settings.

Matomo

We use Matomo as an analytics tool to understand how the website is used, for example page views, session duration, device type and browser.

IP addresses are anonymised by removing the final digits before storage, meaning that the IP address cannot be used to identify you.

Right to lodge a complaint with the Norwegian Data Protection Authority

If you believe that our processing of your personal data is in breach of data protection legislation, you have the right to lodge a complaint with the Norwegian Data Protection Authority.

Changes to this Privacy Policy

We will update this Privacy Policy on an ongoing basis to reflect how we process your personal data.

Contact us

If you have any questions about this Privacy Policy or how we process personal data, please contact us at post@sparebankstiftelsen.no.