Confederation of Norwegian Enterprise (NHO) Privacy Policy

Persons who contact NHO

We process personal data of persons who reach out to NHO, for the purpose of responding to and documenting the communication. This includes all forms of communication, physical and digital, written and oral.

The data processing is based on our legitimate interest of maintaining contacts with the outside world in our work as an employers' and business organization and documenting the work we do.

It is voluntary for persons who reach out to NHO if they wish to submit their personal data. If we do not receive the data necessary to respond to the requests submitted, NHO will not be able to respond to the requests and will delete them. NHO will not receive, nor process in any other way, sensitive data without legal justification.

NHO may store personal data for as long as it is necessary for the purposes mentioned above. Communication on matters which may create need for a follow-up at a later stage, such as complaints or objections, we may store for up to ten years.

Contact persons within existing and potential business clients and suppliers

We process personal data of contact persons within existing and potential business clients and suppliers, for the purpose of

• Administrating our relationship with clients/suppliers
• Marketing our products and services (i.a. NHO membership)
• Preparing, completing and documenting the purchase and sale of goods and services
• Evaluating purchases and sales of goods and services

The data processing is based on our legitimate interest consisting of the need for purchasing, selling and marketing. We store and process also where we have a legal obligation to do so, for instance in accordance with the Norwegian Bookkeeping Act (bokføringsloven) or the Taxes Management Act (skatteforvaltningsloven).

We may store the data for as long as we believe it is necessary, for instance in order to document circumstances relating to purchases and sales.

On many occasions it will be necessary for NHO to receive personal data in order to enter into agreements with clients and suppliers, inter alia in order to document that an agreement is in force. If we do not get receive the necessary data, NHO will not enter into an agreement.

Moreover, it is voluntary for contact persons if they wish to provide us their personal data. If we gather personal data from others, it will mainly consist of contact information, position, function and employer as well as competence and references, where this is relevant. The source of such information will be the employer of the contact person, for instance through the webpage of the employer. In some cases, we may gather references from others in order to evaluate the suitability of clients and suppliers.

We may store the data until the company ceases to be a client or supplier of NHO, or until the contact person ceases this role, with reservation for the above mentioned exceptions.

In cases where NHO is conducting business, we shall distribute marketing per e-mail among natural persons who have consented to this beforehand. We refer to the Norwegian Marketing Act (markedsføringsloven) and to the section further below on "Adressees for mass distribution".

Members of trade unions

We process personal data relating to membership of trade unions, for the purpose of

• Administrating requests relating to collective agreements and affiliation with collective agreements
• Verifying that the condition of representability for the right to affiliation with a collective agreement is fulfilled
• Administrating strikes
• Advising member companies on specific personnel matters, and handling collective agreement disputes concerning individuals

Users of Arbinn

We process personal data of the users of Arbinn to verify their access to services reserved only for member companies, and to further develop and improve our services.

Contacts in civil society

We process personal data on individuals in companies, academia, public administration, media, politics, other organizations and civil society, to inform about and to gather and map opinions on and assessments of important issues and matters for the business sector.

The processing of this information is based on our legitimate interest consisting of fulfilling our purpose as an employers' and business organization.

It is voluntary for contact persons if they wish to submit to us their personal data. NHO may gather personal data from others. Sources of such information will be for example media, websites and public institutions. The data may include data which is relevant for the above mentioned purposes, for instance statements made by the persons themselves.

When processing sensitive personal data ("specific categories"), for instance relating to "political opinions" and "philosophical beliefs" (see GDPR article 9, paragraph 1), NHO will ensure that the conditions for this are met. For instance, by consent from the data subject, or if the data subject itself has made public the information.

NHO may store the data until we conclude that we no longer have any purpose for keeping the data in store.

Members of NHO various bodies, councils, committees and reference groups etc. affiliated with NHO

We process personal data on members of NHO's different bodies to organize and facilitate the work within these bodies, and to document the work relating to specific issues and matters. An elected representative is someone who has been appointed to or participates in an NHO body, councils, committee or reference group etc., inter alia members of the executive board or the supervisory board (representantskapet).

Adressees for mass distribution of newsletters, marketing etc.

We may process personal data for the purpose of mass distribution of newsletters etc, relating to NHO's work and operations.

The processing is based on our legitimate interest consisting of
• Working to improve the competitiveness and profitability of businesses, inter alia by informing the outside world about relevant and current issues and matters important to businesses
• Informing about events and courses organized by NHO
• Informing employees and elected representatives within member companies about the advantages NHO and our partners can offer member companies

It is voluntary to submit an e-mail address to NHO. Unless we receive the e-mail address, NHO cannot distribute newsletters etc. If we gather personal data from other sources, it will consist of name and e-mail address of contact persons in member companies. The sources of this data will normally be the employer of the individual.

NHO will terminate distributions to recipients who request that we do so. We reserve the right to have the possibility to store data that a recipient no longer wishes to receive our distributions. When receiving information that an e-mail address is no longer active, we shall delete it.

When conducting business, NHO shall distribute our e-mail marketing only to individuals who have consented to it beforehand, cf. the Norwegian Marketing Act.

We do not disclose contact data to third parties for any marketing related purposes without first having procured the consent of the individual concerned. Such third parties will typically be the suppliers of different NHO membership advantages. In such cases, the third party will be the responsible data controller for any data we give them.

Speakers and participants at meetings, courses, seminars and other events etc.

We process personal data for organisers, speakers, registrees and participants for courses (e-learning included), seminars, meetings etc. organized by NHO, for the purpose of

• Planning, informing about and facilitating courses, events and meetings etc
• Facilitating contacts between participants and, when necessary, contacting participants
• Invoicing, if there is a participation fee involved
• Evaluating courses, events and meetings
• Informing about upcoming courses, events and meetings

The processing of data is based on our legitimate interest consisting of organizing courses, events and meetings. etc.

To be eligible as a speaker etc. or participant at one of NHO's events is subject to that we receive the necessary data for the above mentioned purposes. If you provide us with sensitive data about conditions that are necessary for our ability to accommodate any special needs you may have (for instance dietary restrictions), our processing of this data will be subject to your consent.

NHO may disclose participants lists including the name of participants and the companies they represent to speakers etc. At some events, we distribute lists including the name of participants and the companies they represent to make it easier for participants to connect during the event. You may object to being included in this list.

Where this is necessary, we may disclose lists of the names of participants and the companies they represent to technical organisers and other third parties.

We may store data on speakers and participants for up to six months. Moreover, we will store data where NHO is legally obliged to do so, for instance in accordance with the Norwegian Bookkeeping Act (bokføringsloven) and the Taxes Management Act (skatteforvaltningsloven).

Persons with access to NHO Headquarters on Middelthuns gate 27, Oslo

NHO Eiendom owns Middelthuns gate 27 in Oslo (Næringslivets Hus). NHO Eiendom processes personal data of visitors and others with access to Næringslivets Hus to have an overview on who has access to the venue. NHO processes personal data for the purpose of facilitating meetings and other events.

For other venues rented by NHO, it is the owner who informs about the processing of personal data. NHO's Brussels office is located in the premises of BusinessEurope, of which NHO is a member. For this purpose, a copy of the BusinessEurope privacy policy is available here.

Persons concerned by legal assignments and cases in which NHO is involved

Attorneys employed by NHO process personal data to practice their work as attorneys, hereunder to document their legal work.

Visitors of NHO webpages

NHO does not process any personal data from the visitors of our webpages which do not require any log-in.

You can read more here about our use of cookies (storing of data in the users communications equipment or our access to data, see Ekomloven § 2 – 7 b).

The information provided here is not valid for other webpages that we link to from our webpages.

We disclose personal data as described in this document for each different group of data subjects. We also disclose personal data when legally obliged to do so.

We do not disclose personal data to recipients outside of EEA countries.

The data we have stored on contact persons in member companies may be used also by the sectoral federations, industry associations and other affiliated units that the member company is part of. NHO has joint data processing responsibility for this data together with these units.

We use data controllers as described for each different category of data subject. Contact information for the data controllers is available at the end of this document.

No automated decisions will be made based on any personal data submitted to NHO.

Those individuals on whom we hold personal data are entitled to a confirmation from NHO that we are in possession of this data. They also have the right to demand access to these data. Should we have any incorrect data registered, the data subject concerned may request that the data is corrected.

In some cases, the data subjects may demand that we delete personal data we have on them. Such a right applies, inter alia, when the processing is based on a consent which is withdrawn by the data subject. In some cases, the data subject may also request that we limit or discontinue the processing of personal data relating to them.

The data subjects may also be entitled to have the disclosed data he or she has provided NHO based on consent.

If you wish to know more about your rights as a registered data subject, we recommend that you read through the webpages of Datatilsynet (The Norwegian data protection authority). If you are not satisfied with our processing of personal data, you may submit a complaint to Datatilsynet.

Our possibility to store data does not constitute a storage obligation to the registered data subjects, other than what is required by law.

NHO (organization number 955 600 436) is the responsible data controller. Our office address is Middelthuns gate 27, Oslo. Our post address is post box 5250 Majorstuen, 0303 Oslo. You may also contact us via email postmottak@nho.no or telephone +47 2308 8000.

NHO Eiendom AS (organization number 989 524 046) is the responsible data controller for data registered on visitors of Næringslivets Hus. NHO Eiendom AS is also a data processor for NHO. The office address of NHO Eiendom is Middelthuns gate 27, Oslo. Our post address is post box 5250 Majorstuen, 0303 Oslo. You may also contact us via email postmottak@nho.no or telephone +47 2308 8000.

The contracted data processor of NHO and NHO Eiendom AS for data on persons with access to Næringslivets Hus is Eurest AS (organization number 952 507 729). Their address is postboks 74, 1371 Asker. They can be reached via e-mail at post@compass-group.no or telephone +47 66 77 62 80.

Our contracted data processor for telephone contacts with member companies is Consort AS (organization number 994 887 203). Their address is Kjøpmannsgata 25, 7013 Trondheim. They can be reached via e-mail at post@consort.no

We have joint data controller responsibility together with the sectoral federations and industry associations within the NHO community.

We will constantly work to develop our principles and practice for the processing of personal data, for instance relating to the deleting of personal data. In case of any changes in our policy or practice, the information above will be updated accordingly.

The Information above is dated 6th of july 2018.