Privacy and security policy

Visitnorway has adopted data protection policies with respect to your privacy and security.

This privacy and security policy statement concerns how Visitnorway.com collects and uses your personal information.

Visitnorway.com links to websites owned and operated by other businesses, such as for example Fjord Norge AS / Fjord Norway. Visitnorway and Innovation Norway do not have access to private and personal information gathered by those websites, unless it is explicitly mentioned in this privacy policy. Visitnorway is not responsible for the content of or processing of private and personal information on other websites. For more information, please see each website's privacy and security policy statement.

Contact information
If you have questions or comments about this statement or how we treat personal information, you can contact us at [email protected] or send mail to:

Innovation Norway
att Visitnorway.com
P. O. Box 448 Sentrum
N-0104 Oslo
Norway

Contents

1. About VisitNorway.com
2. Responsibility for processing
3. Purpose of processing
4. Which data are processed?
5. Personal information about minors
6. Legal basis for processing of information
7. Access to the information
8. Direct marketing
9. Data processors and transfer of data to other countries
10. Safeguarding of the information
11. Your rights
12. Enforcement of this privacy policy statement
13. Consent, governing law, venue
14. Changes to the declaration

1. ABOUT VISITNORWAY.COM

Visitnorway.com is the official travel portal for Norway and is published by Innovation Norway and commissioned by Trade and Fisheries Ministry. Several markets have local variants of visitnorway.com such as visitnorway.com/de in Germany. This Privacy Statement applies to all Visitnorway sites.

2. RESPONSIBILITY FOR PROCESSING

Innovation Norway's Tourism Director Aase Marthe Horrigmo has the formal responsibility for the processing of your personal information.

3. PURPOSE OF PROCESSING

It is entirely voluntary for those visiting the website to provide personal information in connection with services to receive newsletters, order information material and brochures, enrol in events, and so on.

We will use information about you for any of the following purposes:

• To make it easy for you to find destinations, events and other information about Norway as a tourist destination.
• Use of e-mail and postal address for sending out newsletters and other physical materials via our website and other channels.
• Provide information about meetings and events.
• For statistics, aggregation and management of sites and services. Information is obtained in order to allow Visitnorway.com to get further information about the users, including how users come to the site, as well as tracking general usage patterns of users on our website. We use this information to manage and enhance the site.

4. WHICH DATA IS PROCESSED?

We process both personally identifiable information and non-personally identifiable information about you. Personally identifiable information is information that identifies you as an individual. Non-personally identifiable information is information and any other details that do not reveal your personal identity.

Personally identifiable information
We collect and process the following information:

• You can subscribe to newsletters so that you receive emails from Visit Norway on current news. For us to send email to the appropriate subscriber, you must register your first and last names, as well as an email address.
• If you direct a request to Visit Norway or Innovation Norway via the web, such as sending us an email, relevant information could be stored, such as name and email address.
• On visitnorway.com you can order brochures and other information material by providing your name, business, email and postal address. Personal information we receive for processing orders of such material will not be used for any purpose other than to effectuate the order, unless you have explicitly indicated that you want to receive e-mail from us.
• When you visit Visitnorway.com your IP address is recorded. We do not link this information directly to you as a user. The information is used to manage and maintain our sites. Examples of information that this data provides: How many people visit different sites, how long the visit lasts, what websites users are coming from and which browser is used. This enables us to develop better and more user-friendly services. See more about web analytics and cookies below.

User reviews
Visitnorway.com may, by agreement with TripAdvisor, collect and display reviews from users who have published information on relevant destinations and products on TripAdvisor. You have waived all rights you may have in such user reviews. Your assessment(s) can be freely used, copied, distributed and published in any medium, and in any form, without your permission. See TripAdvisor's Terms of Use, Privacy and Cookie Policy.

We do not edit user reviews published on TripAdvisor and can not be held responsible for such user reviews, or any further use, distribution, or republication of them. Innovation Norway neither confirms nor endorse opinions or attitudes expressed in user reviews as individuals personal beliefs. Any decision made on the basis of reviews or comments that are on Visitnorway.com, is at your own risk.

Surveys
Visitnorway may use QuestBack for user surveys. It is voluntary to participate in user surveys, and we collect your explicit consent.

Social Media
Innovation Norway uses social media to provide information on our activities. If you follow us on Facebook, Instagram, Youtube and other social media, the relevant platform will be responsible for the processing of your personal data.

Cookies, web beacons and other storage technologies
Visitnorway.com collects and Innovation Norway processes data about visitors to Visitnorway.com and other Visitnorway websites. We use common Internet technologies, including "cookies" to collect information about users so that at any time we can provide the best possible functionality and develop our information services. This information is taken from the computer's web browser and may include your IP address, operating system, browser, screen resolution and previous website.

We use cookies, web beacons and other storage technologies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partner, such as Facebook and Google.

"Cookies" are small information capsules (text files) that the website asks your browser to store on your computer or mobile device. This allows the website can remember actions or preferences over time.

5. PERSONAL INFORMATION ABOUT MINORS

Innovation Norway does not gather information about your age and does not purposely process information about children under 15 years of age.

6. LEGAL BASIS FOR PROCESSING OF INFORMATION

Innovation Norway processes personal data for twelve different purposes. For each processing purpose, an operational controller has been appointed.

For an overview over:

• processing purposes;
• operational controllers;
• data subjects;
• personal data processed and legal basis;
• disclosure of personal data; and
• transfer of personal data to third countries;

you can download this document:

Processing of personal data (150918).xlsx (Excel document with certain explanatory comments)

It is voluntary for those visiting the website to provide personal information in connection with services to receive newsletters, order information material and brochures, enrol in events, and so on. Unless otherwise specified, your consent or agreement to such processing is considered given when you provide the information.

7. ACCESS TO THE INFORMATION

To ensure that the processing of information is carried out in a safe manner, only specifically authorized persons in Visitnorway, Innovation Norway headquarter in Norway and branches abroad, and our subcontractors and system suppliers (see below and section 9) will have access to the information you provide us. The number of employees with such approval is limited. Access to information is secured by access mechanisms.

We will not disclose, sell, distribute, rent, license, share or pass details or personal information to any third parties other than those who deliver and are contracted to deliver services to us, unless we have your express consent to do so.

Innovation Norway has signed an agreement with various distribution partners who distribute our newsletters, brochures and other materials, so-called "routing." Distribution partners are:

• Microsoft Dynamic for Marketing

We will not share personal information with our distribution partners to a greater extent than is necessary to complete the purpose, such as sending out brochures and newsletters.

By contract, our suppliers may not use or disclose your personal information for other purposes, without your permission.

8. DIRECT MARKETING

It is voluntary to subscribe to newsletters. Newsletters contain current information about Norway, but may also contain commercial information about products and services from suppliers in Norway, and so on. The newsletters are sent out 1-2 times a month. You can unsubscribe at any time via a link in the newsletter.

We do not allow any third party to use your personal data for marketing or communication purposes.

9. DATA PROCESSORS AND TRANSFER OF DATA TO OTHER COUNTRIES

Innovation Norway has signed an agreement with the following data handlers:

• Sanity (sanity.io)
• Maverix (maverix.no)
• Dentsu (dentsu.com)
• Siteimprove (siteimprove.com)
• OneTrust (www.onetrust.com)
• TradeTracker Norway (tradetracker.com/no)
• Distribution partners mentioned in section 7, above.

All Visitnorway sites are currently located on servers in Netherland, but our data processors has reserved the right to transmit information to servers or subcontractors in other countries.

If information is transferred within the EU/EEA, we will ensure that the EU directives on personal data in computing and country-specific data protection laws are followed. If we pass personal information to third parties located outside the EEA, we will ensure that the transfer is in accordance with EU Directive on personal data.

10. SAFEGUARDING OF THE INFORMATION

We have established rules and procedures for the protection of personal data and privacy.

When we treat "non personally identifiable information" combined with "personally identifiable information" (for example your name combined with geographical location) the collected information is treated as personally identifiable information.

If we share your personal information with a third party, we will ensure that there are arrangements and agreements in place to ensure the safety of the information and prevent that the third party uses the personal information for purposes other than what was agreed.

We shall use all reasonable precautions to ensure that our employees, data processors and third parties who have access to information about you have adequate information to ensure that they treat such information in accordance with this statement and our obligations under privacy legislation.

11. YOUR RIGHTS

If Innovation Norway handles personal information about you, you are entitled to access your own information. If personal information is inaccurate, incomplete or inaccessible, you can ask Innovation Norway to correct the information. See contact information in the introduction to this declaration.

You have the right to:

• receive information;
• demand access;
• demand rectification;
• demand erasure;
• demand restriction;
• data portability;
• complaint to a supervisory authority; and
• object;

as set out in the General Data Protection Regulation (GDPR) chapter III.

We do not process and store information about you for longer than necessary for the intended purpose, or as required under existing agreements, and not beyond legal limits. We delete personal information when a user gives notice that he/she no longer wishes to use the service. For example, your email address used to send out newsletters is deleted when you unsubscribe. The same is done when we are notified of inactive email addresses.

12. ENFORCEMENT OF THIS PRIVACY POLICY STATEMENT

Innovation Norway may use the information that we collect about you when we have reason to believe that it is necessary to identify, contact or bring legal action against persons or entities that may harm you, us or others. We may also disclose your information when we believe it is required by law.

13. CONSENT, GOVERNING LAW, VENUE

This privacy statement applies to all users of our website. We require that users agree to comply with the declaration as part of our relationship.

By using our website you accept that your personal data may be processed in accordance with this privacy policy, which includes transferring data to agents and third parties as described in this statement.

Innovation Norway operates from Norway and is subject to Norwegian law. This declaration also meets the minimum requirements imposed by local law in Denmark, Sweden, The Netherlands, Germany, Britain, France, Spain, Italy, Brazil, China, USA, Poland and Russia. You agree that any disputes will be handled by the court in Oslo, in accordance with the laws of Norway, unless otherwise dictated by mandatory local law.

14. CHANGES TO THE DECLARATION

Innovation Norway reserves the right to change or update the privacy statement. All changes are valid from the time of being posted, and will include information gathered from that date, as well as existing information held by Innovation Norway. You can find out when these guidelines were last revised by referring to the date given by "last updated" on this page.