Privacy statement for employees
Here you will find information on how NMBU handles your personal information when you are employed.
The purpose of processing personal information about employees is to safeguard your rights as an employee, to fulfill NMBU's tasks and obligations as an employer, and for you to be able to do the job you are employed to do.
It is necessary for NMBU to process your personal information so that NMBU can, for example:
- give you salary, reimbursement, calculate the number of vacation days and care days that you are entitled to
- sick pay processing
- perform necessary administration around the employment relationship
- secure access to IT systems and management of properties
The legal basis for the processing of ordinary personal information about employees is the Personal Data Act and the Privacy Regulation's Article 6 No. 1 and the processing of sensitive personal information is in Article 9 No. 2 and Article 88. We process your information, among other things, for:
Give you salary, reimbursement, calculate the number of vacation days and care days that you are entitled to
- Legal basis for processing: General Data Protection Regulation (GDPR) article 6 nr. 1 letters b, c and e. That is, to fulfill the employment contract with you as an employee and to fulfill obligations we are required to comply with in other legislation, such as the Working Environment Act (arbeidsmiljøloven), the State Employee Act (statsansattloven), the Archives Act (arkivloven) and the University and College Act (universitet- og høyskoleloven), the Accounting Act (regnskapsloven) and the Tax Act (ligningsloven)
- Which categories of personal data we process about you: Name, social security number, employee number, contact information, salary information, payment information, working hours, travel and expense information, service information about sick leave, sick leave, time off, vacation and leave, tax information, information about side jobs and ownership interests, information about next of kin.
Sick pay processing
- Legal basis for processing: General Data Protection Regulation (GDPR) article 6 nr. 1 letter c, cf. The Working Environment (Arbeidsmiljøloven) § 2-1 and the National Insurance Act (Folketrygdloven) § 8-15
- Which categories of personal data we process about you: Name, social security number, employee number, username, telephone number, email, username, information about sick leave, sick leave
Perform necessary administration around the employment relationship
- Legal basis for processing: General Data Protection Regulation (GDPR) article 6 nr. 1 letter c and article 9 nr. 2 letter b
- Which categories of personal data we process about you: Name, social security number, employee number, username, name and age of children under 12, name and contact information of next of kin, health information to safeguard your rights
Secure access to IT systems and management of properties
- Legal basis for processing: General Data Protection Regulation article 6 nr. 1 letter b
- Which categories of personal data we process about you: Name, social security number, employee number, email, telephone number, username, affiliation in the organization
The information is obtained from you yourself as a job seeker or employee, from other instances such as tax authorities, Nav, the National Register (Folkeregisteret) and previous employer.
Personal information about employees is processed in central systems used to administer the employment relationship. These are systems such as the payroll and personnel system (UBW/Unit4), the case management and archive system (P360), the access control system and Microsoft 365. In addition, in your capacity as an employee at NMBU, you will need access to various IT services and systems to perform your tasks. These IT services and systems also store personal information about you, but the information stored depends entirely on what the service does and what function you have at NMBU. Many of these services have a user profile on you to ensure that you have legal access to the system. Some services will also be able to log your activity for various reasons, such as security and operation.
You as an employee know yourself which services you use in your everyday life. If you are wondering how these services/systems process your personal information, you can contact IT.
Information about name, position and area of work is considered to be public information and can be published on NMBU's website. The purpose of sharing this information is to make it easier to reach you in a work context, both for colleagues, students and others.
When you end your employment at NMBU, you lose access to NMBU's buildings and IT systems and services. After 90 days, the content of your email and your home area will be deleted. Your personnel file will be reviewed and information that we are not required by law to keep will be deleted. Your information in the finance and personnel system is stored for ten years before it is deleted. This follows from the requirements of the Accounting Act.
NMBU will still store information, for example, about who has worked in the business, for how long and what you as an employee have worked with in accordance with the archiving obligation in the Archives Act. Furthermore, information that you have worked with will not necessarily be deleted because this is important for maintaining the operation of NMBU's core business. Your username will not be deleted because NMBU, for security reasons, does not recycle usernames.
When NMBU processes personal information about you, either in the personnel file, in logs or in other registers/systems, you have certain rights under the General Data Protection Regulation (GDPR)
Right to information
You are entitled to receive information about how NMBU processes your personal information. This privacy statement is intended to provide the information you are entitled to.
Right to access
You have the right to contact NMBU to investigate whether we process personal information about you. If we do, you are entitled to know, among other things, which personal information this is, where it comes from and why we have it. You can also be provided with a copy of the personal information we hold. You will not have the right to receive information about whether we process information about others. The university processes personal information in many areas. We therefore have a right to ask you to specify from which system you want information from.
Right to demand correction
If, after having made an inspection of your personal information, you discover that the information we hold is incorrect, incomplete or inaccurate, you can ask NMBU to correct the information.
Right to deletion (the right to be forgotten)
NMBU already has strict deletion routines, whether it is automatic deletion of logs or automatic deletion when you are no longer registered as an employee. You are in principle entitled to ask us to delete the information we hold. This is not an automatic right, but it can happen on certain conditions. If we have a legal basis for holding the information, another law prohibits us from deleting it, or you do not have compelling legitimate reasons to demand deletion, we will still be able to process information about you.
Right to limited processing
This right gives you the opportunity to demand that NMBU temporarily stop using your personal information. You can demand it if you believe that the information we hold is inaccurate or we do not have sufficient grounds for processing the information. We will then stop processing until we have investigated your objections.
Right to data portability
If NMBU processes your personal information based on your consent or an agreement NMBU has with you, and the processing is performed automatically (for example, data is calculated automatically or machines analyze the information), you will be able to demand that we transfer several of your personal information to you or a third party.
Right to protest
If you are in a unique situation that makes NMBU's processing of your personal information create special challenges for you, you can protest against the university's processing. If your interests are heavier than the university's, we will no longer process your personal information.