HomeAbout

Privacy statement for applicants, students, former students, and PhD candidates

Here you will find information on how NMBU process your personal information when you are an applicant, student, former student, and PhD candidate.

  • The purpose of processing personal information about applicants, students, former students, and PhD candidates is to safeguard your rights, to fulfill NMBU's tasks and obligations as a university, and for you to be able to receive and complete studies.

    It is necessary for NMBU to process your personal information so that NMBU can, for example:

    • Assign applicants a study place for study programs, PhD programs, subjects, and courses
    • Offer students and PhD candidates teaching, exams, and practice
    • Report data on applicants, students, and PhD candidates to the Database for Higher Education (DBH) and the Loan Fund (Lånekassa).
    • Offer exchange to other educational institutions abroad
    • Make necessary assessments in the event of suspicion of false documents, annulment of exams or tests, exclusion and expulsion, police certificates, or suitability assessments.

  • The legal basis for the processing of ordinary categories of personal information about applicants, students, former students, or PhD candidates is in the Personal Data Act and the GDPR article 6 nr. 1 and special categories of personal information in GDPR article 9 nr. 2 and Article 88.

    Assign study place for study programs, PhD programs, subjects, and courses for applicants

    • Legal basis for processing:
      - GDPR article 6 nr. 1 letter e, cf. University and college act (Universitet og høyskoleloven) § 1-3, § 3-7 and § 4-15.
    • Which categories of personal information we process about you:
      - Contact information, Information for secure identification, Documentation of necessary competence, Source of funding / proof of funding (PhD admission), Financial documents, for example bank statement or sponsor letter (SFM admission), Necessary documentation for PhD projects, Other necessary information, cf. the subject or program's websites

    Offer students and PhD candidates teaching, exams, and practice

    • Legal basis for processing:
      - GDPR Article 6 no. 1 letter e, cf. University and College Act (Universitet- og høyskoleloven) § 1-3, § 3-3, § 3-9, and § 4-15.
      - For the processing of special categories of personal data, the legal basis is the GDPR Article 9 letter g and the University and College Act § 4-15 (5).
      - NMBU requires police certificates and conducts ongoing suitability assessments of students on the teacher program and animal care (from autumn 2024). NMBU can also initiate a special suitability assessment for matters that require follow-up. NMBU will contact you if there is a need to assess the content of a police certificate or conduct a special suitability assessment.
    • Which categories of personal information we process about you:
      - Information regarding the implementation of exams, including exam answers and exam results.
      - Information regarding the implementation of teaching and work requirements, including posts in learning support systems and submitted assignments.
      - Sound and image regarding digital teaching and exams.
      - Information regarding the implementation of practice, including personal and contact information, program and subject affiliation, results, and any other circumstances that the practice site should be aware of.
      - Health information for the purpose of ensuring your rights.

    Report data on applicants, students, and PhD candidates to the Database for Higher Education (DBH) and the Loan Fund (Lånekassen)

    • Legal basis for processing:
      - GDPR Article 6 nr. 1 letter e, University and College Act (Universitet- og hhøyskoleloven) § 7-7 and § 7-8, and the Education Support Act (utdanningsstøtteloven) § 21 and § 23.
    • Which categories of personal information we process about you:
      - Students: Name, social security number or temporary social security number, citizenship, information related to education, for example study progression, grades, and degrees
      - For PhD candidates, the following also applies: information related to employment and financing of the position, information related to scientific publishing

    Offer exchange to other educational institutions abroad

    • Legal basis for processing:

    • - GDPR article 6 nr. 1 letter b and Article 9 nr. 2 letter a.
      • Which categories of personal information we process about you:
    • - Name, Address, Email, Mobile number, passport number, citizenship
    • - Information regarding study program: name of study program, transcript of grades, copy of high school diploma, confirmation of language skills or IELTS / TOEFL results, motivation letter for exchange. Confirmation of facilitation. This confirmation does not contain information about the reason for the facilitation.

    Make necessary assessments in the event of suspicion of false documents, annulment of exams or tests, exclusion and expulsion.

    • Legal basis for processing:
      - GDPR Article 6 nr. 1 letter e, cf. University and College Act (Universitet og høyskoleloven) § 1-3, § 3-7, § 4-7, § 4-8, § 4-9, or § 4-10
      - If NMBU retrieves information from or sends information to the Register of Excluded Students (RUST), the legal basis for the processing is the University and College Act § 3-7 (8), § 4-8 (1), (2), and (3) or § 4-10 (3).
    • Which categories of personal information we process about you:
      -Necessary documentation to assess cases of false documents, annulment of exams or tests, exclusion, and expulsion

  • The information is obtained from you yourself as an applicant, student, former student, or PhD candidate, and from instances such as Coordinated Admission (Samordna Opptak), the Loan Fund (Lånekassen), tax authorities, Nav, the National Register (Folkeregistreret).

  • The information is stored in the Joint Student System (FS) which is the system NMBU uses for administrative data about students. Application web (Søknadsweb) and Student web (Studentweb) and Nomination web (Nominasjonsweb) are part of FS. We report your information about study progression to the Database for Higher Exchange.

    In addition, in your capacity as a student or PhD candidate at NMBU, you will need access to various IT services and systems to be able to study. These IT services also store personal information about you, but the information stored depends entirely on what the service does and what function you have at NMBU. Many of these services have a user profile to ensure that you have legal access to the system. Some services will also be able to log your activity for various reasons, such as security and operation.

    You as a student or PhD candidate know yourself which services you use in your everyday life. If you are wondering how these services / systems process your personal information, you can contact IT.

  • When you apply for admission to or are a student at NMBU, a number of processes regarding the admission and your study path will be performed as partially automatic or fully automatic processing. The legal basis is the University and College Act § 4-15. Contact us if you have questions about automated case processing.

  • When you leave NMBU, you lose access to NMBU's buildings and IT systems and services. After 90 days, the content of your email and your home area will be deleted. Your student folder will be reviewed and information that we are not required by law to keep is deleted. NMBU will still store information such as that you have been a student with us, how long, and which exams you have taken. Your username will not be deleted because NMBU does not recycle usernames for security reasons.

  • Information and access

    You are entitled to receive information on how NMBU processes your personal information. This privacy statement is intended to provide the information you are entitled to.

    You have the right to access all personal information NMBU has registered about you and how this information is processed. You also have the right to receive a copy of the personal information about you. The right of access is free, and you can contact the data controller to exercise the right.

    Correction

    You have the right to have personal information that we have stored about you corrected if it is not correct, and to have incomplete personal information about you supplemented. If you believe we have registered incorrect or incomplete personal information about you, we ask you to contact us. It is important that you justify and possibly document why you believe the personal information is incorrect or incomplete.

    Deletion

    In some cases, you have the right to demand that we delete personal information about you. The right to deletion is not an unconditional right, and whether you have the right to deletion must be assessed in light of the General Data Protection Regulation (GDPR). If you want your personal information deleted, we ask you to contact us. It is important that you justify why you want the personal information deleted, and if possible, also state which personal information you want to have deleted. We will then assess whether the legal conditions for demanding deletion are met. Please note that the legislation in some cases gives us the opportunity to make exceptions from the right to deletion. For example, this will be the case when we are required to store personal information to fulfill a task we are required to do under the University and College Act, or to safeguard important public interests such as archiving, research, and statistics.

    Limited processing

    In some cases, you may have the right to demand that the processing of your personal information be limited. Limitation of personal information means that the personal information is still stored, but that the possibilities for further use and processing are limited.

    If you believe that the personal information is incorrect or incomplete, or have protested against the processing, you have the right to demand that the processing of your personal information be temporarily limited. This means that the processing is limited until we have possibly corrected your personal information or have assessed whether your protest is justified.

    In other cases, you may also demand a more permanent limitation of your personal information. To have the right to demand limitation of your personal information, the conditions in the Privacy Regulation Article 18 must be met. If we receive an inquiry from you about the limitation of personal information, we will assess whether the law's conditions are met.

    Protest

    You may have the right to raise an objection to the processing, i.e. protest against the processing, if you have a special need to have the processing of your personal information stopped. Examples can be if you have a protection need, confidential address, or similar. The right to protest is not an unconditional right, and it depends on what is the legal basis for the processing, and whether you have a special need. If you protest against the processing, we will assess whether the conditions for protesting are met. If we find that you have the right to protest against the processing, and that the objection is justified, we will stop the processing and you will also be able to demand deletion of the information. Please note that in some cases we may still make exceptions from deletion, for example if we are required to store personal information to fulfill a task we are required to do under the University and College Act, or to safeguard important public interests.

    Withdraw your consent

    If NMBU uses consent as the legal basis, you have the right to withdraw your consent for the processing.

    Data portability

    If we process information about you based on consent or a contract, you can ask us to transfer information about you to you or to another data controller.

    Complain to a supervisory authority:

    If you believe that we have not processed personal information in a correct or legal manner, or if you believe that we have not managed to fulfill your rights, you have the opportunity to complain about the processing to us. If we do not accept your complaint, you have the opportunity to complain to Datatilsynet. Datatilsynet is responsible for ensuring that Norwegian companies comply with the provisions of the Personal Data Act and the GDPR when processing personal information.