Here you can read about what personal data Changefactory processes. Changefactory is committed to protecting your rights when we process personal data.
Personal data is all information that can be linked to you as a person, such as name, telephone number, photos, films and audio recordings.
The CEO (in his/her absence, the chairman of the board) of Changefactory is the data controller for the foundation’s processing of personal data.
Changefactory processes information about you when:
Changefactory does not collect and store more information than is necessary to fulfill the purpose of the processing. The personal information we collect is generally obtained from you.
Changefactory has good procedures for storing your personal information in a secure manner. This is done by storing the information in areas with access control where we limit who has access to the information about you.
You have the right to access the information that Changefactory has registered about you and can request that Changefactory update, limit, archive or delete information about you.
Changefactory is particularly concerned with protecting the rights of children and young people. We therefore have good procedures that ensure that the information we have about you is stored in a safe and secure manner.
When you agree to participate in a survey where we talk to you outside of school, we need some information from you so that we can contact you. We will always ask if it is okay for you to participate in the survey and for us to store information about you. In this way, you consent. Your contact information is stored on a disc that only those working on the survey have access to. The information is deleted when the survey is completed and the report is complete.
When Changefactory conducts surveys outside of school, this is done, among other things, by talking to you in an interview. The minutes from the interview are initially anonymised immediately, and no later than the same day the interview was conducted. This means that any personal data in the minutes that can be linked to you as an individual is removed.
The processing basis for processing personal data when we conduct surveys is either Article 6(1)(a) of the General Data Protection Regulation on consent or Article 6(1)(e) on public interest. Letter a of consent means that you (and guardians for you under 16 years of age) have agreed that you can participate in the survey and provide us with the information. Letter e of public interest means that Changefactory is allowed to process the information pursuant to sections 8 and 9 of the Norwegian Data Protection Act, because it is necessary for purposes related to scientific or historical research.
When you register as a member of Changefactory, we register your name, date of birth and telephone number in our member register. The basis for this processing is the data protection regulation art. 6 no. 1 letter a regarding consent. We store this information about you in order to be able to provide you with information and offers related to membership. The information is stored on a disk that only factory workers working with members have access to. The information is deleted when you are no longer a member.
Changefactory invites children and young people to take photos, films or audio recordings (e.g. podcasts). This is done as part of disseminating knowledge from children and young people. Before we do this, we obtain written consent from the child and from the caregiver for those under 16 years of age.
Changefactory publishes pictures, films and audio recordings with children on our websites, social media, public streaming services and in reports. CF obtains written approval from children and young people for the use of pictures/film and for where the picture/film can be published.
The basis for processing this is basically the Privacy Regulation art. 6 no. 1 letter a on consent and exceptionally letter f on legitimate interests. Pictures, films and audio recordings are deleted when the child or caregiver requests it.
When a child or young person is under 16 years of age, we also obtain consent from caregivers to process personal data about the child. Changefactory then receives contact information for the caregiver from the child.
The basis for processing is the Data Protection Regulation art. 6 no. 1 letter b because the processing is necessary to fulfill an agreement to which the data subject is a party. The information will be deleted when the child reaches the age of 16 or in accordance with point 4.1.1 or 4.1.2.
If you apply for a job at Changefactory, we need to process information about you to assess your application. The recruitment process involves processing the information you provide to us through the documents you send us, including your application, CV, diplomas and certificates. In addition to any interviews, Changefactory may also conduct its own investigations, for example by talking to references.
To assess applications and other submitted documents, conduct interviews and call references, the basis for processing is Article 6(1)(b) of the General Data Protection Regulation. This means that we may process personal data when it is necessary to take measures at the job seeker’s request before an agreement is concluded.
If we also conduct other investigations, for example by calling someone who has written a certificate and who is not a reference, the basis for processing is Article 6(1)(f), which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the interests or fundamental rights and freedoms of the individual. The legitimate interest is to find the right candidate for the position.
Applications will be deleted no later than when the recruitment process has been completed.
When you are employed by Changefactory, we process some personal data about you. This includes contact information, information needed for payment of wages and police clearance. Changefactory has routines for deleting user accounts, including e-mail and formatting of PCs, when an employee leaves.
The basis for processing contact information, information needed for payment of wages and police clearance is Article 6, first paragraph, letter b, stating that it is necessary to fulfill an agreement and Article 6, paragraph 1, letter c, stating that the processing is necessary to fulfill a legal obligation.
Information that we are obliged to keep under the Norwegian Bookkeeping Act is stored for 5 years, which is the requirement under the law.
We use e-mail in much of our work. CF has its own email accounts for employees, which are only used for as long as an employee works at CF.
We ask that you do not send special categories of personal data unencrypted by email. This is, for example, personal data about racial or ethnic origin, political opinion, religion, or health information.
If you have requested a lecture or similar for your business, we will store your contact information for the current and following years. The purpose is to plan and administer lectures, keep an overview of and follow up on completed lectures and prepare anonymous statistics for reporting and internal prioritisation and planning.
The basis for this processing is Article 6(1)(f) of the General Data Protection Regulation, which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the consideration of the individual’s privacy. The legitimate interest is to administer, keep an overview of and follow up on lectures and prepare statistics.
When registering for an event, we will ask for information about your name, contact information and place of work. The purpose of the information is to provide information to participants, administer and organise events, prepare participant lists, follow-up of participants afterwards and for anonymous statistics for reporting.
The basis for processing is Article 6(1)(f) of the General Data Protection Regulation, which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the consideration for the individual’s privacy. The legitimate interests are to carry out events in a good manner.
We process contact information for our partners. The purpose is to be able to arrange meetings, events and disseminate knowledge.
The basis for processing is Article 6(1)(f) of the General Data Protection Regulation, which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the consideration for the individual’s privacy. The legitimate interests are to be able to contact our partners.
Changefactory processes your personal data in accordance with the Personal Data Act and applicable regulations.
You have the right to access the information that Changefactory has registered about you, and you can request that the information be updated, archived, restricted or deleted. We have routines for deleting and archiving personal data.
You can object to the processing of the personal data we have registered about you. You also have the right to complain to the Data Protection Authority when processing personal data that is not in line with the rules.
To request deletion, correction or access to personal data, you can send an email to samtykke@forandringsfabrikken.no.
If you have any questions or other inquiries, you can contact:
Viola Gunvaldsen Breunig
Legal advisor
Tel: +47 977 44 911
Email: viola@forandringsfabrikken.no