Through this privacy statement, we aim to provide information on how and why the Geological Survey of Norway (NGU) collects and processes your personal data.
Latest version: May 4, 2021.
This privacy statement is aimed at individuals who are in contact with NGU. For example, through your inquiries about geological questions, in connection with ongoing projects that affect you or your property, or for instance, if you as an employee in a public or private entity have shared your contact information with us.
It is important to us that your personal data and your personal integrity are protected, and that the information we have about you is processed in a lawful and transparent manner in accordance with privacy legislation. Personal data is any information about an identified or identifiable physical person.
NGU, through our organization's director, is responsible for the data collected and processed by NGU. The day-to-day responsibility is delegated to the Section Leader for Communication and Dissemination. This privacy statement contains information you are entitled to when personal data is collected through NGU and general information about how we process your personal data.
Your personal data is processed in accordance with the applicable privacy regulations at any given time.
1. Our use of personal data
We collect and process personal data to fulfill our legal obligations as a government entity. NGU is subordinate to the Ministry of Trade, Industry and Fisheries and processes personal data mainly in the public interest and due to legal obligations.
Furthermore, we process personal data to be able to administer our operations to fulfill our duties for users of NGU's websites and digital services (including registration solutions such as Brønnreg and NADAG WebReg), and otherwise comply to requirements for processing of your personal data.
The personal data we process is primarily obtained directly from you; for example, through your inquiries, your use of our digital services, or if we have received your details as a contact person at one of our partners in the public or private sector.
As a government entity, NGU is subject to the legislation on archives and is therefore obligated to archive certain personal data. When contacting NGU, your personal data may be journaled and archived in accordance with the rules of the Archival Act and associated regulations.
2. Transfer of personal data to third parties
Your personal data is treated confidentially by us, and only those with a legitimate need within our organization will have access to your personal data. Where your personal data is subject to a duty of journalization, your personal data may be made available in our correspondence journal. This can occur if you contact us with questions or other inquiries.
Information about you will be stored in NGU's journal and archiving system.
Personal data may be made available to third parties who assist us with the technical operation of our IT and accounting systems. When we allow third parties access to personal data in this manner, we use data processing agreements to ensure that these third parties comply with our requirements for processing personal data and applicable legislation.
It may also be that in some contexts we share some of your personal data with our partners, such as well drillers or partners within a limited research or mapping project. Note that we will never share your personal data with a third party unless we are legally obliged to do so or we have your consent.
Finally, the data of newsletter subscribers is stored by Make AS, the provider of our newsletter services.
3. How, why, and for how long do we process personal data?
3.1 As a business contact
We only process personal data that are necessary to fulfill our obligations as a government entity and for the administration of our business. If you are employed in a public or private business, we will process information about you that we have received from you or your employer. The information we usually record is primarily limited to name, telephone number, email address, and business name. If you provide other personal details about yourself, these may also be recorded.
The legal basis for the processing of personal data at NGU is primarily the performance of tasks in the public interest. As a governmental institution, we have a legal responsibility to perform tasks within our societal mandate.
3.2 As a private individual
If you, as a private individual, contact NGU with inquiries regarding your property, we will process your personal data based on the purpose of the inquiry. We will process the personal data you provide to us, and we will not collect more personal data than necessary to fulfill the purpose. At the same time, we encourage you not to send us any superfluous information.
As previously mentioned, your information from such inquiries may be archived in accordance with the Archive Act and associated regulations.
For further processing in response to your inquiries, please refer to the sections below for a detailed description of our processing.
3.3 Using the National Database for Ground Investigations (NADAG)
NGU processes and stores personal data in NADAG to ensure the quality of the records we receive, to be able to contact the person who has submitted data in case of questions, and to manage NADAG.
Data is provided to NADAG voluntarily by you, or when a contractor is obligated to do so through a contract with a client. The basis for our processing of your personal data is your consent, according to GDPR Article 6(1)(a).
For users of NADAG WebReg, the following personal data is processed: Organization, national identity number, name, and email address of the contact person. The personal data for users in NADAG WebReg is provided by the user themselves and is collected from ID-porten. The national identity number is only used for logging in via ID-porten. When user accounts in NADAG WebReg are deleted, all associated personal data is removed from our systems.
For users of GeoSuite Cloud for NADAG, the following personal data is processed: Username, email address, first and last name, organization, and password. A user must be created for the delivery and downloading of data in Geosuite format via GeoSuite Cloud. The data is stored at NGU and our cloud service provider, Trimble. Email addresses are only used for the delivery of produced content, and possibly for contact if something goes wrong with the ordered production. We have entered into a data processing agreement with Trimble which ensures that their processing of personal data on our behalf is in accordance with privacy regulations.
For other formats, only an email address is required for the delivery of produced data files.
Uploaded reports may contain personal data such as names and affiliations to organizations.
By uploading data to NADAG, it is assumed that you consent to NGU managing the data and freely sharing it with others under the Norwegian Licence for Open Government Data (NLOD).
3.4 Use of the Brønnreg and the National Groundwater Borehole Database
NGU manages Norway's National Groundwater Borehole Database (GRANADA), where all groundwater and energy wells that are drilled must be registered by the party who has conducted the drilling. When a well is registered, NGU uses personal information about the client who commissioned the drilling, and the person who registers the well, for the purpose of quality assurance of the registration.
The processing and storage of personal data in the Brønnreg (Norway's well registry) and GRANADA are carried out pursuant to the Water Resources Act §46 with the associated regulations (FOR-1996-11-19-1066 - Regulations on mandatory reporting for well drilling and groundwater investigations), cf. GDPR Article 6(1)(c).
For users of the Brønnreg, the following personal data are processed:
Your national identity number and the company you represent. Your name is stored if you choose to provide it. Personal data about users in the Brønnreg is provided by the users themselves and is retrieved from the ID portal.
For clients subject to mandatory reporting in Brønnreg, the user's name, address, telephone number, and email address are processed if the person registering the well provides this information. The geographical location of the well is also recorded in the form of coordinates and cadastral numbers. This is considered personal data when NGU processes these in combination with the client's name and contact information.
After NGU has quality assured the registration, the contractor's name and contact information are anonymized. The cadastral number and coordinates of the well are published in the National Groundwater Database and are no longer considered personal information when the associated information about the contractor has been deleted.
The party conducting drilling must always inform the client about the registration obligation to NGU before drilling.
The client's personal information registered in the Brønnreg is collected by the party drilling the well, and from the cadastral register.
When user accounts in the Brønnreg are deleted, all associated personal data are removed from our systems.
Wells registered in the Brønnreg and GRANADA are linked to an automatically generated ID number, which cannot be traced back to the user account that registered the well after the account has been deleted.
Personal information about the contractor is deleted or anonymized as soon as the well has been quality assured and registered. This occurs within a maximum of three months.
It is important that the information we have in GRANADA is accurate and updated. If you discover any errors, we encourage you to contact us so that the information can be corrected.
Data transfer between the Brønnreg and NGU's servers are encrypted.
3.5 As an NGU visitor
When visiting NGU's premises in Trondheim, you must register in our visitor registration system. The processing of this information is founded on your consent. The purpose of collecting this information is to keep track of who is on our premises for fire safety and security reasons. At the time of registration, you must provide your name and phone number, and if you wish, you can also specify the company you represent.
Your information is automatically deleted after three days.
3.6 As a job applicant
If you are applying for a job at NGU, you must submit your application through our application platform, Webcruiter. Jefferson Wells provides recruitment services for NGU, and we have entered into a data processing agreement that ensures their handling of personal data on our behalf complies with privacy regulations. The personal information you provide in connection with your application will only be processed by those who have a legitimate need for it.
In the application, you will be asked to provide a variety of personal information about yourself. This includes your name, contact details, and information about yourself. You will also be asked to provide information about your education and your previous work experience. References from your previous employers may also be given. We will also process your certificates, diplomas, and any other documents you upload.
The purpose of the processing is to evaluate your application for the position you are applying for. Your information will be processed as long as we have a purpose for it and will be deleted once the purpose has been fulfilled.
Archive legislation requires us to retain a variety of information in connection with recruitment processes. If you are not employed, your name will be archived in a public or extended list of applicants. Certain personal information about you may also be included in the processing notes from the appointment authority at NGU which are required to be kept. These details are stored confidentially in accordance with the archiving regulations.
3.7 As a visitor to our websites
We use cookies on our homepage. A cookie is a small text file, and our website will always ask your browser to store the cookie on your machine. We do this to remember your actions, preferences, and how often you have visited our website. This, in turn, allows us to provide you, the user, with better access to various features. Furthermore, we also use cookies on our pages to keep statistics on how often our site is generally used.
You can manage your cookie settings in your browser.
3.8 As subrsciber to. newsletter
Our newsletters update our fields of expertise and services, as well as current projects, research, events, and job vacancies. When you subscribe to our newsletter, we collect your email address, which is mandatory. Additionally, you may choose to provide your first name, last name, and company, but this is optional. We use this information to tailor the content we send you as effectively as possible. For instance, certain events may only be relevant to specific companies. This information is not shared with other entities and is deleted when we notice that you no longer wish to receive information from us. The information is also deleted if we receive feedback indicating that the email address is inactive.
Make AS is the data processor for the newsletter, and all data is stored on Norwegian servers. In connection with the newsletter distribution, we compile statistics on usage, such as the number of readers and the content being read. We do this to provide our readers with the most relevant content possible.
4. Storage and deletion of personal data
The personal data we process about you is stored through our systems on servers located in Norway, which are currently considered to be a safe and satisfactory storage solution for your information. TietoEvry is our data processor for several of our core IT systems. We have entered into a data processing agreement that ensures their processing of personal data on our behalf is in compliance with data protection regulations.
NGU will delete your personal data without undue delay when they are no longer necessary for the purpose for which they were collected.
NGU is subject to the Archives Act with accompanying regulations. As mentioned above, some of your personal data may be archived in accordance with NGU's statutory obligations.
If you object to the processing of your personal data and there are no more compelling legitimate grounds for the processing, we will delete your information. Note that there may be legal requirements that oblige us to retain your personal data for a certain period. We have specific deletion procedures for each processing activity.
5.Your rights as a data subject
As a data subject, you have several rights related to our processing of your personal data. Here you will receive information about what these are, and how you can exercise these rights with NGU in connection with the processing of your personal data. If you request us to exercise one or more of these rights, we will comply with the request within one month from when it was made. Requests can be directed to personvernombud@ngu.no.
- Access: You can send us a request for access to our processing of your personal data.
- Correction: If you believe the information we have stored about you is incorrect (e.g., email address or information about real estate), you may request that we correct this at any time.
- Object: If you do not want us to process your personal data, you can object to the processing.
- Withdraw your consent: You can withdraw your consent allowing us to store and process your personal data at any time, where such consent has been given.
- Deletion: If you object to the processing of your personal data, or you withdraw your consent, information we have stored about you will be deleted, provided that we do not have another basis for retaining it. If you wish to have your personal data deleted under other circumstances, you may simply direct a request to us for this.
- Data portability: You have the right to demand data portability for information about yourself that you have provided to NGU, and which has a basis in consent or contract. If you wish to exercise your right to portability, the relevant information about you will be sent to you, or to a third party designated by you, provided this is technically feasible.
- Right to restrict processing: If you wish for us to restrict the processing of your personal data, you can request this.
- Right to lodge a complaint with a supervisory authority: If you believe our processing of your personal data is in violation of the General Data Protection Regulation (GDPR), or other privacy regulations, you have the right to lodge a complaint with the Norwegian Data Protection Authority. Complaints can be submitted on their website.
6. Contact
If you have any questions or concerns regarding your privacy, you can contact us by email at personvernombud@ngu.no, or you can make an inquiry by phone at 73 90 40 00. Our mailing address is:
Geological Survey of Norway
P.O. Box 6315 Torgarden
7491 Trondheim
7. Changes to NGU's privacy statement
We may modify the privacy statement from time to time at our discretion. When we make changes to this statement, we will update the revision date at the top of this page, and a modified privacy statement will be effective from the revision date. We encourage you to review this privacy statement to be informed about how we protect your information.