Privacy statement for employees

The University of Agder, hereafter referred to as UiA, is the data controller for the personal data we collect and process in connection with your employment at UiA. This privacy statement provides information about how we handle your personal data and outlines your rights.

What personal data UiA has about you

Personal data includes any information that can be linked to you as an individual.

We record your name, age, gender, residential address, email address, and phone number. Additionally, we store your bank account number for salary payments. If needed, we may record the number of sick days related to a sick child, which requires information about the number of children you have and their ages. We also store a photo of you on your access card, which also functions as a library card.

As part of the recruitment process, we retain your CV, reference statements, and internal evaluations for the duration of your employment.

It is also necessary to process your health information in relation to sick leave and medical certificates, as well as associated sick leave follow-ups. Under occupational health and safety (HMS) regulations, we may need to store information about personal injuries and accidents. If required, we may also store information about allergies and special dietary needs.

Union membership information is stored if necessary for deducting membership fees or processing payments, as well as for conducting annual salary negotiations.

Personal data collected in connection with your employment

This includes information such as your employment start date, position, job description, meeting notes from employee appraisals, and other evaluations, such as the Work Environment and Climate Survey (ARK), salary development, and details related to your career development. Sources of such information may include our internal business systems as well as other employees.

The following business systems are used at UiA:

We store information related to expenses, insurance, other costs, pensions, and credit cards covered by UiA.

We also register personal data regarding leaves of absence, pensions, and the termination of employment.

To ensure the accuracy of personal data at the time of employment, we use digital checks with the National Population Register.

Handling warnings, notifications, and complaints may also require the processing of your personal data, whether you are the notifier or the subject of a notification.

In connection with the use of mobile devices and computers, logs are stored that record when and where the equipment is used. Internet activity conducted through this equipment is automatically logged.

The use of our business systems generates various types of logs. For instance, these logs can provide information about when you use a system or access our facilities.

What UiA uses your personal data for

The following are the primary purposes for which your personal data is used. The legal basis for processing is either that the processing is necessary to fulfill your employment contract, that we are required by law to process the data, or that we have a legitimate interest in processing the data that outweighs any potential privacy inconvenience for you.

We need to verify your identity and background and use your contact information, provided details, and information from references, among other sources, for this purpose.

We need to manage your employment and career development and use various information generated while you are employed with us for this purpose.

We need to process your salary, other financial compensations, pension obligations, and insurance arrangements, and we use your salary-related information for this.

We may wish to use your photo for marketing UiA, but this is done only based on your consent, and you are free to withdraw this consent at any time.

We need to secure our systems and the university’s offices and premises, as well as ensure workplace safety. We use login information from various systems and logs from video and access control systems for this purpose.

We need to process complaints, reports, and warnings and use various information generated during your employment for this purpose.

We need to register certain information for accounting purposes, typically using your salary-related information, but also hours worked may need to be stored to fulfill obligations.

Who UiA shares your information with

We use data processors who assist us with various processes. Different categories of data processors are listed below:

• Providers who manage IT systems
• Providers who assist with payroll processing
• Providers who assist with the operation of various core systems
• Providers who manage recruitment systems
• Providers who manage archive systems
• Providers who manage travel services

In connection with travel, your contact details will be shared with the Berg-Hansen travel agency. Berg-Hansen acts as a data processor in this context, and a data processing agreement has been signed between UiA and Berg-Hansen.

Public authorities require us to share your personal data with, for example, the tax authorities and NAV.

Geographical storage of personal data

UiA ensures that your personal data is stored in accordance with privacy regulations governing geographical storage. Any storage in third countries is conducted lawfully through EU-approved transfer mechanisms. If you wish to know the specific locations where your personal data is stored, you can contact us using the details provided below.

How long UiA retains your personal data

We retain your personal data for the shortest possible time and only as long as necessary or as required by law. We require more information about you during your employment and very little after your employment ends. Below is an overview of how long we retain specific types of information:

• Warnings: Retained for 5 years unless exceptional circumstances justify longer retention.
• Akan Information: Retained for a minimum of 2 years, and never longer than 5 years.
• Employment Contract: Retained for the duration of employment.
• Work Schedules: Retained according to applicable bookkeeping regulations.
• Working Hours: Retained according to applicable bookkeeping regulations.
• Certificates: Retained for the duration of employment.
• CV: Retained for the duration of employment.
• Disciplinary Decisions: Retained for 5 years unless exceptional circumstances justify longer retention.
• Approved Secondary Positions/Responsibilities: Retained as long as they are active within the employment period.
• HSE Incident Reports: Retained for the duration of employment.
• Union Membership Information: Retained for the duration of employment.
• Recommendations: Retained for the duration of employment.
• Internal Assessments During Recruitment: Retained for the duration of employment.
• Payroll Records: Retained for the lifetime of UiA.
• Payslips: Retained according to applicable bookkeeping regulations.
• Employee Evaluations: Retained for the duration of employment.
• Employee Surveys: Retained for the lifetime of UiA.
• Disciplinary Penalties: Retained for 5 years unless exceptional circumstances justify longer retention.
• Overtime Records: Retained according to applicable bookkeeping regulations.
• Leaves of Absence: Retained for the duration of employment.
• Reference Statements: Retained for the duration of employment.
• Travel Expense Reports: Retained according to applicable bookkeeping regulations.
• Tax Deductions: Retained for the duration of employment.
• Follow-up on Sick Leave: Retained for the duration of employment.
• Medical Certificates During Illness: Retained for the duration of employment.
• Applications: Retained for the duration of employment.
• Timesheets: Retained according to applicable bookkeeping regulations.
• Notifications: Retained for the duration of employment.
• Notification Reports: Retained for the lifetime of UiA.
• Diplomas: Retained for the duration of employment.

In any case, data will be retained as required by law and when specific needs arise, such as in cases of complaints or claims made against or by UiA.

Your rights

Privacy regulations grant you several rights regarding your personal data.

While this privacy statement provides extensive information, you may request more detailed explanations about how we process your data and have the right to access your personal data. If your personal data is incorrect, you have the right to have it corrected.

Data for which we lack a legal basis to process must be deleted, and you can request this if we have not done so on our own initiative. You can ask us to restrict the use of your data. You have the right to data portability, meaning you can request that your personal data be transferred to you or another organisation in a structured, commonly used, and machine-readable format. You can object to our use of your data. You may also object to being subject to fully automated individual decisions with legal consequences.

If you believe we process your personal data without a legal basis, you may file a complaint with the Norwegian Data Protection Authority (Datatilsynet). However, we encourage you to contact us first so we can address your concerns and clarify any misunderstandings.

Privacy regulations include comprehensive provisions regarding the aforementioned rights, and exceptions to some rights may apply. If you wish to exercise your rights, you can contact us using the form Personal data enquires (GDPR), and we will respond as soon as possible, typically within 30 days.

Access to emails

Privacy regulations allow us, in specific cases, to access your email account, mobile phone, and other equipment provided to you. This typically occurs if necessary to ensure the continuity of daily operations or other legitimate interests of the organisation or in cases of suspected gross misconduct that may justify dismissal or termination. All such access is conducted in accordance with the detailed rules of the law.

Video surveillance

Privacy regulations allow us to conduct video surveillance in specific situations. The purpose of the surveillance is to prevent and investigate suspected criminal activities. Video footage is only disclosed to the police upon request and with legal justification.

Data is automatically deleted after 7 days. All surveillance is managed internally at UiA, including servers operated by UiA’s IT department.