Privacy Policy

1. General information

This privacy statement describes how Bane NOR processes personal data about travelers, users of our websites, suppliers and other third parties.

All processing of personal data at Bane NOR will take place in accordance with Norwegian legislation, including The Personal Data ACT and the General Data Protection Regulation (GDPR) and other Norwegian legislation regulation of Bane NOR`s learning activities.

Bane NOR is responsible for the national railway infrastructure, which includes building and maintaining the railway system and property related to the railway. Bane NOR is also responsible for The Norwegian Railway Academy (NJ), which are the railway sector’s leading competence center and course provider of professional railway training.

All processing of personal data by Bane NOR learning is necessary to be able to deliver the services that Bane NOR are responsible for.

2. Data controller

Bane NOR SF is data controller for the processing of personal data executed by Bane NOR SF.

3. Legal basis for processing of personal data

All processing of personal data at Bane NOR learning is carried out pursuant to the GDPR and/or other relevant laws and regulations.

The types of personal data being processed is wide-ranging and varies with each individual processing. The legal basis for processing personal data is in most cases found in laws and regulations relating to railway infrastructure and railway safety and security.

4. Security in processing

Bane NOR works continuously to ensure that your personal information is stored so that the information is protected against unauthorized access. Access to your personal data is managed on a need-to-know basis.

5. Data processors and data sharing

Bane NOR share your data with our data processors and other relevant third parties in accordance with legal requirements. Where Bane NOR have engaged data processors to process personal data on out behalf, the processing is regulated in data processing agreements.

All personal information is stored and processed within the EU/EEA.

6. Data retention

Your personal information is stored for as long as is necessary to fulfil the purpose for which it was collected, such as managing the course participation, or to comply with government requirements or legal obligations.

7. Processing activities

We process your personal data in accordance with the requirements for the processing of personal data laid down in relevant privacy legislation. The types of personal data being processed is wide-ranging and varies with each individual processing. We collect and process your personal data for the among other following purposes

  • Camera surveillance – Bane NOR uses cameras on all railway stations to ensure security and safety
  • Customer service – Bane NOR process personal data such as name and contact information to be able to respond to inquiries.
  • Assistance on railway stations – Travelers with the need for assistance, can contact our customer service. To be able to give assistance, Bane NOR need information about need for assistance, time, place, and contact information.
  • Parking on railway stations – Bane NOR collect parking information to estimate the number of travelers from each railway station.
  • Wireless internet – Bane NOR offer wireless internet access on railway stations. When you use this service, Bane NOR collect your IP-address.
  • Websites – Bane NOR use cookies on our websites. You can find more information here.
  • Whistle blowing – Bane NOR have a portal for whistle blowing. Whistle blowing can be done anonymously.
  • Access control – Bane NOR maintains access control to all of Bane NORs buildings, construction sites and offices to make sure that access to our premises is controlled.
  • Employees at supplier companies – Bane NOR process personal data about employees, such as CV and contact information, from supplier companies.
  • Recruitment – Bane NOR process personal information about applicants to vacant positions at Bane NOR.
  • Archive – Bane NOR is maintaining a public archive in compliance with the Norwegian public authorities.
  • Procurement – Bane NOR is collecting and processing personal data in relations to procurement processes.

8. Your rights as a data subject

If you are registered in Bane NOR’s registers, you have the following rights pursuant to the GDPR.

  • Access – You have the right to be given information about what information Bane NOR are processing about you
  • Correcting errors – If Bane NOR are processing incorrect information about you, you have the right to have this corrected or updated
  • Right of appeal – If you believe that Bane NOR does not process you personal data in accordance with the GDPR, you have the right to appeal to the Norwegian Data Protection Authority
  • Deletion of personal data – You have the right to demand that your information is deleted if Bane NOR no longer has a legal basis for continued storage
  • Right to protest – Where the legal basis for Bane NOR’s processing of you information is based on legitimate interests or to pursue a task carried out in the public interest, you have the right to protest against the processing of your personal data.

9. Contact and complaint

For further information about Bane NORs processing of personal, you may contact Bane NORs data protection officer at personvern@banenor.no.

You have the right to complaint about our processing of personal data to the Norwegian Data Protection Authority, see www.datatilsynet.no.