1. Our responsibility for your privacy
This privacy policy applies to everyone who requests support from the Olav Thon Foundation (hereinafter the 'Foundation'). When we use 'we, our, us' in this privacy policy, we mean the Foundation.
You can be sure that we process your data in a lawful and secure manner.
2. Data controller
The Foundation is the controller of your personal data. We decide why and how personal data is processed.
Our contact details are:
Olav Thon Foundation
Postboks 489 Sentrum, 0105 Oslo, Norway
3. Your personal data: What do we do?
3.1 Application for support
When you apply for support from us, we collect the following information from you:
- Contact details (name, phone number and email address)
- Organisational affiliation
- Bank account number (for approved applications)
The basis for this processing of personal data is the fulfilment of the support agreement (GDPR Article 6 (1) b).
It is necessary for us to keep all applications in order to see the application history. This is to be able to document the grounds for rejection or to be able to document whether the project has previously received support. The data is stored for the life of the company.
4. Cookies
You can read more about our use of cookies in our Cookies Policy here.
5. Where is your personal data stored?
Personal data is stored on servers within the EU/EEA. We do not store personal data in countries outside these areas.
6. Who do we share your personal data with?
We enter into data processing agreements with our suppliers and require them to provide guarantees that they process your data safely and securely and only for our purposes.
7. Security of processing
We have established appropriate security measures to protect the integrity, confidentiality and availability of your personal data. These measures include both technical solutions, such as access controls and encryption, and organisational procedures that ensure the proper processing of the data.
Access to your personal data is strictly limited to employees with a business need for such access and who are authorised to process the data in accordance with applicable guidelines. We conduct regular reviews of access levels to ensure that only the necessary people have access to data.
We provide training to employees and relevant third parties to promote awareness of the Foundation’s guidelines and data protection policies and to ensure that everyone who handles personal data has sufficient competence and understanding of the applicable regulations.
Employees of the Foundation are bound by a duty of confidentiality and we have established internal procedures to handle any violations of privacy. In the event of deviations or a suspicion of unauthorised access, we take the necessary measures to limit damage and notify the affected parties in accordance with legal requirements.
8. Your rights when we process your personal data
8.1 Right to erasure (right to be forgotten)
You have the right to have your data deleted in the following cases:
- You exercise your right to object to the processing of your data and we do not have a legal basis to retain it.
- If you have withdrawn your consent and we still process your data for the purpose of the consent.
- If we still have your data stored after the purpose has been fulfilled.
- If we have collected the information illegally.
- If we are legally obliged to delete data.
Your right to erasure does not apply in the following cases:
- We have a legal retention obligation, such as pursuant to the Norwegian Bookkeeping Act.
- Storage is necessary to establish, exercise or defend legal claims.
8.2 Right of access
You can request access to the personal data we hold about you and obtain a copy of this. You are entitled to:
- Confirmation of who is responsible for processing your data
- A copy with an overview of the information we have
- Justification for the processing of your data
- Know which categories of data we hold about you
- Know which recipients we share your data with and whether we share it outside the EEA
- If possible, you should be informed about how long we store your data
- Know whether we have collected the information from another source if we have not collected it directly from you
- Know whether we make automated decisions and if so, what this means for you
We may refuse access in the following cases:
- The access concerns a data subject other than yourself and would infringe their rights and freedoms
- We have a legal duty of confidentiality
- The data is used in connection with the investigation of a possible criminal offence
8.3 Right to rectification
You have the right to have incorrect or incomplete personal data corrected.
8.4 Right to restriction
You can request the restriction of processing, for example while we are considering an objection or rectification. You can request a restriction of processing if:
- You contest the accuracy of the information
- The processing is unlawful, but you object to deletion
- We no longer need the data, but you need it for legal claims
- You have objected to the processing and an assessment is underway
8.5 Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to have this data transferred to another controller.
This right only applies when the processing takes place automatically and is based on consent or agreement. The right does not apply if it would infringe the rights or freedoms of others.
8.6 Rights regarding automated decision-making
You have the right to object to automated processing of personal data that involves profiling if this has a legal effect on you or otherwise significantly affects you.
8.7 Right to withdraw consent
If the processing is based on consent, you can withdraw this consent at any time. This does not affect the lawfulness of any processing carried out prior to the withdrawal of consent.
8.8 Right to object
You can object to processing based on legitimate interest. We must then stop the processing unless we can demonstrate compelling legitimate grounds.
We may continue processing if we can demonstrate compelling legitimate grounds that outweigh your interests, rights and freedoms or if processing is necessary to establish, exercise or defend legal claims.
8.9 Your right to lodge a complaint with a supervisory authority
We encourage you to contact us first. If you still wish to contact the Norwegian Data Protection Agency, you can find their contact information here.
9. Contact us
If you have any questions, objections or wish to exercise your rights, you can contact us directly at .
We are obliged to respond to your request regarding your rights within 30 days of receipt.