Privacy policy
This Privacy Policy describes how Duvi AS collects and processes personal data in connection with the company’s business activities and services.
What is personal data?
Personal data means any information or assessments that can be linked to you as an individual. This may include, for example, your name, national identity number, address, telephone number, email address, or information relating to your employment.
Such information is necessary for us to administer customer relationships and deliver our services.
Special categories of personal data
In some cases, it may also be necessary to process special categories of personal data. These are data that are considered particularly sensitive under data protection law and are therefore subject to stricter rules for processing. This may include, among other things, health data.
Such information may be necessary in connection with insurance coverage linked to pension schemes, for example when assessing waiver of contribution in the event of disability or disability pension.
Such data will only be processed where necessary to administer the insurance scheme or to comply with legal obligations, and always in accordance with applicable data protection legislation.
1. Who is the data controller?
Duvi AS (“Duvi”) is the data controller for the processing of personal data described in this Privacy Policy. Overall responsibility for the company’s processing of personal data lies with the Managing Director.
Duvi is responsible for determining the purpose of the processing and the means used.
If you have any questions or would like to contact us, you may send an email to: ks@duvi.no
2. Purpose of processing and legal basis
Duvi processes personal data only for specific and legitimate purposes. The data will not be used for purposes other than those for which they were collected, unless there is a new legal basis for processing under applicable data protection legislation.
A substantial part of the processing of personal data takes place in order to establish, administer and follow up customer relationships. The data are used, among other things, to document and carry out agreed services related to pension schemes and associated products. The legal basis for this processing is normally that the processing is necessary for the performance of a contract with you as a customer. If you are employed by an employer that has entered into an agreement on defined contribution pensions with Duvi, the processing is necessary in order to comply with legal obligations related to that agreement.
Personal data is also processed in order to provide customer service, follow up customer relationships, and communicate with customers and members of pension schemes. In some cases, the data may also be used for analysis of products and services and for the development of new solutions. Such processing is based on our legitimate interest in offering relevant and well-functioning services to our customers.
In addition, personal data are processed to comply with statutory obligations. As a financial undertaking, Duvi is subject to various reporting and documentation requirements, including obligations towards tax authorities and other public authorities. The legal basis for this process is that it is necessary to comply with legal obligations arising from laws, regulations, or decisions by public authorities.
For pension schemes governed by the Norwegian Defined Contribution Pensions Act, insurance coverage for waiver of contribution in the event of disability, is mandatory. This means that, in certain cases, it may be necessary to process personal data in connection with assessing whether the conditions for such coverage are met.
In such situations, Duvi may process the information necessary to administer and prepare the assessment of an insurance claim. This may include collecting and compiling information from you, your employer, healthcare professionals, or public authorities such as NAV.
The information is used to administer the insurance scheme and is forwarded to the insurer, which makes the final assessment of the claim. When Duvi performs such tasks, the processing may take place on behalf of the insurer pursuant to a data processing agreement.
3. Confidentiality
Duvi processes personal data in accordance with applicable data protection legislation. Information about customers and their affairs is subject to confidentiality to the extent required by law or agreement. Information is not shared with others unless this is necessary to fulfil the purpose of the processing, or disclosure follows from law, agreement, or another valid legal basis.
4. What personal data we process
Duvi processes personal data that are necessary to deliver our services. This may include identification and contact details such as name, address, telephone number, email address, and national identity number.
In connection with the administration of pension schemes, we also process information relating to employment, including employer, salary, employment percentage, and pension accrual. We also process information related to pension savings, such as contributions, payments, investment choices, and returns. If the pension scheme includes insurance coverage for one or more risk products (waiver of contribution in the event of disability, disability pension, or group life insurance), it may also be necessary to process information related to an insurance claim. This may include health data, information about illness or reduced work capacity, information about public benefits from NAV, and other documentation necessary to assess the insurance claim.
5. Where the information comes from
As a main rule, personal data is collected directly from you. If your employer has entered into a pension agreement with Duvi, we may also receive information from your employer.
In addition, in some cases we may collect information from other sources where this is necessary to administer the pension scheme or to comply with legal obligations. Such sources may include both public and private institutions, for example the National Population Register (to update address information) or other relevant registers. When we collect information from such sources, we will inform you unless the collection is prescribed by law, notification is impossible or disproportionately difficult, or you are already aware of the collection.
Information processed without consent
We process personal data without consent where this is necessary in order to:
- perform the agreement we have with you or your employer, for example administration of a pension scheme
- comply with legal obligations, for example reporting to public authorities
- safeguard our legitimate interests, where this is permitted under applicable law
Information processed on the basis of consent
In some cases, processing will be based on your consent. This applies, among other things, to:
- processing of special categories of personal data where this does not follow from law or agreement
- sharing of information with suppliers in situations not already regulated by agreement or law
- sending electronic marketing about products and services
You may withdraw your consent at any time by contacting us.
6. Is it voluntary to provide the information?
Generally, it is voluntary to provide personal data. Where information is collected directly from you, Duvi will inform you of this and of what the information will be used for.
Where processing is based on consent, the consent must be informed. This means that you will receive sufficient information to understand what you are consenting to and what consequences this may have for you.
At the same time, not all processing of personal data requires consent. Duvi may process personal data without your consent where this is necessary in order to:
- perform agreements, for example related to pension schemes
- comply with legal obligations
- carry out tasks in line with the company’s licences and authorisations
As a management company for securities funds, with authorisation to offer collective defined contribution pensions under section 2-2 of the Norwegian Defined Contribution Pensions Act, Duvi may therefore in some cases process personal data without consent.
7. Disclosure of information
Duvi may share personal data with suppliers who perform services on our behalf, for example within IT operations or system delivery. Such suppliers’ process data in accordance with data processing agreements entered with Duvi, and they may not use the data for their own purposes.
If you are covered by one of the company’s risk products (waiver of contribution in the event of disability, disability pension, or group life insurance) linked to the pension scheme, necessary information may be shared with the insurer for the processing of insurance claims.
Information may also be disclosed to public authorities where this follows from law or regulation.
8. Transfer of personal data to countries outside the EU/EEA
Some of our suppliers operate in countries outside the EU/EEA. In such cases, we will ensure that any transfer of personal data to such countries takes place on the basis of an adequate level of protection or is subject to the necessary safeguards, for example by using standard contractual clauses adopted by the European Commission.
9. Storage and deletion
We delete personal data when it is no longer necessary to fulfil the purpose for which it was collected. This means that, if you have an agreement with us, we store the information necessary about you. When the contractual relationship ends, we store the information until the limitation period for the relevant products has expired. This is done in view of the possibility of future claims arising out of the contractual relationship.
The information may be further processed for another purpose provided that you consent or there is another legitimate basis for such further processing. For example, we may wish to retain relevant statistical data about members and pensioners over the long term.
Personal data that we process based on your consent will be deleted if you withdraw your consent. Assessments, decisions, or other processing carried out on the basis of consent will remain lawful even if the consent is later withdrawn.
If you request a pension offer or ask for information, we will retain the information you have submitted in this connection for 90 days. This applies to individuals who are not already customers of Duvi.
10. Your rights
Access
You have the right to receive information about which personal data we process and how we process them. Much of the information we hold about you as a customer is available through your personal pages. There you can also find your customer profile, where you can see which information is stored about you. In addition, you can manage your consents there.
Rectification
It is important that the information we hold about you is correct and necessary for us to implement the agreements we have entered with you and provide good service. You may request that we correct or delete information about you if it is incomplete or unnecessary. This can be done by sending an email to Duvi Customer Service at ks@duvi.no.
Erasure
Duvi deletes personal data when it is no longer necessary to fulfil the purpose for which they were collected. This means that, if you have an agreement with us, we store the necessary information about you. When the contractual relationship ends, we store the information until the limitation period for the relevant products has expired.
Right to object to processing of personal data
For certain purposes, Duvi processes personal data based on a balancing of our interests and your interests as our customer. Examples include processing related to marketing, testing of IT systems, and development of new products and services.
If there are circumstances which mean that Duvi should not process your personal data for such purposes, you may notify us by contacting us by email at ks@duvi.no. In such a case, we will carry out a specific balancing test. Duvi will continue the processing if this is necessary to establish, exercise, or defend a legal claim, or if Duvi has compelling legitimate grounds for the processing. If you are or become an employee of a company that is or becomes a customer of Duvi, we will also be subject to the follow-up required under that contractual relationship.
Restriction of processing
In some cases, you may request that Duvi restrict the processing of your personal data. This means that Duvi may continue to store the relevant data, but all other processing of the personal data must be temporarily stopped.
Examples of restricted processing:
- if you believe that the personal data are inaccurate
- if Duvi wishes to delete the data, but you need them for a legal claim
- if you have objected to the processing and it is based on a balancing of interests
Examples of when the processing may nevertheless continue:
- if necessary to establish, exercise, or defend legal claims
- to protect the rights of others
- for reasons of important public interest
11. Information security
In accordance with legal requirements, Duvi has implemented measures to comply with the provisions on satisfactory information security. All agreements entered with suppliers concerning data processing that include the processing of personal data describe security measures to safeguard confidentiality, integrity, and availability in the processing of such data.
Customer information is stored in an internal database at Duvi and with subcontractors, and is secured against unauthorised access, alteration, destruction, or dissemination. We continuously monitor which of our employees are authorised to access the database, and we seek to maintain sound administrative and technical safeguards to protect the information.
12. Secure communication
In accordance with legal requirements regarding the handling of personal data, we have put in place secure communication measures so that national identity numbers and copies of identification documents must not be sent by unsecured email.
13. About the Company's Privacy Information on our website (and blog)
Privacy and Cookies
When you use our services, DUVI stores information about you and your computer in cookies in your browser.
A cookie is a small text file that is left on your computer when you come to our website. Information you enter yourself can be linked to your user profile, and we will also store the IP address of the machine you are using. In addition, other information is stored, such as the time, so we can check when you were last logged in and adjust our service accordingly.
As an important part of our efforts to create a user-friendly website, we look at the user patterns of those who visit the site. To analyze the information, we use Google Analytics. We also do this to measure the activity on our pages and extract valuable statistics both in terms of readership, screen resolution, what devices our readers read duvi.no on, where they came from, etc. Examples of what the statistics give us answers to are; how many people visit different sites, how long the visit lasts, which websites the users come from and which browsers are used. None of the cookies allow us to associate information about your use of our website to you as an individual. If you don’t want your data to be recorded with this tool, you can download the “Google Analytics Opt-out” browser add-on.
Google Analytics information is stored on Google’s servers in the United States. Information received is subject to Google’s Privacy Policy.
How to handle cookies in your browser
On https://nettvett.no/ you’ll find information about how to set your browser to accept/reject cookies and get tips for safer Internet use.
Newsletter
It is possible to subscribe to newsletters from us to receive the latest blog posts. For this purpose, we register your email address. The legal basis is your consent. You can withdraw this consent at any time by sending an email to ks@duvi.no. Your email address is not shared with other businesses and is deleted when we are told that you do not want to continue receiving information from us. The information is also deleted if we receive feedback that the email address is no longer active.
Social media and blog features
Our site includes social media features, including sharing buttons for Facebook, LinkedIn and Twitter. Such features can register your IP address and which page you open on our site, and they can store cookies to enable features to work as intended. Social media features are operated either by a third party or directly on our site. Your use of such features is subject to the privacy statement of the company providing them.
In addition, Duvi has a blog where users are invited to leave comments. In order to publish the comments, the user must provide a name and email address. The blog comments will be stored as part of the discussion on the blog.
Duvi also sends information by email to those who are employed by companies that are our customers. To unsubscribe from these emails, you can click on the unsubscribe link at the bottom of the email. However, we will still send you the information that is required by laws regulating these agreements.
14. Contact information
If you would like to contact us about our privacy practices, please write to us as follows:
Duvi AS
Attn. Compliance Department
Adolph Tidemands gate 55
N – 2000 Lillestrom, Norway
You can also email us at ks@duvi.no
15. The right to file a complaint
If you believe that our processing of personal data is not in accordance with what we have described here or that we in other ways violate the privacy laws, you can complain to the Data Protection Authority (www.datatilsynet.no).
Ønsker du å motta et uforpliktende pristilbud for din bedrift? Legg igjen din kontaktinfo og en av våre ansatte vil ta kontakt med deg.