Privacy policy
1. Information we collect about you
This privacy policy sets out the basis on which Canica AS and Canica Eiendom AS (hereinafter: Canica) prosess personal data about the following persons:
- Job applicants, references and attestants
- Visitors to our website
- Visitors to our social media
- Tenantries, suppliers and collaborators
We collect and use personal data about you for different purposes depending on who you are and how we get in touch with you. Below we have provided an overview of the purposes for which we process personal data, the types of personal data we process and the legal basis for the processing. You will also find information about who we share personal data with, how long it is stored, your rights as a data subject and what security measures we have implemented.
2. Contact information
The controller of your personal data is Canica AS (org. no. 938 701 237) and Canica Eiendom AS (org. no. 891 450 052).
Visiting address: Karenslyst allé 4, 0278 OSLO
Postal address: Postboks 313 Skøyen, 0213 OSLO
E-mail address: post@canica.no
Phone: +47 24 13 30 00
3. Why do we collect personal data and what kind of information we collect
3.1 Introduction
All processing of personal data takes place in accordance with the privacy regulations in force at any given time, including the Personal Data Act, the General Data Protection Regulation (GDPR) and associated regulations.
"Personal Data" means any information that may be linked to a natural person (the latter is referred to as "registered").
"Processing" means any operation made with personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
We collect and use your personal data for various purposes. Below you will find information about the operations.
3.2 Job applicants, references and attestants
Canica processes personal data about job applicants, references and attestants in connection with recruitment processes. We process personal data contained in application documents, including applications, CVs, employee reference letters, references, information provided in connection with interviews and more. The processing takes place on the basis of the data subject's request before entering into an agreement and a balancing of interests, as it is necessary to be able to carry out the recruitment process and assess the applicant's qualifications. Special categories of personal data are only processed if necessary for the position.
For applicants who are rejected, the personal data is normally stored for 6 months from the rejection. If the applicant consents to longer storage, the personal data is stored during the period for which the consent applies or until the consent is withdrawn.
3.3 Visitors to our website
3.3.1 Visitors to www.canica.no
Canica.no is currently using the following cookies:
- canica_session: Contains a session code that associates the user's browser with the web server. Use to store "state" on interactive elements on the page. Has a lifespan of two hours.
- XSRF TOKEN: Security key used to secure forms and so on that are submitted to the solution. Has a lifespan of two hours.
The cookies are necessary for the webpage to work properly and have session duration.
3.3.2 Visitors to www.oslotreet.no
Oslotreet.no is currently using the following cookies:
- Crumb: Prevents cross-site request forgery (CSRF)
- Test: Investigates if the browser supports cookies and prevents errors
The cookies are necessary for the webpage to work properly and have session duration.
3.4 Visitors to our social media
3.4.1 Canica on LinkedIn
Canica shares news and other material over LinkedIn. LinkedIn stores personal data that users have disclosed about themselves and others in posts, in their profile, when uploading or synchronizing contacts, calendar information or emails, using services to customers and partners, by logging users' use of the services and storing usage data and location data using cookies and similar technologies. Read more about LinkedIn's processing of personal data here: https://www.linkedin.com/legal/privacy-policy.
Our processing of usage analytics data is limited to what is reported by LinkedIn. Before Canica is granted access to the usage data, the personal data is anonymized.
If you communicate directly with us through our social media pages, for example by sending us a message, commenting on posts etc., we will get access to the information you have chosen to publish and make available on social media. The processing takes place on the basis of a legitimate interest as it is necessary to ensure optimal operation and provide good service, cf. Article 6 (1) (f) of the GDPR.
3.4.2 Oslo Treet on Instagram
Canica shares news, updates and other material regarding Oslo Treet on Instagram. Instagram stores personal data that users have disclosed about themselves and others in posts, in their profile, when uploading or synchronizing contacts, using services to customers and partners, by logging users' use of the services and storing usage data and location data using cookies and similar technologies and so on. Read more about Instagram’s processing of personal data here:
https://help.instagram.com/519522125107875/?maybe_redirect_pol=0
If you communicate directly with us through our social media page, for example by sending us a message, commenting on posts etc., we will get access to the information you have chosen to publish and make available on social media. The processing takes place on the basis of a legitimate interest as it is necessary to ensure optimal operation and provide good service, cf. Article 6 (1) (f) of the GDPR.
3.5 Tenantries, suppliers and collaborators
Canica records personal data about tenantries, suppliers and collaborators. Personal data in agreements and archive-worthy correspondence is stored and archived, while other personal data is deleted. The processing is necessary to ensure compliance with the agreement, for the administration of tenantries, suppliers and collaborators relations, cf. Article 6 (1) (b) and (f) of the GDPR. Archived personal data is stored for up to 3 years after the tenantries, supplier or collaboration relationship has ceased.
4. Categories of recipients of personal data
It may be relevant to disclose personal data to public authorities, suppliers (IT, accounts, auditing etc.), collaborators etc. Canica does not pass on personal data to others unless there is a legal basis for such disclosure. Examples of such a basis may be consent, that the disclosure is necessary to fulfil an agreement, that there is a legal basis that necessitates disclosure or that Canica has a sufficiently justified interest.
Canica uses data processors to process personal data on our behalf. The data processors act in accordance with the concluded data processing agreement.
Some recipients may be located in countries outside the EU and EEA. The transfer of personal data takes place in accordance with the EU standard transfer agreements.
5. Your rights as a data subject
5.1 Right to withdraw consent
If processing of your personal data is based on consent, you can withdraw your consent at any time. If the consent is withdrawn, it does not affect the legality of previous processing based on the consent before it is withdrawn, cf. Article 7 of the GDPR.
5.2 Right of access
You have the right to request access to the personal data that we process about you, cf. Article 15 GDPR. The right to access does not apply to personal data as mentioned in Section 16 of the Personal Data Act.
In order to ensure that personal data is disclosed to the right person, we may require information necessary to verify the identity of the data subject, cf. Article 12 (6) of the GDPR.
5.3 Right to rectification
Under Article 16 of the GDPR, you may have the right to have incorrect personal data about yourself corrected. As a general rule, you also have the right to have incomplete personal data completed, including by making a supplementary statement.
5.4 Right to require restriction of processing
Pursuant to Article 18 (1) of the GDPR, you may have the right to demand that the processing of personal data about you to be restricted. If the processing has been restricted, the data controller shall, with the exception of storage, only process the personal data for processing specified in Art. 18 (2) of the GDPR. If the processing has been restricted, you have the right to be notified before the restriction is lifted.
5.5 Right to object to processing
Pursuant to Article 21 (1) of the GDPR, you have the right to object to the processing of personal data about you that is of legitimate interest pursuant to point f of Article 6 of the GDPR. Canica may continue to process your personal data if there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or to establish, enforce or defend legal claims.
5.6 Right to data portability
Under Article 20 of the GDPR, you may have the right to receive personal data that you have provided us in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller. You have the right to have your personal data transferred directly from us to another data controller if technically feasible.
5.7 Right to erasure ("right to be forgotten")
Under Article 17 of the GDPR, you may have the right to have personal data about you deleted.
We will as far as possible accommodate a request to delete personal data, but we cannot do so if there are weighty reasons not to delete, for example that we have a statutory storage obligation or continued storage is necessary to establish, enforce or defend legal claims.
5.8 Limitations of your rights in the law
Your rights may be limited by law or pursuant to law, see Article 23 of the GDPR.
6. Right to complain to the Norwegian Data Protection Authority
You have the right to complain to the Norwegian Data Protection Authority if you believe that Canica's processing is in violation of the GDPR and the Personal Data Act, as well as other laws and regulations regulating processing that fall within the scope of the Personal Data Act and the GDPR pursuant to Section 2 of the Personal Data Act, cf. Article 77 of the GDPR and Section 20 of the Personal Data Act. You can find information about how to contact the Norwegian Data Protection Authority on their website: www.datatilsynet.no