1. Data controller
Misjon Sarepta (corporation no. 913 786 602 ) is the controller of the personal data processed through our websites and our registration and administration system.
Mission Sarepta, 4365 Nærbø
Email: it@misarepta.no
Website: misarepta.no
2. Who and what do we record?
This statement applies to the information we hold in our system. We have two groups.
Employees and volunteers with access
- Name, email address and mobile number
- Role and access level
- What locations and events you are assigned to follow up on
- When you last logged in and what you changed
Participants and guests
- Name and contact information of the person registering
- Names and ages of everyone coming
- Dates, location, room and board
- Allergies and special needs, if you enter them
- Travel information when booking a pick-up: flight number, time and luggage
We do not have card numbers, account numbers or other payment information. Payment is made somewhere else than here.
3. Basis and purpose
Agreement (GDPR art. 6 b)
- To carry out the event you have registered for
- To provide you with an account and access when you work for us
- To send you login codes and messages related to your registration
Legitimate interest (GDPR art. 6 f)
- Internal operations and administration
- To see who has changed what, so errors can be corrected and abuse detected
Legal obligation (GDPR art. 6 c)
- Requirements arising from law, where applicable
4. Health information
When you sign up, you can enter allergies and special needs. What you enter there is health information under Article 9 of the General Data Protection Regulation, and it has stricter protection than the rest.
Our basis is your express consent (Art. 9, No. 2, Letter a). You give it by entering the information, and the field is voluntary. If you leave it blank, the registration will work just as well.
How we treat it:
- The field is encrypted in the database . It is the only information about you that is encrypted.
- It's folded up on the screen , so anyone who just wants to see who's coming won't be able to see it.
- It is only visible to the person assigned to follow up on that particular location . A colleague in another location will not see it.
- It is deleted after three years , along with the name.
If you book a pick-up and check the box for a wheelchair or other equipment, it will be stored with the travel information and not in the field above. It is practical information for the driver, and it is not encrypted.
5. Data processors and third parties
We do not share personal data with anyone for commercial purposes. To operate the service we use this, and all three are data processors with an agreement:
- Gigahost AS , Sandefjord — server and database (Norway)
- Amazon Web Services , Stockholm — all mail out (EU)
- Cloudflare , EU endpoint — nightly database backup (EU)
SMS is sent through 46elks AB in Sweden. They are not a data processor for us: a Swedish e-communications provider is an independent data controller for the actual shipping of the message, in the same way that Posten is for a letter. They are subject to Swedish e-communications law and supervision by the Swedish Post and Telecom Agency.
We also release information to public authorities where required by law.
None of them store the information outside the EU/EEA.
6. Storage time
We store as long as we need it, and no longer.
| What | How long |
|---|---|
| Registrations: name, contact information, allergies and special needs | 3 years after the event |
| Entries: number, dates, location, age and gender | Remains as a statistic, without a name |
| Mobile number and content of SMS we have sent | 180 days |
| The cybersecurity review: address and progress | 2 years from last activity |
| Trash | 1 year, then it is deleted for good |
| User account for employees and volunteers | Until the account is deleted |
After three years, the name is removed from the registration, not the row. The contact person is deleted, the participant names are cleared, as are allergies, special needs, and internal notes. Again, there are numbers, dates, location, age, and gender — numbers we need for planning, and which do not point to anyone.
7. How we secure the information
- Everyone who has access logs in with their own password and a one-time code from their phone. Shared logins are on their way.
- Access is granted per location and per task. Anyone who registers in one location does not see another.
- Every change is logged with who and when.
- The link you receive in a registration email is the key, and we only store a copy of it. We cannot recreate the link — not even with us. If you use it, it will be given a new lifespan, so it will last as long as you follow up on your registration. If it stops working, we will delete the copy one month later.
8. Your rights
According to the Personal Data Act and GDPR, you have the right to:
- Access — find out what information we have about you (art. 15)
- Correction — have what is wrong or incomplete corrected (art. 16)
- Deletion — request that data be deleted, unless we need to keep it (art. 17)
- Restriction — request that processing be restricted (Art. 18)
- Data portability — get what you have provided to us in a machine-readable format (art. 20)
- Objection — object to processing based on legitimate interest (Art. 21)
- Withdrawing consent — for allergies and special needs, you can ask us to delete what you have written at any time
Write to it@misarepta.no . We will respond within 30 days.
9. Cookies
We only use cookies that are necessary for login and sign-up to work. We do not use tracking, analytics or marketing.
10. Right of appeal
If you believe that we are processing personal data in violation of the regulations, we would like to hear from you first. You also have the right to complain to the Norwegian Data Protection Authority :
- Website: datatilsynet.no
- E-mail: postkasse@datatilsynet.no
- Phone: 22 39 69 00
11. Changes
We update this statement when something changes. We will notify you of significant changes by email or when you log in. The date at the top shows when it was last changed.