Safeguarding your privacy

You have the right to request access to the personal data we process about you, and you have the right to receive a copy of this information. You also have the right to information about how we process your data. Information about this can mainly be found in this privacy policy.

Information about, for example, your products, agreements, contact information and transaction history are available in your online bank. If you cannot find the information you are looking for, please send us a request for access. We may ask you to clarify what information or processing activities you want to access. In those circumstances where your online bank is not available or you cannot read electronic documents for some other reason, we can send you the information on paper.

There are some exemptions to the right of access. These include when we have a legal duty of non-disclosure or we have to keep information confidential for the prevention, investigation, detection and prosecution of criminal acts. Another exemption exists regarding information that is solely contained in documents prepared for internal use and an exemption from access is necessary to ensure proper processing.

It is important that the information we have about you is correct. SpareBank 1 checks its data against the Norwegian Population Register and other sources. At regular intervals, we also ask you in your online or mobile bank to confirm that the information we hold about you is correct. If you believe that the information we hold about you is incorrect or incomplete, you have the right to request that the information be corrected or updated.

You have the right to request that your personal data be deleted if

• you withdraw your consent to the processing and no other legitimate basis for the processing exist
• you exercise your right to object to the use of your personal data and there are no compelling grounds for the processing
• you object to the use of your personal data for direct marketing purposes
• the processing is illegal
• the personal data processing concerns minors, if the data was collected in connection with providing information society services

In many circumstances, we have to retain information about you, even though you want the information deleted. This may be true both while you are a customer of ours and for a period after the agreement with us has ended. In practice, this means that you may not always be able to require us to delete your data. This may be because we have a legal duty to retain it or because we must safeguard our legitimate interests. Similarly, we may need to retain your information to establish, exercise or defend a legal claim.

You can require that SpareBank 1 restrict the processing of your personal data in certain situations, for example if

• you believe that the personal data is incorrect or that the processing is not lawful
• SpareBank 1 wants to delete the data, but you need the information due to a legal claim
• you have objected to the processing and we need to assess whether we have a legitimate interest in continuing to process it

We will keep the relevant data stored, but all other processing of the personal data will be temporarily suspended. SpareBank 1 may begin processing your personal data again in connection with legal requirements or to protect another person’s rights.

If you are entitled to require that only a limited number of employees may and are able to access your personal data, we will facilitate this.

For further terms and conditions and information on protecting personal data, email the bank's data protection officer.

You have the right to obtain a copy of the personal data you have given us in a machine-readable format. Unlike the right of access, this right only applies to personal data that you have provided to us and that is processed on the basis of consent or agreement.

You have the right to require SpareBank 1 to stop processing your personal data if the processing is based on legitimate interests, unless there are grounds that take priority over your interests or serve to establish, enforce or defend legal claims. You may also require SpareBank 1 to stop using your personal data for direct marketing sent directly to you, including profiling for such purposes.

If you wish to exercise your rights, please email the data protection officer at the bank or company.

Email is considered an unsecure channel. We recommend that you do not send us confidential information via email. We will respond as quickly as possible and within no more than 30 days. If it is clear to us that the matter will take longer than 30 days to process, we will let you know.

• Identification and personal information such as name, national identity number, citizenship, other identification numbers issued by the government and copies of proof of identity.
• Contact details such as phone number, address and email address.
• Financial information such as customer and product agreements, credit history, account numbers, balances, payment card number and transaction data.
• Messages and communication with the bank, annual statements and bank statements.
• Information required by law such as tax country, foreign tax registration number, information in connection with financial advice, information related to anti-money laundering work and reporting to public authorities.
• Special categories of personal data such as information about health and trade union membership in connection with the purchase of personal insurance or the conclusion of agreements with LOfavør AS.
• Information on income, assets, debt, place of work and employment, education, marital status, family relations and dependent responsibilities.
• Photos and video recordings taken in connection with our customer and sponsorship events.
  
• Audio recordings may also be made when you talk to us on the phone. You can choose to refuse this when you call customer services. We are required by law to make audio recordings when you receive investment advice from us.
• Our premises and ATMs have camera surveillance for security purposes.
• If you have consented to this in your cookie settings for our websites, data is collected on your use of our websites and online and mobile banks.

The main purposes behind processing your personal data are customer management, financial advice, billing and the implementation of banking, insurance and financial services as they are described in agreements we have entered into with you. All of the agreements we have with you, or will enter into with you, describe their terms and conditions clearly such that it is easy to understand what the agreement includes.

We also process your personal data in order to meet our legal obligations, such as:

• Preventing and detecting criminal acts such as money laundering, terrorist financing and fraud.
• Monitoring sanctions.
• Accounting requirements.
• Reporting to tax authorities, law enforcement agencies, enforcement and supervisory authorities.
• Risk classification related to risk management such as credit development, credit quality, capital adequacy and insurance risk.
• Credit rating.
• Requirements and obligations related to payment services.
• Other obligations related to service or product-specific legislation such as securities, funds, collateral security, insurance or home loan mortgages.
  

We may use your personal data if this is required to safeguard a legitimate interest that outweights considerations concerning your privacy. The legitimate interest must be legal, pre-defined, real and factually rooted in our business activities.

Examples of basing our processing on legitimate interest include:

• Marketing, product and customer analyses that help us improve our solutions and provide our customers with the best possible services, products and offers.
• Checks, reporting and analyses that help us develop our business and systems, as well as ensure that our operations are properly managed.
• Profiling, for example when conducting customer analyses for marketing purposes or monitoring transactions to detect fraud and other criminal acts.
  
• Transaction classification of your income and expenses to provide you with a better overview and understanding of your personal finances.
• Automatic transfer to your SpareBank 1 bank when you log into your mobile bank, so you do not have to disclose your bank affiliation every time you log in.
• Developing and using machine learning models to identify suspicious transactions in connection with statutory anti-money laundering work.
• Using machine learning and artificial intelligence to classify your transaction details, including in order to provide you with a better overview of where your money goes.
• Identifying your subscriptions or other regular expenses that we can help you terminate.

When we process personal data about you on the basis of our legitimate interests, you can object to the processing. Read more about the right to object under Your rights.

In some cases, we will ask for your consent to process personal data. Any consent given by you must be voluntary, unconditional and informed. Consent is one of the bases for processing if we need to process special categories of personal data (e.g. information about health and trade union membership).

We also use your consents to, for example, collect information about your activities on our websites (via cookies) and send you more personalised marketing based on data we hold about you.

If you have given us consents concerning cookies or marketing, you can withdraw these at any time in the online and mobile banks. If you withdraw your consent, the processing will stop and the personal data associated with the consent will be deleted. 

We will process your personal data to fulfil the obligations we have assumed concerning the performance of transactions and services for you. For example, we will need to process your personal data to send you invoices, execute payment transactions on your accounts and respond to your enquiries.

Basis for processing: Agreement, legal obligations.

We want to provide you with information about products within the product categories where you already have an agreement with the bank and/or the individual company. In these circumstances, the bank/company will use personal data such as name, contact details, date of birth and the services or products for which the customer already has an agreement. 

Our products are distributed across the following categories:

• Payment services
• Savings and deposit products
• Loans and other credits
• Pension insurance
• General insurance
• Personal insurance

Using personal data, interests and user group profiles, we personalise communication, ads, advice and offers to ensure that they are relevant and useful. The information about you may also be used in analyses and customer surveys to develop and improve products and services and enhance customer service. We will only analyse your transaction data for marketing purposes if you have consented to this.

You may also see ads from us on social media, external news sites and other wesites when we buy ad space through various media.

We use various analytical tools based on what you have consented to. For example, various analytical tools are used to:

• Collect statistics concerning your usage patterns.
• Systemise statistics and build segments for relevant content in our digital channels, for example, websites, apps, on social media and via ads.
• Test and present relevant content to you.

We process personal data in connection with market and customer satisfaction surveys. For example, after you have been in touch with us, we ask you to tell us how you experienced the contact. Your feedback helps us to provide you with even better products and services. We can also measure the effectiveness of improvement and look at the link between customer satisfaction and customer behaviour over time.

Responding to such surveys is voluntary.

Basis for processing: Legitimate interest.

We use certain personal data to assess risk in the sale of products and services. This provides you, the customer, with the confidence that your assets will be well taken care of.

The Financial Institutions Act, Securities Trading Act and CRR/CRD IV Regulations require us to process credit information, application information and other information about you in order to calculate capital requirements for credit risk. Such processing is also carried out when you establish a customer relationship and when assessing which services and products are suitable for you.

The calculations are conducted using our own models, work processes, decision-making processes, control mechanisms and internal guidelines. This applies to the classification and quantification of credit risk and other risks. In other words, the risk associated with credit and other financial factors is assessed. In conjunction with this, personal data may be collected from credit information agencies. Information may also be collected from the Norwegian Debt Register to develop risk assessment models and to draw up individual credit policy rules.

The Financial Institutions Act, Securities Trading Act and CRR/CRD IV Regulations require companies in the Group to exchange customer information in order to fulfil the institution’s governance, control and reporting requirements. This particularly applies to information regarding defaults on commitments. 

Basis for processing: Legal obligations.

We process personal data to prevent, detect, clear up and deal with fraud and other criminal acts against you, other customers or us.

We will also process personal data to prevent and detect transactions related to gains derived from criminal acts or in conjunction with terrorist financing. This is done because we are required to investigate and report suspicious transactions under the Anti-Money Laundering Act, as well as to verify the identities of all of our customers.

The Anti-Money Laundering Act requires us to report suspicious information and transactions to the Financial Intelligence Unit (EFE) of the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim). The information will be collected from, and may be disclosed to, other banks and financial companies, the police and other public authorities. 

Basis for processing: Legitimate interest, legal obligation.

We always strive to ensure that your personal data is secure. This is done through access management, logging, encryption, firewalls, access control and camera surveillance, as well as other measures that safeguard your security and the security of SpareBank 1. We have a management system for information security, nonconformance management and training.

When you use SpareBank 1's digital services, we can identify the computer or mobile device you use to perform the banking service, record user behaviour and the user environment, the state of the computer/device, etc. SpareBank 1 uses this information to verify that it is the right person using the service. How your personal data is processed when you use BankID is described in the terms and conditions for BankID(pdf) and in BankID's privacy policy. 

SpareBank 1 does not store or process biometric information such as fingerprint and facial recognition data on your phone if you choose this to log in to our services. This information is only stored locally on your mobile phone and will not be sent to SpareBank 1. The biometric data on your phone is processed by the manufacturer (Apple, Google, Huawei, Samsung, etc.). For further information on the use and storage of biometric data, please refer to the manufacturer’s privacy policy.

It is up to you as the customer to choose the log in solution (PIN code or biometrics) you want to use.

Basis for processing:Agreement, legal obligation,  legitimate interest.

We are always striving to improve and enhance our systems, services and products. We depend on being able to use data for testing and development purposes in order to safeguard personal data security and ensure that our solutions work properly. The general rule is that fictitious or anonymised data must be used, although sometimes we need to use real customer data to ensure functionality and security.

Basis for processing: We rely on developing and testing new solutions before they are put into production in order to ensure our customers are offered good solutions. In our opinion, such processing is very close to our original purpose of delivering products and services to our customers. We have documented this via a so-called compatibility assessment.

We also use personal data to ensure that the bank is well managed and to gain insights into customers. Information about your customer relationship will therefore be included as part of the basis for managing and supervising the bank. Furthermore, we use personal data to organise ourselves according to our customers’ needs and expectations, as well as to provide a basis for making decisions on new customer concepts, delivery models, organisational changes and adjustments to capacity or competence.

Basis for processing: The basis for processing is a compatibility assessment, as the processing is very close to our original purpose of delivering products and services to our customers.

We also process personal data to produce statistics for our own purposes and to share with public enterprises and private organisations. The statistics will be aggregated data that cannot be linked to you as a person. For example, the statistics will be based on demographic information, product information and transaction information. Both we and public and private organisations can only use the statistics to improve goods, services, communication and services for consumers. 

Examples of statistics include the most popular time of day for people to visit grocery stores, how many customers live in a detached house, sustainability reporting or what average citizens in a municipality pay for electricity, phone subscriptions, food consumption, etc.

Basis for processing: Legitimate interest.

The banks and companies in SpareBank 1 have a duty of confidentiality regarding customer information. The duty of confidentiality also applies between the companies within SpareBank 1. There are some exemptions where the companies in SpareBank 1 may in some circumstances share some personal data with each other where this is allowed. This could be

• your contact details
• your date of birth
• information about the SpareBank 1 company in which you are a customer and the services and products you have entered into an agreement to receive

A typical case where information will be shared is, for example, between your bank and SpareBank 1 Forsikring to see whether you need any of the products or services that can be delivered. Information about customers will never be shared between the banks in the Alliance. 

If you would like more relevant advice and offers from us, you can consent to the companies in SpareBank 1 sharing more information about you.

In many cases, SpareBank 1 is required to disclose personal data to public authorities. Examples of these include disclosing information to tax authorities, the Norwegian Labour and Welfare Administration (NAV), the courts, the police, supervisory authorities, the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) and public committees. Registered personal data will only be disclosed to public authorities and other third parties when this is required by statutory disclosure obligations or disclosure rights.

If we are permitted to do so by law, personal data may be disclosed to other banks, insurance companies, financial companies and partners. One example where this might happen could be if you want to see your account information in another bank, or if you want to see your insurance from Fremtind in your mobile bank.

For payments to or from abroad we will provide pertinent personal data to the foreign bank. The laws of the recipient country determine the extent to which the information is disclosed to government agencies or regulatory bodies. This might be done to comply with the recipient country’s tax laws, measures against money laundering or terrorist financing.

If you default on your credit agreements, the information may be disclosed to a debt collection company for the purpose of collecting the defaulted claim on behalf of the creditor. The claim may also be sold to a debt collection company which then takes over as creditor for the claim.

Norway has entered into agreements with several countries on mutual tax reporting to combat tax evasion and international tax crime. The agreements are often referred to as CRS (Common Reporting Standard) and The Foreign Account Tax Compliance Act (FACTA). Under the agreement, Norwegian financial companies are required to identify and report persons, companies and other entities that reside or are domiciled abroad to the Norwegian tax authorities. You can get more information about CRS and FATCA from the Norwegian Tax Administration.

• SpareBank 1 Utvikling – our own IT and development company that provides services for the entire SpareBank 1 Alliance.
• Amazon (AWS) – the platform we use to build our digital bank, financial platform, etc.
• TietoEvry – one of SpareBank 1’s largest subcontractors of core banking and other payment systems.
• Microsoft—for example, for Teams meetings with you or general email correspondence.

SpareBank 1 primarily wishes to use data processors based in the EU/EEA. If SpareBank 1 uses providers outside the EU/EEA, we will ensure that the following conditions are met to ensure that the privacy and rights of our customers are well safeguarded:

• There is an approved transfer basis for the delivery of personal data to a third country, such as the use of standard contracts (EU standard clauses) approved by the European Commission, the data processor has valid, binding corporate rules (BCR) or the European Commission has decided that there is an adequate level of protection in the relevant country.
• The level of protection for the processing of personal data in a third country has been assessed as corresponding to the level of protection in the EU/EEA, as a result of specified technical and/or organisational measures.

We use cookies in our digital channels: websites, online bank and mobile bank.

Cookies are small pieces of data that are stored on your computer or your mobile phone by the browser or app you are using. A cookie belongs to a specific website and therefore cannot be read by other websites. 

If you use our website without identifying yourself, the cookie consent will only apply to the device (such as mobile or PC) you are using. When logging in to your online or mobile bank, you can choose to allow the answer from the device to apply to you as a customer as well. 

You can choose which categories of cookies we can use. 

Technical cookies

For the websites to work, we must use technical cookies. These, therefore, cannot be turned off.

In addition to cookies, we use pixels and scripts from third parties. These are snippets of code that allow us to analyse your usage across social media and our channels, and we use this to give you more relevant marketing. 

You can choose which categories of cookies we can use.

The following provides an overview of changes made to the privacy policy.