Privacy notice

Last update: October 2024

Our goal is to ensure that you understand how your personal data is used by Statkraft and to provide you with control over its processing. It is important that you understand how Statkraft and its companies collect personal data, and how we use it.  
 
We’ve therefore made every effort to ensure this privacy policy is easy to understand, but if you have any questions or need further information, we can always be contacted using the email address under ‘Your rights as a data subject’.  
 
This privacy notice is written in accordance with the transparency requirements of Article 13, Regulation (EU) 2016/679 (General Data Protection Regulation). This privacy statement will be updated when necessary, with any changes will be published on this page.  

For data subjects who are engaging with Statkraft from Brazil, please consult our additional privacy notice to address any additional rights you may be provided under the LGPD.

Who is responsible for your personal data 

Statkraft is made up of a number of different entities internationally. Within the Statkraft group of companies, the data controller will be either Statkraft AS and/or the Statkraft company(ies) you have your relationship with.  
 
Our local companies are also the controller of personal data to provide local processes, such as managing our relationship with you as a landowner or interacting with you as an interested stakeholder in our projects. 

What personal data do we process? 

Statkraft collects personal data to operate effectively and provide you with the necessary services. Your interaction with Statkraft may be as a landowner, a customer, a vendor, a potential job candidate, or even as a member of the public simply reaching out for information.

The nature of personal data we process therefore depends on our relationship with you, however in most cases we will process:

• contact information, such as name, contact email, telephone, address
• information relating to your accounts and contracts with us, such as contract details, payment details, bank account data
• communication and engagement related information, such as interactions with us, outlooks towards projects, meeting minutes
• information related to user behaviour on our website, collected via cookies you have consented to.

Why do we process this personal data? 

Statkraft process your personal data for several different reasons, depending on the nature of your interaction with us. We will always ensure that our processing of personal data is fair and lawful, with specific and explicit purposes identified. 

Statkraft’s processing of personal data includes but is not limited to the following purposes, using the following identified lawful basis:  

• to ensure good communication lines with our vendors and customers. Our lawful basis for processing this information is based on the performance of the contract into which we enter with our vendors and customers.
• to ensure the security and availability of our services. Our lawful basis for processing this information is our legitimate interest in safeguarding our business operations and any applicable legal requirements relating to this.
• to ensure the security and safety of our physical locations, through closed-circuit surveillance techniques (CCTV). Our lawful basis for processing this information is our legitimate interest in maintaining the safety and security of our office locations, power plants and operational centres. At some sites we may have a legal obligation to maintain surveillance technologies to secure the space.  
• to improve our services and communication channels. Our lawful basis for processing this information is based on our legitimate interest to ensure we are providing those who interact with us a high-quality service.
• for marketing and other customer relation and management purposes. Our lawful basis for processing this information is based on either consent that you have provided to us, or our legitimate interest to provide marketing to you.
• for contract management purposes. Our lawful basis for processing this information is based on the performance of the contract into which we enter with our vendors and customers.
• to manage trading services. Our lawful basis for processing this information is based on the performance of contracts we enter into with trading partners, as well as legal obligations pertaining to trade activities.  
• for communication and social media purposes, such as marketing or market research activities. We process your information for this purpose based on consent that you have provided to us, or based on our legitimate interest where we have identified this to be applicable.   
• for audit, control and review purposes. Our lawful basis for processing information for this purpose is under our legal obligations, such as the Norwegian Transparency Act, as well as safeguarding our legitimate interest in ensuring correct operating procedures in the business.
• for emergency response purposes. Our lawful basis for processing information for this purpose is to comply with legal obligations across our jurisdictions concerning emergency response.
• for integrity due diligence purposes. Our lawful basis for processing this information is based on our legitimate interest to ensure that Statkraft enter into business relations with reputable and trustworthy third parties.
• for procurement purposes. Our lawful basis for processing this information is our legitimate interest in ensuring Statkraft enter into agreements with suppliers, business partners and customers who can provide a high-quality service to Statkraft.
• for the provision of local grievance mechanisms. Our lawful basis for processing this information is our legitimate interest in ensuring we are able to thoroughly investigate and respond to grievances from individuals, local communities or representatives about Statkraft’s activities.
• for stakeholder and community engagement purposes. Our lawful basis for processing this information may be under our legal obligation to demonstrate we have conducted environment and societal impact assessments, where this is a legal obligation in the jurisdiction, or our under our legitimate interest to ensure that we have considered and discussed the impact of our activities with key stakeholders.
• for recruitment purposes. Our lawful basis for processing this information is based on information required to enter into a contract with you, and your consent where you allow us to store the information to consider you for future roles. 
  • When you are taking part in a recruitment process, we will provide you with a separate privacy notice that provides more detail on how we process the personal data. Our recruitment privacy notice is available here.

How does Statkraft collect my personal data? 

Personal data we collect about you may come from different sources. Most commonly, we collect personal data directly from you as part of our interactions to deliver the service required. On other occasions, however, personal data may be collected from from your activities as a vendor or stakeholder, or from publicly available sources.  

Here are some examples as to how Statkraft may collect personal data. This list is not exhaustive. 

Information provided by you, such as: 

• when you enter into contracts or agreements with us
• when you submit forms to us
• when you access our webpages or use our social media platforms
• when you establish an account with us as a landowner, business partner or vendor 
• when you send us emails or contact us through other means, such as by using our webform or telephone numbers

Information we obtain from publicly available sources:

• details of land ownership from nationally available databases
• integrity due diligence results from compliance and monitoring databases
• credit scores from credit institutions when entering into agreements with us
• social media profiles, where accounts are open and visible to the public 

How do Statkraft share my personal data?

On occasion, we may need to share your personal data with other parties in order to deliver the service in question. Most commonly, we may share your personal data with the following: 
 
Other companies in the Statkraft group

To the extent it is necessary for fulfilling any of the purposes above, your data is shared with other companies in the Statkraft group.

Third party suppliers 

We use a number of third party suppliers who provide services such as IT services and support, cloud services, etc. We may allow such vendors to access/receive your personal data to the extent relevant to deliver these services.

We will ensure adequate data processing agreements with our suppliers for the purpose of protecting your privacy where they are acting as a data processor to a Statkraft company.  

Where we are sharing personal data with a third party who are acting as an independent controller to Statkraft, or as a joint controller, we will ensure the inclusion of contractual clauses or data-sharing agreements to govern the use of personal data and its sharing.

Public authorities

We will also disclose your personal data where required by law, by order or requirement of a court, administrative agency or government tribunal or in response to legal process. 

Transfers of personal data from the EEA to third countries 

When sharing personal data, we may, on occasion, need to transfer personal data to a country that is outside the EEA for the ability to fulfil one of the purposes described above.  

Statkraft is currently implementing Binding Corporate Rules (BCR). The BCR will establish a legal basis for the intra-group transfer, meaning between other Statkraft companies, of personal data outside the EU/EEA and will be binding for the Statkraft group of companies that process personal data.

Transfers of personal data to a third country outside of the EEA that does not provide adequate protection will only take place if appropriate safeguards are in place. Where the BCRs are not applicable, these safeguards may be achieved through entering EU Standard Contractual Clauses, or the existence of certified international transfer mechanisms. 

Keeping your personal data secure

Statkraft is committed to protecting the security of your personal data.  

We manage your personal data so it is accurate, readily available and handled in accordance with its sensitivity.  

We use a variety of security technologies and information security measures to help protect your personal data from unauthorized access, use or disclosure.  

We limit access to your personal data to only personnel or third parties who are tasked with processing this data on Statkraft’s behalf. These parties are subject to strict requirements regarding confidentiality. Statkraft may implement disciplinary actions or terminate agreements if these conditions are not met.  

How long do Statkraft keep my personal data for? 

Your personal data is stored for as long as is needed, or as is permitted in relation to the purpose for which it was collected and any applicable laws. The legal basis for which we process your personal data, as described above, heavily influences the storage period we rely on.

Where there is a legal obligation to which Statkraft are subject, we will retain your personal data for as long as is stipulated in the law. Once this period has been fulfilled, we will then delete your personal data.

If you have provided us with consent to process your personal data, we will delete the personal data should you revoke your consent. You have the right to revoke your consent to processing of personal data at any time.  
Should the processing be based on the performance of a contract you have entered in to with Statkraft, your personal data will be deleted on the fulfilment or expiry of the contract.

Where we have identified that your personal data is processed based on Statkraft’s legitimate interest, we will retain it for as long as is necessary to achieve the purpose for which it was collected. In some cases, we may need to retain personal data longer than after your relationship with Statkraft has ceased. An example of this may be where we retain information to answer complaints or queries, and we retain the data for longer in case further queries still arise.

Your rights as a data subject

Under certain national and international data protection legislations, you may at any time exercise one of the following rights, free of charge:

• Right to access personal data – you have the right to request a copy of the personal data that we hold about you, and how it has been processed.
• Right to correct personal data – if you believe that personal data we hold about you may be incorrect, you have the right to request this data be updated.
• Right to erasure of personal data – in some circumstances, such as where we no longer have a justifiable reason to continue processing your personal data, you have the right to request deletion of your personal data.
• Right to object to use of your personal data – in some circumstances, you can request that we temporarily suspend the processing of your personal data.
• Right to restrict the processing of your personal data – where applicable, you have the right to restrict how we process your personal data
• Right to portability – where applicable, you have the right to receive personal data about you, which you have provided to us, in a structured, commonly-used and machine-readable format, and have this data transmitted to a third party.
• Right to object to automated decision-making – where applicable, you have the right to receive information about the logic involved in the automatic processing of your personal data, in the case of automated-decision making.

If you have any questions about the processing of your personal data, or wish to exercise one of the data subject rights mentioned above, please contact our central Privacy team at privacy@cnof86.com.

How to lodge a complaint: 
 
If you have a complaint regarding the processing of your personal data, you are welcome to contact us using the same email address above. We will do our best to respond to your request and address your concerns, however in the event you are not satisfied with our response, you may contact the Norwegian Data Protection Authority, Datatilsynet, to lodge a complaint. Their details are available here.

If you are a resident within another EU / EEA jurisdiction, you may also choose to contact your local Data Protection Authority. You can find a full list of local Data Protection Authorities here.