Agreement on data processing in connection with filming and photography at Torucon events (GDPR)
Use of individual words
This agreement is about personal data, but for simplicity we will use words such as "information", "information", or "data". Read about personal data on the Norwegian Data Protection Authority's pages.
For those under 15
If you are younger than 15 years of age, you cannot agree to us storing data about you on your own. In that case, you must get your parents, foster parents or similar to read the agreement and approve it on your behalf.
Data controller
The data controller (Torucon) is the one who decides what data is collected and what it is used for. To contact us regarding privacy issues, please send an email to our contact person or send us a letter to the address provided.
Contact person
Aurora Schmidt-Brekken Vollvik
aurora.vollvik@torucon.no
Business
Torucon
Org. no. 997 804 996
Postal address
Torucon v/ Eirin Ellingsen
Høvdingvegen 82
7725 STEINKJER
About the treatment
What information is collected
Name
E-mail address
Phone number
Video recording
Images
The purpose of collecting the data
Name, email address and phone number are collected in order to confirm the identity of the person depicted if they contact us to exercise their rights.
Images and video recordings are collected for use as advertising for Torucon, including for sharing in our social media profiles (such as Facebook, Instagram, Twitter and YouTube), on our website and as printed posters, booklets, flyers, and the like. In this context, the images and video recordings may be edited as needed (cutting, cropping, color adjustment, text, etc.).
We may also collect a separate image of the depicted person together with their name, email address and/or their phone number, which will be used to identify which images and video recordings the depicted person is in, if necessary to fulfill the depicted person's rights.
The basis for processing the data
Discretionary assessment for situational images (where the activity in the image is more important than the people in the image).
Written consent for portrait photos (where the people in the photo are the main focus).
Written consent on a separate card defines which event the agreement applies to.
How long the data is stored
Images and video recordings will be stored indefinitely, or until the person depicted requests to exercise their right to rectification or erasure of their personal data. If the images or video recordings have several people as subjects, these will not be deleted, but the person requesting deletion will be anonymized (deleted) unless deletion is the only option for practical reasons.
Data processors
The following organizations are involved in the processing of your data. This means collection, storage, transfer, etc. of the data. We have entered into a separate data processing agreement for each organization, which states that they cannot use the data for anything other than what we have agreed. For those organizations that are located in countries outside the EEA, or that are multinational companies with branches outside the EEA, we have also entered into extra strict agreements to ensure that the data is transferred safely if it needs to be sent outside the EEA.
To gain access to the agreements, you can contact us by email or post. Data processors are also obliged to provide access to the information they have stored about you and to correct or delete it upon request.
Google Workspace
Google
+47 800 30 103
https://workspace.google.com/
Purpose
Storage of data on behalf of Torucon. This includes image and video material, information about volunteers and competition participants, emails, etc.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
YouTube
https://www.youtube.com/t/terms_dataprocessing
Purpose
Storage and publication of images and video on behalf of Torucon.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
Twitter, Inc.
c/o Trust & Safety - Legal Policy
1355 Market Street, Suite 900
San Francisco, CA 94103
Fax: 1-415-222-9958 (attn: Trust & Safety - Legal Policy)
Twitter International Company
c/o Trust & Safety - Legal Policy
One Cumberland Place
Fenian Street
Dublin 2
D02 AX07
Ireland
Fax: 1-415-222-9958 (attn: Trust & Safety - Legal Policy)
https://twitter.com/
Purpose
Storage and publication of images and video on behalf of Torucon.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
https://www.facebook.com/legal/Workplace_GDPR_Addendum
Purpose
Storage and publication of images and video on behalf of Torucon.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
Purpose
Storage and publication of images and video on behalf of Torucon.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
DigitalOcean
DigitalOcean, LLC
privacy@digitalocean.com
https://www.digitalocean.com/
Purpose
Operation of servers and databases on behalf of Torucon. Storage and processing of various types of data.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
Squarespace
Squarespace, Inc.
Attention: Legal - Privacy
225 Varick Street, 12th Floor
New York, NY 10014 United States
Squarespace Ireland Limited
Attention: Legal - Privacy
Squarespace House
Ship Street Great
Dublin 8, D08N12C
Ireland
https://www.squarespace.com/dpa
Purpose
Storage and publication of images and video on behalf of Torucon.
Third country
This data processor is located in a country outside the EEA, or has branches both inside and outside the EEA, and is subject to additional requirements to guarantee that all data is processed securely and in accordance with EU and Norwegian data protection rules.
Your rights
We are obliged to follow up on your rights. If you wish to exercise any of the rights described here, please send us an email or letter.
Right of access
You have the right to know, among other things, why and how we process data about you and what data we have stored. At the same time, there are some exceptions, for example if the access would violate the rights and freedoms of others.
You should receive the information you request as soon as possible, and within one month at the latest.
Read more about the right of access on the Norwegian Data Protection Authority's website.
Right to rectification
If you notice that we have stored information that is incorrect, you have the right to request that we correct the information. However, there are many cases where rectification is not practically possible, for example.
We will correct your information as soon as possible, and within one month at the latest.
Read more about the right to rectification on the Danish Data Protection Agency's website.
Right to erasure
In some cases, you can demand that your data be deleted. This applies, for example, if we have obtained your consent to collect your data and you withdraw your consent.
We will delete your data as soon as possible, and no later than within one month.
Right to restriction
For example, if you have requested rectification of your data, you also have the right to stop all use of your data while we are working on the corrections. Your data will still be stored, but we cannot use it for anything without your permission. When a restriction is lifted, you will always be notified first.
We will ensure that your data is restricted as soon as possible, and within one month at the latest.
Read more about the right to restriction on the Danish Data Protection Agency's website.
Right to protest
Sometimes we will process data about you without asking for your consent. In these cases, we will provide another legal justification for the processing, for example, that the data is necessary to perform the service you wish to use. In other cases, we may be required by law to process the data.
Apart from this, you have the right to object to the processing. If you object, we can no longer use your data. If the data is not also used in other contexts, it will also be deleted. You also always have the right to object to the use of your data for direct marketing purposes.
We will respond to your protest as soon as possible, and within one month at the latest.
Read more about the right to object on the Danish Data Protection Agency's website.
Right to data portability
You have the right to receive your data in a format that makes it easy to read by another system, so that you can easily get an overview or transfer the data to another service provider.
The data must be transferred encrypted and we must be able to confirm who you are before we disclose the data. This right only applies to data collected directly from you, such as information from a user account. We must deliver your data as soon as possible, but no later than within one month.
Read more about the right to data portability on the Norwegian Data Protection Authority's website.
Right to information
You have the right to receive easy-to-understand information about how we use your data and your rights. We have done our best to write as briefly and simply as possible, but if something is still difficult to understand, you can send us an email, contact us on Facebook, or send us a letter. We'll do our best to explain what you're wondering about!