Privacy policy

General

Public Property Invest ASA, company reg. no. 921 563 108, ("PPI ASA") owns, manages and develops social infrastructure properties throughout Norway. The properties are generally owned by PPI ASA's subsidiaries, which you can find more information about here (the "Subsidiaries"). PPI ASA's subsidiaries, Public Property Forvaltning AS ("PPI Forvaltning") and Public Property Drift AS ("PPI Drift") assist with the management of the properties.

We process personal data about the contact persons of entities that are, have been or wish to be tenants, visitors to our properties and contact persons at our suppliers or other business partners. In addition, we process your personal data if you visit our website or social media pages, subscribe to our newsletter, apply for a job with us or are in contact with us in any other way. We also process personal data about shareholders, board members, managers, as well as related persons of these persons, and others as necessary in connection with our compliance with applicable legislation.

In this privacy notice we provide you with information about what personal data PPI collects, why PPI processes the personal data, and your rights related to our processing of personal data.

If you have any questions about our processing of your personal data or wish to exercise your privacy rights, please contact us at gdpr-no@publicproperty.no.

Data controller

PPI ASA is the data controller for the processing of personal data about visitors to our website, our premises or our social media pages, persons who contact us in other ways, and shareholders, board members, managers, as well as related persons of these persons, and others as necessary in connection with compliance with the Public Limited Liability Companies Act.

PPI ASA and the Subsidiary that owns the property in question are joint data controllers for the processing of personal data in connection with the fulfilment of practical and administrative tasks related to owning, managing and developing the property/premises in question. However, the Subsidiary that owns the property in question is an independent data controller for the processing of personal data in connection with the fulfilment of contractual or statutory rights and obligations related to the property.

The company you apply for a position with is the controller of the personal data processed in connection with the processing of your job application. If you are applying based on a job advertisement, more information about this company will appear in the job advertisement.

The company that enters into the agreement with your employer or client is the data controller for the processing of personal data about contact persons at suppliers or other business partners.

Each PPI company is an independent controller for the processing of board members and observers in its own company.

The controller(s) of the processing will be referred to as "PPI", "we" or "us" in the following.

Our processing of your personal data

Contact persons at potential or current tenants

When you express interest in a rental property

If you are the contact person for an entity that expresses interest in one of our rental properties, we process your personal data, including title/position, name, e-mail address and workplace. We receive the personal data directly from you or the entity that lists you as a contact person. The processing is carried out in order to respond to and manage interested tenants. The legal basis for the processing is a balancing of interests where our legitimate interest is to manage interested tenants and enter into agreements with new tenants (GDPR Article 6(1)(f)).

If a lease agreement is not entered into with PPI, the personal data will be stored for the aforementioned purpose for up to six months after the process of finding a new tenant has been completed.

During and after the lease period

If you are the contact person for one of our tenants, we process personal data about you, including your name, telephone number, address, e-mail address, title/position, e-mail correspondence with you, your enquiries, meeting minutes and other information about you that is relevant to the lease of the property. We receive the personal data directly from you, the entity that lists you as a contact person or our own organisation.

We process the personal data in order to meet and on the basis of our legitimate interest to (GDPR Article 6(1)(f)):

Execute and manage our rights and obligations in the lease agreement;
Establish, assert or defend our rights and obligations in the event of any legal disputes in connection with the lease agreement; and
Manage payments in connection with the lease agreement.

Your contact details may also be processed to fulfil our statutory bookkeeping and archiving obligations (GDPR Article 6(1)(c)).

The personal data is stored for the aforementioned purposes for as long as it is necessary to fulfil our rights and obligations in connection with the lease agreement, and as a general rule five years after the end of the tax year from the termination of the lease agreement.

List of interested parties

If you are the contact person of one of our former or current tenants, we will process your name, telephone number, position/title and employer in order to contact you by telephone about properties or premises that we believe may be of interest to the entity you represent. The processing is based on our legitimate interest in leasing out our properties/premises to tenants (GDPR Article 6(1)(f)). We receive the personal data directly from you, the entity listing you as a contact person, our own organisation or public sources.

The personal data is deleted when we become aware that you are no longer the contact person for the former or current tenant.

Property transactions

In connection with the purchase or sale of a property or a company that owns a property that you or someone you represent owns, leases or has owned/leased or in which you are employed, personal data may be processed and transferred between the buyer or seller of the property, as well as PPI ASA and possibly these companies' professional advisers. The personal data typically includes your name, position, e-mail address, information about your ownership of the object of sale and any agreements you have entered into in connection with the property/company.

The processing is necessary for our and the seller's or buyer's legitimate interest in evaluating and/or carrying out the transaction. The basis for processing is a balancing of interests where our legitimate interest is to fulfil the aforementioned purpose (GDPR Article 6(1)(f)). We obtain the personal data directly from you, the entity listing you as a contact person, our own organisation or the buyer/seller in the transaction.

The personal data will be retained for the aforementioned purposes for up to three years after the transaction has been completed or, if a transaction is not completed, until we have decided that the transaction will not be conducted.

Contact persons at suppliers or other business partners

To process and evaluate offers from suppliers and other partners, we may process the name, job title, CV, education and work experience of employees of these parties. The processing is based on our legitimate interest in evaluating and selecting the best offer (GDPR Article 6(1)(f)). The personal data is processed for this purpose for three months after the assignment has been carried out or, if the offer is not accepted, after the contract has been signed.

To administer rights and obligations in supplier and other business relationships, we process the name, title/function and contact information of our contact persons at suppliers or other business partners, as well as correspondence with these contact persons. The processing is based on our legitimate interest in being able to communicate with, administer and fulfil rights and obligations towards suppliers and other business partners (GDPR Article 6(1)(f)). We may also process this personal data in order to fulfil the legal obligations incumbent on us under applicable laws on, among other things, accounting, tax and money laundering (GDPR Article 6(1)(c)).

We receive the personal data directly from you, the entity you are acting on behalf of or our own organisation. We may also receive the personal data from third parties, such as authorities or publicly available sources.

The personal data is retained for the aforementioned purposes for as long as it is necessary to fulfil our legal obligations or rights, normally for five years after the end of the tax year from the termination of the contractual relationship.

Subscriptions to our newsletters

If you subscribe to our newsletters, we will process your name and email address to send such newsletters to you. The processing is conducted on the basis of your consent (GDPR Article 6(1)(a)). You have the right to withdraw your consent at any time by unsubscribing from the newsletter or contacting us by using the contact information you can find in the bottom of this privacy notice. We receive the personal data directly from you.

The personal data is processed as long as you consent to the processing.

Job seekers

When you apply for a position with us, we process your personal data. The personal data that may be processed is your name, national identity number, address, e-mail address, telephone number, education, police certificate of conduct, personality tests, work experience, references, and other information you provide in your application or that is obtained from references or interviewers. We obtain personal data directly from you, our own organisation, your references or public sources.

The processing is based on our legitimate interest in administering and processing your application and finding employees suitable for the work (GDPR Article 6(1)(f)) and to review your application based on your request to potentially enter into an employment contract (GDPR Article 6(1)(b)). A police certificate of conduct is only obtained where this is authorised by law and is a necessary security measure for the position in question. You can always object to us conducting a personality test.

Personality tests and police certificates of conduct are deleted immediately after the position has been filled. We store your other personal data for up to one year after the recruitment process has been completed, unless there is a need for a longer storage period to defend or assert legal claims. If you consent (GDPR Article 6(1)(a)), we may also process your personal data for a longer period of time in order to contact you about relevant vacancies.

Visitors and others staying at our premises

In some of our premises we have access control. If you visit or stay at our premises, we can thus process your name and time of entry and exit of our premises. The processing is based on our legitimate interest in safeguarding the property and the safety of those staying at the property (GDPR Article 6(1)(f)).

Personal data processed in connection with access control is deleted 90 days after the relevant entry or exit.

If you use our wireless network at the premises, we will process your IP address and the name of the device you use to give you access to the wireless network. The processing is based on our legitimate interest in offering you to log on to the wireless network (GDPR Article 6(1)(f)). The personal data will be deleted within 24 hours after you have logged on to the wireless network.

Where our tenants have established video surveillance and/or access control, our tenants are data controllers for the processing of personal data in this connection. We refer you to the tenant and the tenant's privacy notice for more information about the tenant's processing of personal data.

People who contact us

If you contact us, for example by e-mail, telephone or social media, we will process your name, title/position, telephone number, e-mail address, address and other personal data provided in connection with the enquiry to respond to the enquiry. The processing is based on our legitimate interest in answering your enquiry and helping you with your questions (GDPR Article 6(1)(f)).

The personal data is stored for three months after the enquiry was received, unless it is necessary to store the personal data for a longer period to answer and handle the enquiry.

Board members and observers – the Limited Liability Companies Act

If you are a board member or observer in a PPI company, this company will process your name, attendance at meetings, voting and statements to ensure proper governance and documentation. The processing is based on the necessity to comply with company law obligations (GDPR Article 6(1)(c)) and our legitimate interest in ensuring proper governance and documentation (GDPR Article 6(1)(f)).

The personal data will be stored for ten years after the board meeting.

Shareholders, board members, managers and their related persons – the Public Limited Companies Act

PPI ASA carries out the following processing of personal data to fulfil legal obligations applicable to the public limited liability company (including the Public Limited Liability Companies Act, the Securities Trading Act, the Accounting Act and the Market Abuse Regulation) (GDPR Article 6(1)(c)):

Name, position, company affiliation, transaction details (share purchases/sales) and position in the company of presenters, managers, board members, primary insiders and primary insiders' related persons to send out stock exchange announcements and otherwise maintain the duty of disclosure towards the market.
Name, contact information, national ID number, function in the company and time of access to insider information for primary insiders to comply with the statutory obligation to maintain insider lists.
Name, position, related persons and share purchases/sales of managers, board members and their related parties to fulfil the notification requirement for trading of financial instruments.
Name, address and ownership share of shareholders to document ownership and exercise shareholder rights.
Names, identity papers, proxy statements and voting of shareholders and proxies to conduct and document general assemblies.
Names, salaries, remuneration and loans to management, CEO, board members and auditors to provide insight into remuneration and financial ties.

We may publish or otherwise share the personal data with the public or the Oslo Stock Exchange for the aforementioned purposes where this is necessary to fulfil our legal obligations.

The personal data is stored for as long as it is necessary to fulfil the legal obligations, but never longer than ten years.

Who we share your personal data with

We may share personal data with data processors who process the personal data on our behalf. This may, for example, be a company that supplies broadband or a company that manages our IT systems. Some partners and suppliers may have parts of their operations in countries outside the EU/EEA (a so-called third country). We have ensured that your personal data is subject to adequate security guarantees, through the use of the EU's standard contractual clauses for such transfers or through transfers to countries that have been pre-approved by the European Commission. Please contact us by using the contact information you can find in the bottom of this privacy notice if you would like more information about this.

We also disclose your personal data to authorities when required by law or governmental decisions. If all or parts of our business is sold or integrated with another business, we may also disclose your personal data to advisors and potential buyers. If we need professional assistance, we may also share your personal data with our professional advisors, such as lawyers or auditors.

Your rights

You have the right to demand access to, rectification of or erasure of the personal data we process about you if the conditions for this are met. In some cases, you also have the right to demand restricted processing, to object to the processing and to data portability (the right to receive or transfer personal data in a suitable format). If the processing is based on your consent, you may withdraw your consent at any time. If the processing is based on a balancing of interests, you can request access to this assessment.

If you wish to exercise your rights, please contact us by using the contact information you can find in the bottom of this privacy notice.

You also have the right to complain about our processing of your personal data to the Norwegian Data Protection Authority. For more information about this, see here (link). We encourage you to raise any objections to or concerns with PPI's processing of personal data with us first, so that we can try to sort it out together.

Changes

The privacy notice in force at any given time will be available on our website. If we make changes to our processing of personal data, the notice will be updated, and significant changes will be notified.

If we make changes to the processing of personal data that require your consent, we will obtain your consent before implementing such changed processing.

Contact details

If you have any questions about this privacy notice or our processing of your personal data, please contact us using the following contact details:

Public Property Invest AS
Postal address: Pb 1882 Vika, 0124 Oslo
Visiting address: Haakon VIIs gate 1, 9th floor, 0161 Oslo
gdpr-no@publicproperty.no