We need your personal data in order to establish and maintain your customer relationship so that you can use our banking and financial services. We also process personal data to provide you with information and offers, and to fulfil our legal obligations.
When you become a customer, we must register relevant information about you. Some information is required for all customers, while other information depends on the products and services you will use.
To establish a customer relationship, we must verify your identity. This is an important security measure that ensures we know who we are entering into a customer relationship with and who is using our services. We use BankID for secure login and signing of agreements, although some services may also be used without BankID.
We primarily process your personal data because it is necessary to perform an agreement with you. In addition, we are required to process personal data in order to comply with legal obligations under financial services legislation and other applicable regulations.
Identification and contact information.
In connection with the establishment of a customer relationship, we are also required by law to process information to prevent and detect financial crime. See the section 'Preventing and detecting financial crime' for more information.
We collect this personal data directly from you and from the Norwegian National Population Register.
We retain this information for up to 13 years after the end of the customer relationship.
When you are a customer, we use your personal data to provide you with account and payment services. You can manage your customer relationship and carry out banking services through online and mobile banking. Here, you can enter into new agreements, manage accounts, cards, payments, loans, savings products, consents, and communicate digitally with the bank.
If you indicate that you have a trade union membership, we use this information to ensure that you receive the benefits you are entitled to.
We also process information about which payment services you have activated in connection with your cards and which payment service you have used to complete a purchase, such as Vipps and Apple Pay.
We primarily process your personal data because it is necessary to perform an agreement with you. In addition, we are required to process personal data in order to comply with legal obligations. For certain services and purposes, we also process personal data based on your consent.
Identification and contact information, card and account information, transaction data and trade union membership.
We collect personal data directly from you. Depending on the service, we may also collect information from third parties such as Lånekassen (the Norwegian State Educational Loan Fund), Gjeldsregisteret (the Norwegian Debt Register), your trade union or other banks.
We retain this information for up to 13 years after the end of the customer relationship.
We use your personal data when you apply for loans and other forms of credit. We conduct a credit assessment to determine whether we can approve your application. This applies to mortgages, credit cards, consumer loans and other credit facilities.
Our credit processes are fully or partially automated. This means that decisions may be made without human involvement. If a decision is based solely on automated processing and has legal or similarly significant effects on you, you have the right to request a manual review, to express your views and to contest the decision.
Once a loan agreement has been entered into, we use personal data to manage the customer relationship and monitor repayments. In the event of non-payment, we may share necessary personal data with debt collection agencies.
We primarily process personal data because it is necessary to perform an agreement with you. We are also required to process personal data in order to comply with legal obligations.
This depends on the type of loan, but may include identification data, financial information, income, assets, debt, transaction history, employment details, education and family situation.
We retain this information for up to 13 years after the end of the customer relationship. Certain data related to risk assessments may be retained for up to 50 years in accordance with regulatory requirements.
We use personal data to assess credit risk and risks related to capital requirements when offering loans and other forms of credit. This means that we analyse your personal data using models and methods to calculate the probability that a loan will not be repaid as agreed. Such assessments are necessary to ensure responsible lending and to safeguard both you as a customer and the bank’s assets.
Processing takes place both when you apply for a loan and during the customer relationship in order to monitor risk over time.
We process personal data in order to comply with our legal obligations. In some cases, processing is based on legitimate interests, where we have assessed that our interest in ensuring sound risk management outweighs any potential privacy impact for you.
Identification and contact details, financial information including income, assets, debt and credit history, transaction data, employment details, education, family situation, business interests and use of the bank’s products and services.
We retain this information for up to 50 years after the end of the customer relationship.
We process personal data in order to establish and manage your savings accounts and to provide investment services.
To provide investment services, we collect information that enables us to assess your suitability and appropriateness in relation to the intended investment service or product. This may include portfolio management and trading in financial instruments.
We are required to document all communications relating to investment services. This includes recording telephone calls and storing electronic communications.
Some savings and investment products are available through our partners. To access these products, you may need to enter into separate agreements with the relevant partner.
We primarily process personal data because it is necessary to perform an agreement with you and to comply with legal obligations.
Identification data, contact details, risk profile, financial information and other information arising from communication with you.
We retain this information for up to 13 years after the end of the customer relationship. Recordings are retained for at least 5 years.
We want to be available to our customers both digitally and physically to provide the best possible customer service and advisory services. Online and mobile banking are our preferred channels for secure communication, but we are also available via email, chat, phone, meetings and other channels such as social media.
We store all written communication and summaries of oral communication with you in order to follow up and document your enquiries. Summaries may be created with the support of artificial intelligence, including transcription of conversations.
We may record calls for training and quality assurance purposes. You will be given the option to opt out of such recordings.
We primarily process your personal data because it is necessary to perform an agreement with you. We also process personal data based on legitimate interests, where we have assessed that our interest in providing good customer service and efficient handling of enquiries outweighs any potential privacy impact for you.
Identification data, contact information and other information arising from communication with you.
We retain this information for up to 13 years after the end of the customer relationship.
Our chatbot is designed to streamline customer service and respond to simple enquiries. In some cases, we use artificial intelligence (AI) to enable the chatbot to understand questions and provide you with appropriate answers. Such answers are provided with the proviso that responses may contain errors.
If you want to speak to an adviser during a chat, the chat conversation will be made available to the adviser so that we can assist you more efficiently.
If you start a chat without being logged in, we will only process your IP address. Chat conversations may be used for statistics and analysis in order to improve our services. Once you log in, the conversation will be linked to you as a customer.
We primarily process your personal data because it is necessary to perform an agreement with you. We also process personal data based on legitimate interests related to service improvement.
If you are logged in, we process identification data, contact details and other information from the conversation. If you are not logged in, we only process your IP address.
If you are logged in, we retain chat conversations for up to 13 years after the end of the customer relationship. If you are not logged in, we retain chat conversations for one year.
In some cases, you may interact with a voicebot to receive more efficient customer service by phone. Artificial intelligence may be used to interpret your enquiries and provide responses.
We conduct spot checks of voicebot interactions in order to improve functionality. For this purpose, conversations may be recorded and reviewed. Audio files containing personal data are excluded from improvement work.
We primarily process your personal data because it is necessary to perform an agreement with you. We also rely on legitimate interests for quality improvement and efficient service provision.
Identification data, contact details and other information arising from communication with you.
We retain this information for up to 13 years after the end of the customer relationship. Recordings used for improvement purposes are retained for up to 30 days.
We process personal data in order to provide insurance products, including pension, life and non-life insurance.
The type of personal data processed depends on the insurance agreement, for example health data for personal insurance or vehicle data for motor insurance.
Insurance products are offered by our partners and require separate agreements with those partners.
We primarily process personal data because it is necessary to perform an agreement with you and to comply with legal obligations.
Identification data, contact information, health data, risk profile, product and financial information.
We retain this information for up to 13 years after the end of the customer relationship.
We process personal data in order to provide you with relevant information, advice and offers regarding our products and services. This applies both when you are a customer and when we contact you without an existing customer relationship.
Marketing may take place through various channels, including online and mobile banking, email, SMS, post or telephone. The channels used will depend on the type of communication, your customer relationship and your preferences.
We respect your preferences if you have opted out of marketing.
We process personal data based on legitimate interests, where we have assessed that our interest in informing you about relevant products and services outweighs any potential privacy impact for you. For personalised marketing, including combining and analysing multiple types of data, we only process personal data if you have given your consent.
Identification data, contact details, date of birth and information about the products and services you have with us or that may be relevant to you.
If you have consented to personalised marketing, we may also process additional personal data stored about you, except for sensitive data such as trade union membership.
If you are a customer, we primarily collect information directly from you. If you are not a customer, we may have obtained your contact details through events, referrals or publicly available sources.
We do not store personal data specifically for marketing purposes. The data is reused from other parts of the customer relationship and is used only as long as it is relevant and lawful. Processing ceases if you opt out or withdraw your consent.
We process personal data in order to prevent, investigate and report financial crime, including fraud, money laundering, terrorist financing and violations of sanctions. The purpose is to protect you as a customer, the bank and society.
When you become a customer, we verify your identity and ask questions about the purpose of your customer relationship and how you intend to use our services. We also carry out ongoing risk assessments and monitoring of customer relationships and transactions.
This includes the use of both manual and automated processing methods, including profiling and the use of artificial intelligence.
If we detect suspicious activity, we may process personal data in order to temporarily block your cards, accounts or BankID to protect you from fraud. Such actions may be based on automated processing.
We also use personal data to identify customers and transactions subject to international sanctions.
We process personal data in order to comply with legal obligations under financial services legislation. In some cases, processing is based on legitimate interests, where our interest in preventing and handling financial crime outweighs potential privacy impacts.
Identification data, contact information, customer relationship data, use of services and financial data such as account information and transaction data. We may also process relationship data and information about politically exposed persons (PEPs) and beneficial owners.
We collect personal data directly from you or from public registers such as Folkeregisteret (the Norwegian Population Register), Gjeldsregisteret (the Norwegian Debt Register), Motorvognregisteret (the Norwegian Vehicle Register), Matrikkelen (the Norwegian Property Register), and Brønnøysundregistrene (the Brønnøysund Register Centre).
We retain this information for up to 13 years after the end of the customer relationship.
We work continuously to ensure that your personal data is protected. We implement organisational, technical and physical measures, including governance frameworks, access control, logging, encryption, firewalls, backups and other safeguards.
These measures help protect your personal data and our systems from cyberattacks, accidental events and other risks. In some cases, these measures involve processing personal data.
We process personal data to comply with legal obligations and based on legitimate interests in maintaining security for you and the bank.
Identification and contact data and any additional information processed as part of our security measures.
We do not store personal data specifically for security purposes, except for recordings from video surveillance, see the section 'Video surveillance'.
We use video surveillance to prevent undesirable incidents and to ensure documentation in the event of serious situations. If an incident is investigated by the police, we may disclose recordings in accordance with applicable regulations.
We process personal data based on legitimate interests, where we have assessed that our interest in ensuring the safety of employees, customers and assets outweighs any potential privacy impact for you. We may also disclose recordings when required by law or lawful orders from public authorities.
Images and video recordings.
We retain this information for up to 90 days.
We process personal data to ensure sound and responsible governance of our operations. This includes analysing and combining data to gain insight into how our products and services are used, and what needs and expectations our customers have.
These insights are used to improve existing solutions, develop new products and services, and ensure that we are organised with appropriate capacity and expertise.
We process personal data in order to establish, exercise or defend legal claims. We retain documentation and history related to your customer relationship for as long as you may bring claims against us under your agreement. The limitation period determines how long the information is retained.
We process personal data based on legitimate interests related to safeguarding our legal interests.
Documentation and historical records relating to your customer relationship with us.
We retain this information for up to 13 years after the end of the customer relationship.
We process personal data to produce statistics for internal use and to share with public authorities and other organisations. The statistics consist of aggregated data that cannot be linked to you as an individual.
Examples include general trends such as consumption patterns, housing types or average expenses. The purpose is to gain insights and identify societal trends.
We process personal data based on legitimate interests, where we have assessed that the interest in generating insights outweighs any potential privacy impact for you.
The types of personal data depend on the specific statistical purpose.
We do not store personal data specifically for statistical purposes. Processing ends when the data is aggregated and no longer linked to individuals.
We process personal data in order to verify and ensure that we are organised and operating in a responsible manner. Controls are carried out on an ongoing basis, including spot checks, thematic reviews and internal and external audits.
Personal data may be included in these control activities, for example when assessing the quality of data collected for anti-money laundering purposes.
We process personal data in order to comply with legal obligations.
Depends on the purpose of the audit or inspection.
Retention is governed by other purposes for processing personal data.
