Privacy Policy
1. Privacy Declaration
This privacy policy provides an overview of how we, HELITRANS AS (corporate ID: 980 313 360), hereafter “Helitrans”, process personal data and how we take your privacy into account.
As a provider of services, we are particularly dependent on our customers, business partners, suppliers and, not least, our own employees and co-workers, trusting us when it comes to the processing of customers’ and employees’ personal data.
Helitrans is the data controller for all processing of personal data where Helitrans itself determines the purpose of the processing of the personal data.
1.1 Background and key concepts
In 2018, Norway got new privacy regulations. The new Personal Data Act consists of national rules and the EU’s personal data protection regulation (GDPR – General Data Protection Regulation) and basically applies to all processing of personal data, both in the private and public sector, provided that electronic aids are used or that the information is included in a register.
Privacy means a legally mandated protection of privacy and your personal integrity. The protection includes your right to influence the use and dissemination of personal data about you.
By person is meant a living identified or identifiable natural person.
Personal data means information and assessments that can be linked to you as a person. Examples may be name, address, telephone number, e-mail address, IP address, car number, photos, and social security number (both date of birth and social security number). Information about behavior patterns is also considered personal data. This can, for example, be information about what you, which TV series you watch, and where you are. Information about you that tells about your racial or ethnic background, about your political, philosophical or religious beliefs, health conditions, sexual relations, and any information that you have been suspected, charged, prosecuted or convicted of a criminal offence, as well as membership of trade unions , is defined as sensitive personal data.
The processing of personal data means all operations carried out with personal data, such as collection, registration, structuring, storage and dissemination.
By controller is meant the business which is responsible for the processing of personal data, determines the purpose of the processing, and which means are to be used.
Personal data shall only be processed for specific, express, stated and legitimate purposes.
A data processor is a business that processes personal data on behalf of the controller.
A data processor agreement is an agreement between the data processor and the data controller on how personal data is to be processed.
Basis for processing means the statutory basis for processing personal data. The processing is only legal if
the data subject has consented to the processing, cf. the Personal Protection Ordinance art. 6 no. 1 a)
it intends to fulfill an agreement to which the data subject is a party, cf. the Personal Protection Ordinance art. 6 No. 1 b)
it is necessary to fulfill a legal obligation, cf. the Personal Protection Ordinance art. 6 no. 1 c)
it is necessary to protect the data subject’s vital interests, cf. the Personal Protection Ordinance art. 6 no. 1 d)
it is necessary to carry out a task in the public interest or to exercise public authority that the data controller is required to do, cf. the Personal Protection Ordinance art. 6 no. 1 e)
it is necessary for purposes linked to the legitimate interests pursued by the controller or a third party, unless the data subject’s interests or fundamental freedoms take precedence and require the protection of personal data, cf. the personal data protection regulation art. 6 No. 1 f)
By consent is meant a voluntary, specific, informed, unequivocal and active declaration from you that you accept the processing of given personal data. A consent can be withdrawn at any time.
Helitrans can process personal data if it is necessary to fulfill an agreement to which you are a party. The same applies where the processing is necessary to carry out measures that you have asked for before concluding the agreement.
Helitrans is required by legal obligations to carry out certain processing of personal data.
Helitrans collects certain personal data if it is necessary to protect a person’s vital interests. This basis for treatment is very narrow. It must be about the processing of personal data in connection with life and death, or danger to health.
Helitrans can process personal data if it is necessary to carry out a task in the public interest. The same applies if the processing is necessary to exercise public authority to which the controller is required.
Helitrans can process personal data if it is necessary to safeguard a legitimate interest that outweighs consideration of the individual’s privacy. Helitrans uses this processing basis only where the intervention in your privacy is very small, and where the advantages are greater than the disadvantages.
Data portability means the ability to move data (content) between different systems and services.
2 How Does Helitrans Process Personal Data?
Helitrans’ basic services are:
- Passenger transport by helicopter
- Transport of goods by helicopter
These are services that involve a great deal of responsibility, and which must be carried out with a great degree of accuracy in order to ensure the safety of those involved. Effective and accurate communication is important to ensure safety.
Helitrans has an activity that involves services and in the exercise of this activity, the processing of personal data is necessary in various contexts:
- Communicating with us
- Administration
- Invoicing
- Appointment
Helitrans will never sell personal data to third parties for financial consideration. It may happen that personal data is shared with third parties to carry out certain operations for Helitrans. For example, sending newsletters, rented customer follow-up system, etc.
2.1 Communicating with us
We process your personal data in one form or another when you visit our websites, social networks, subscribe to/unsubscribe from our newsletter, place orders, when we provide our services, when we invoice for our services and not least when we process job applications and hire new employees.
Purpose
Helitrans processes your personal data for:
- to deliver the services to you as a customer
- when customers involve you in the delivery of our services
- in order to be able to contact you for security reasons
- to various platforms, so that we can communicate with you and that our communication platforms appear in an effective, intentional and
- predictable way for you as an audience.
- to be able to adapt the services and information flow to you, your user habits and interests
- to be able to learn about the use of, and further develop the services for the best for you and other users.
- to identify you, create and maintain a user account for you in our online platform and online store. This gives you, for example, the opportunity
- to manage your user profile, and gives us the opportunity to inform you about matters of importance for your user account or for your use of the services.
2.2 Administration
As part of daily operations, Helitrans processes personal data when handling and planning orders
Purpose
The overall purposes of processing personal data about you as part of our daily operations are to:
- ensure a safe and efficient execution of our customers’ orders
- follow-up and information of our customers before, during or after implementation of our services
- inform our customers directly or indirectly about services, offers, services and more
3 Personal Data Processed, Basis and Purpose
3.1 General when visiting our online services
3.1.1 Collection of visitor data
When you use the Services, we collect information about, for example, the name of the manufacturer of your computer, mobile phone or smart TV, which operating system the device has, which browser version or e-mail client is used, as well as information about the connection to the Services, such as IP address. The purpose of collecting this information is to give you and other users a better user experience, and to prevent misuse of the Services.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to improve and further develop the Services for the benefit of you and other users.
3.1.2 Geographical position
When ordering transport services, you may be asked about your location. This is to simplify the ordering process so that you can start from your local area and the nearest helicopter base.
The processing basis for our use of personal data for this purpose is legitimate interest, so that use of the service will be as simple as possible.
3.1.3 Search engines
The website stores information about which keywords you use in our search tools. The keywords are stored in a separate database, and they are only stored in aggregated form. Only the search is saved and it cannot be linked to other personal data.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to improve and further develop the Services for the benefit of you and other users.
3.1.4 Comment field
Helitrans’ online services do not normally use comment fields. And does not store comments or personal data related to this either.
If a comment field is exceptionally used, it will be necessary to log in with a username and password in order to leave a comment.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to avoid misuse of the comment fields for, for example, spam and harassment.
3.1.5 Analysis and statistics
We analyze and compile information that you choose to give us in connection with surveys and similar data collections that we carry out in order to improve the offer to the public. The processing basis for this is your consent.
We analyze the use of and interaction with the Services. The analysis is created on the basis of actions performed on your device.
The statistics include, for example, which pages or news items you have visited, when and how long these are visited, which TV or radio programs are started, stopped or interrupted, actions in quizzes, games and voting.
The statistics are not used to link information back to individuals.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to improve and further develop the Services for the benefit of you and other users.
Data that is exclusively collected for analysis and statistical purposes and that is not linked to identifiable individuals is stored indefinitely. Data relating to logged-in users is deleted after 12 months of inactivity.
3.1.6 Cookies
If you are wondering how Helitrans uses cookies, you can read more about it in the article Information cookies (cookies). The purpose of cookies is to give you a better user experience and improve the Services. The processing basis for our use of personal data for this purpose is your consent and legitimate interest.
3.1.7 Logged in user
If you register and act as a logged-in user of the Services, or in other ways establish a customer relationship with Helitrans via the Services, in addition to mandatory fields such as name and e-mail address, we process the personal data you provide yourself, such as, for example, year of birth, postcode, gender, interests and photo.
Logged-in users will receive a personalized service. In order to be able to offer you this service, Helitrans analyzes your usage pattern to be able to uncover behavior and preferences in order to be able to provide recommendations and content that are relevant to you. Your personal data tells us something about how, when, if you consume content across devices and platforms and how often you use our content. All your interaction with the Services may affect this result.
The processing basis for our use of personal data for this purpose is agreement.
Data relating to logged-in users is deleted after 12 months of inactivity.
The information is deleted when you as a user delete your user account.
3.2 What personal data is processed when you contact us?
3.2.1 When ordering services
We process the following personal data about everyone who uses our services in order to be in contact in connection with the delivery of the service:
• Name
• Telephone number
• Email
In addition, the following information for these locations will be stored as part of the service assignment:
• Address
• Position data
3.2.2 What personal data is processed when you have requested to receive news / newsletters from us?
In order to be able to send out information letters (newsletters), we collect the following information with the recipient’s authorization:
• Name
• E-mail address
• Industry
• Region
• Channel (what type of information you want)
3.2.3 What personal data is processed when you contact us via a form on e-mail or via our website?
When you send us an e-mail or contact us via online form, your inquiry will be processed in one of our follow-up systems. The information that we are not obliged to record or archive will be deleted according to Helitrans’ established deletion routines.
When you contact us electronically, we will be able to receive and store from the service:
• Name
• Telephone number / email or username / identifier of the service we are contacted via.
• If you use a service that has a profile, profile information such as photos and other information will also be stored by the service
• IP adress
• Messages and information that have been sent and that must be seen as part of the contact.
Our IT solutions can store this information automatically as part of your profile in our customer follow-up system.
Which personal data is processed when services have been ordered from us and they are carried out.
In addition to our customer follow-up system, your information will be stored in the flight operation system as well as our accounting and invoicing system.
For the information we process to process your inquiry, our basis for processing is legitimate interest. The legitimate interest is to provide good customer service.
Our email solution supports TLS encryption to secure our email communications. Your email communication with Helitrans will be protected if your email provider supports this. Emails sent to Helitrans where TLS encryption is not used will not be rejected by our email solution.
Our service provider scans all incoming and outgoing e-mail for viruses and malware.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to secure Helitrans’ ICT infrastructure.
3.2.4 What personal data is processed when you follow us on social media.
When you follow us or contact us on social media, we will be able to receive and store from the service:
• Name
• Username / identifier
• Profile information such as picture and other stored by the service
Our IT solutions can store this information as part of your profile in our customer follow-up system.
3.2.5 What personal data is processed when you contact us by telephone
When you contact us by telephone, we will obtain your telephone number, from which our computer systems can look up your name and, if you are a former customer, your previous activities with us:
• Telephone number
If you call us, your name and telephone number will be stored together with information about when you called our call centre, and on the devices to which the call was connected. Names are looked up in the online telephone directory and our customer follow-up system.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to safeguard the safety of Helitrans employees and what is recorded when you visit our premises.
Helitrans has scattered locations with bases around Norway. The head office at Værnes and several of the bases are located at airports where Avinor is responsible for security and visitor control. On these, visitors will be registered by Avinor in their solutions due to security.
The processing basis for our use of personal data for this purpose is legitimate interest. The legitimate interest is to secure access to the airports and Helitrans premises.
3.2.6 Invoicing / payment of services?
When invoicing and/or payment, the following information will be stored about the person who is to receive the invoice:
• Name of invoice recipient
• Address
• Telephone
• E-mail address
Helitrans performs the invoicing of services and in this connection will handle personal data relating to the customer and the service. In some situations, customers pay for the service with payment services. Then the customer’s personal data will also be handled.
Helitrans uses a factoring partner and personal data can be shared with this third party.
When paying by credit card, credit card information will be handled against 3rd party services, such as VIPPS and iZettle, but credit card information or bank information will never be stored by Helitrans.
The exception will be if a repayment has to be made, then we will have to separately request bank information for this purpose in order to carry out a bank transaction. This information will then be stored and archived as part of accounting data according to own rules and laws.
3.2.7 Job applications and employment
If you apply for a job at Helitrans, we need to process information about you to assess your application.
Information is processed to the extent necessary to enter into or prepare to enter into an employment agreement. To the extent that your application contains sensitive (special categories) personal data, the legal basis is our Personal Data Act § 6 (processing of special categories of personal data in order to carry out employment law obligations or rights.)
Application documents typically contain:
• Name
• Address
• Telephone
• Email
• Date of birth as well as social security number
Social security numbers are particularly sensitive personal data that can be misused and special considerations are taken when such information is stored, and the information is destroyed when it is no longer required.
Helitrans does not use and does not store social security numbers other than in connection with employment.
Employees will be stored in our HR and payroll system.
4 Access Routines, Department Division and Level Division
Helitrans uses access control so that outsiders do not gain access to customer information, including personal data.
In addition, efforts are being made to divide departments and levels so that detailed customer information is only available to those who must have access to this information.
5 Data Processors and Third Parties
In order to deliver the Services to you, Helitrans uses several external service providers. Some of these are data processors who process personal data on behalf of Helitrans, while others are third parties who process personal data on their own behalf.
Helitrans uses several data processors that give us insight into the public’s usage patterns and interaction with our Services. Examples of such data processors are Google Analytics, Hotjar, Bitrix24 and Mailchimp.
When data processors process personal data on behalf of Helitran, this is regulated in data processor agreements or through other mechanisms that ensure secure processing of your personal data. If the use of data processors involves the transfer of personal data to countries outside the EEA, Heitrans will ensure that suitable guarantees are in place, for example by entering into the EU’s standard transfer agreements.
In order to adapt and further develop the Services, Helitrans uses third-party services such as elements from Google, Facebook, Twitter, YouTube, Snapchat or Instagram, where you as a user can have your own user account with the third-party service that is built-in.
Helitrans will then, among other things, be able to see aggregate information (including age, gender and location), get statistics on how many people have been to the page and seen the posts, how many have responded with clicks and reactions, etc.
Third party services available through our services are subject to the third party’s privacy policy. We encourage you to familiarize yourself with these.
Helitrans has agreements with a number of data processors who process personal data related to daily operations. This is to be able to handle, for example, salaries and telephone subscriptions for employees, and physical security for employees and visitors.
6 Your Rights and How You Can Exercise Them
6.1 Privacy representative
6.2 Withdrawal of consent
6.3 Access to own information
6.4 Correction of personal data
6.5 Deletion of personal data
6.6 Data Portability
6.7 Limited processing
6.8 Stop using personal data in connection with advertising
6.9 Other rights
7 Other Contact Information
Inquiries should be directed to HELITRANS AS (organisation number 980 313 360). For contact information, see Contact Us.
8 Information Security
Helitrans’s overall basic principles for information security apply to all users, systems and services in Helitrans. Measures for compliance with information security also apply to securing personal data that is used for journalistic purposes.
The basic principles shall contribute to ensuring that Helitrans’ information values are secured in a systematic and satisfactory manner. The basic principles are used as a basis for planning, organizing and implementing all projects that deal with information systems.
Also see the Cookie Declaration and the Transport Terms (coming soon)