Protection of personal privacy

In DNB, we take the security of your personal data seriously, which means that it is safe for you to use the products and services we offer. As an international financial services group we have a duty of confidentiality and will handle your personal data in accordance with prevailing data protection legislation. The controller in the DNB Group will be a subsidiary of DNB ASA in or outside Norway which processes personal data about you because you are, for example, a customer of the entity in question. Click here to find the companies in the DNB Group. Please find contact details and guidance for complaining, in the bottom section Contact information.

Examples of the types of personal data DNB may collect are specified below. Please note that the type of personal data that is collected will depend on the product or service we are providing for you as a customer or related to one.

Identification information: national identity number and name. tax purposes or foreign tax identification number, BankID , a copy of your identification such as a passport, driver’s licence or the like.

Relations information: spouse, child, civil status, roles regarding customer relation, nationality, country of domicile for tax purposes, roles connected to collateral object

Most of the personal data DNB registers will be collected directly from you as a customer, for instance when we process applications for loans or other products or you use our services in some other manner.

To be able to offer you services and comply with statutory requirements, DNB will also gather personal data from third parties. In connection with outgoing payments, for example, we may collect information from payers, shops, banks, payment service providers and others.

Examples of such sources of information include:

When you visit DNB’s website, cookies are stored on your device. By device we mean, for example, your PC or mobile phone. Information capsules or "cookies" are small text files that are stored locally on your device and that make it possible to collect data about the use of our website. 

DNB is required by law (e.g. according to the Norwegian Securities Trading Act) to record telephone conversations and store electronic communication in which you, as a customer, are given advice about loans, saving, investments or similar services. DNB records all conversations you have with advisers or brokers, e.g. in Markets, DNB Private Banking or DNB Asset Management, who provide the aforementioned services. DNB may listen to conversations and review other electronic communication for quality control purposes. 

To prevent and detect criminal acts, buildings managed or leased by DNB are monitored by surveillance cameras. 
As a rule, surveillance videos recorded by security cameras that DNB controls are stored for seven days after the recording date. Surveillance footage of bank offices, branch offices, ATMs and payment terminals linked to in-store banking outlets is stored for 90 days. These storage periods apply except in cases where the surveillance video is given to the police or DNB has the right to use the video recordings for another purpose.

DNB will use your personal data to meet its obligations when executing orders for you and according to service agreements with you, and in connection with customer administration and invoicing. When entering into agreements with you and during the term of such agreements, DNB will register information about you and other persons involved in the contractual relationship, e.g. authorised users. DNB will also register information about individuals with whom it has declined to enter into agreements as a basis for informing the individuals that their application was declined and to be able to document the circumstances later on, if necessary. 

In customer relationships, we process identification information, contact information, financial information, relation information and digital behavioral information for marketing purpose on the DNB Group's financial products and services.

You have the right at any time to object against the processing of your personal information for marketing purpose. Please find below the information necessary to use your right to object in the chapter «What are your rights / Object against treatment and purpose

Below you will find specific information about scoring as a method for determining the relevant message to our customers. We also provide information about customer matching as a method of marketing directly on our customers' user profile in social platforms.

In DNB we define profiling as automated processing of data to analyze or to make predictions about customers; for example, assessing or classifying customers based on characteristics related to their financial situation, their personal preferences or transactional behavior.
 
We use profiling in connection with the preparation and implementation of marketing campaigns, for customer follow-up purposes and in the preparation of product offers. DNB has a legitimate interest in using profiling, for example when we perform customer analysis for marketing purposes or transaction monitoring to detect fraud. Please find the information about Prediction scoring (Profiling) under the chapter on Marketing, and the information about the right to protest against this processing under the chapter What are your rights? / Object against process and purpose.

The DNB Group has a shared customer register. The data in the register is used to manage customer relationships and coordinate offers of services and advice from the different companies in the Group. 
The group-wide customer register will contain neutral information about you like your name, date of birth, address and other contact information, as well as information about the companies in the Group you are a customer of, and the services and products for which you have entered into agreements. Your national identity number may be shared and registered in a group-wide customer register when the purpose is administration of the customer relationship.

DNB has implemented technical and organisational security measures to protect your personal data. DNB continuously seeks to ensure that your personal data is protected against loss, destruction, corruption or unauthorised access. Our security framework is updated regularly in line with technological developments. In addition, DNB is permitted to process personal data to pursue the legitimate interest of securing the Group’s assets, for instance in connection with logons to servers, the operation of infrastructure, firewalls, access controls and video surveillance.

DNB will process credit information and other personal data in accordance with the provisions of the Norwegian Financial Institutions Act and Securities Trading Act. This processing takes place in connection with the establishment of your customer relationship, determining which products and services are suitable for you and the use of systems to calculate capital adequacy requirements for credit risk. The internal measurement systems include DNB’s models, work and decision-making processes for approving and managing credit, control mechanisms, IT systems and internal guidelines for classifying and quantifying the Group’s credit risk and other relevant risk. The personal data used for this purpose is obtained from credit agencies.

DNB is permitted to process personal data for the purpose of preventing, detecting, investigating and handling fraud and other criminal acts. In such cases, DNB may need to gather information and disclose it to other banks and financial institutions, the police and other public authorities. The collected information may be stored for up to ten years after it is registered. DNB will process personal data to fulfil its obligation to investigate and report suspicious transactions in accordance with the Norwegian Money Laundering Act. DNB has a statutory obligation to report suspicious information and transactions to the Financial Investigation Unit in ØKOKRIM (the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime). According to the Norwegian Personal Data Act and the Money Laundering Act, you are not entitled to inspect certain information registered by DNB in this connection as long as an investigation is still ongoing.

When you use DNB’s electronic services, DNB is permitted to register your user behaviour and user environment and any deviations from these, identify the computer or mobile device you use to carry out the banking service, the state of the computer/unit etc. DNB will use this data to make sure that the right person is using the service in question. DNB may also use the data in a risk assessment to adjust the authentication method that you have to use for the service.

DNB may choose to reuse collected customer information to analyze how customers use the services to the improvement of existing products and services or to the development of new. This includes identifying potential demand for products and services, as well as performing tests related to the development.

It is in our legitimate interests to develop, build, improve and put in place business models, systems, products and services, and to produce and provide reports for our benefit, and provide a high standard of service. The developing, maintaining and validating of data models, are based on pseudonymous information in predefined data sets with information for conducting strategic, insight-based business. To ensure that the model provides a representative picture of customer portfolio, the pseudonymous data set consists of age, age group and postcode, existing accounts, loans, credit cards, savings agreements, funds and personal insurance, use of products, occurrence of roles as co-debtors, guardians or guarantors. as well as logins in DNBs´ online banking and apps. Model development is due to a constant process to ensure decisions in business development. This processing activity does not involve concrete scoring or profiling, and has no direct significance for the customers. However, if the models are to be used for specific scoring of customers in connection with marketing purposes, it will have a direct impact on the customer. We recommend that you read more about this in the chapter What purposes is personal data used for? / Marketing. See also the chapter What are your rights? / Object against processing and purpose

In some cases, we can use automated decisions when this is permitted by law and you have explicitly consented to this, or if it is necessary for the performance of an agreement, e.g. automated credit decisions in our online channels. You may, at any time, request manual processing instead, state your opinion or contest a decision that is exclusively based on automated processing, including profiling, if such a decision could have legal or other significant consequences for you.
When we use automated decision-making processes, we will give you additional information about the underlying logic that is used and the consequences it can have for you.

At DNB Bank, we process personal data to provide statistics to public and private companies. The statistics we share are never personal information only non identifiable. The companies may use the statistics to improve goods, services, communications and offers to their consumers. Our legal basis of processing for this purpose is legitimate interest. The statistics we create are based on demographic information, product information and transaction information. In some cases, we also use additional information from public registers, such as from the Mapping Authority (Kartverket). Examples of statistics can be groups of residents who travel collectively, which age groups most often go to the cinema, how many customers live in detached houses, the time of day that most people in the grocery store, or what average people in a municipality pay in electricity, telephone subscriptions, food consumption, etc. You have the right to object to including your personal data in the statistics. You can do so in the online banking, through the menu Settings.

We process personal data for the purpose to execute customer and market surveys. In order to get feedback from our customers about what they expect of DNB, their experiences or what input they have for improvements it is necessary to conduct surveys. It is voluntary to participate. Our analysis agencies receive the contact information to conduct customer surveys on behalf of DNB. The analysis agency is DNB`s data processor and subject to a data processor agreement. As controller for the processing DNB is responsible for all stages of the survey. DNB has a legitimate interest in processing your contact information and answers for this purpose. By participating in the survey, you agree that we may process your information. The analysis agency deletes the customer lists automatically after 6 months. Exceptionally, the files are stored for 24 months for follow-up examinations that take more than 2 years.

We sometimes need to disclose information about you when we deliver services and products. If, for example, you have instructed us to transfer money or securities, we need to disclose certain information to carry out the transfer.To obtain the rating necessary to optimize deposit terms and thus favorable interest rates for the customer, DNB will in addition to sharing necessary information within the group, give information to external agencies to provide such rating.  - software providers 

All transfers of personal data from DNB to a service provider are conditional on a data processor agreement between DNB and the service provider. This applies irrespective of whether DNB uses data processors in Norway or another country in the EEA. In some cases, DNB transfers personal data to organisations in countries outside the EEA, e.g. providers of IT services or other data processors. Such transfers are only permitted when the data controller or data processor has issued the required guarantees and on the condition that the individuals are guaranteed enforceable, effective rights. 

DNB must have legitimate grounds for processing personal data. The most important legitimate grounds are listed below.

DNB primarily processes personal data for the purposes of customer administration, provision of financial advice, invoicing and the provision of banking, insurance and financing services in accordance with your agreements with DNB.

DNB processes personal data to meet its obligations according to laws, regulations and the decisions of the authorities.

DNB is permitted to process personal data when this is necessary to protect a legitimate interest that outweighs an individual’s right to protection of personal privacy. The legitimate interest must be legal, predefined, real and justified by business operations. 

If there is no other statutory basis for processing, DNB’s processing of personal data must be based on your freely-given, specific consent. You will always be asked to give your consent if personal data categorised as sensitive (e.g. information about your health, religious beliefs, sexual orientation, ethnicity etc.) needs to be processed. 
Even if you have given DNB consent, you can withdraw it at any time. If you withdraw your consent, the processing will be stopped and, if further storage of the data in question is conditional on your consent, it will be deleted. Information about the purpose, processing activities and your right to withdraw your consent will be provided when you are asked to give DNB your consent through different channels.

A request for data access gives you the right to inspect the data that we have stored about you. This applies to data you have provided yourself, data we have obtained from external sources and information about the processing of this data. Your right to data access does not extend to internal assessments and similar internal data created by data controllers on the basis of personal data you have given us. The same applies to certain personal data we have gathered to fulfil statutory obligations, such anti-money laundering obligations. Please check the online bank for detailed information and historical data about the products and services you use. If you do not subscribe to our online banking services, you will have received this information in our regular dispatches by post. 

You have the right to object to the processing of your personal data that takes place on the basis of legitimate interests, unless such interests override your fundamental rights or freedoms. We will assess and respond to such a protest. Inquiries are directed to our service department for complaints here.

As long as you have one or more active agreements with us, we will need to store personal data about you that is linked to these agreements. After an agreement expires, the personal data will be stored for a while to ensure that you get the best possible customer service. The other reasons for storing data after agreements expire are to meet our statutory obligation to store data and to defend ourselves against any legal claims. After the set storage period your personal data will be deleted. 

If the data we have about you is inaccurate or incomplete, you are entitled to request rectification of the data within the limits that follow from legislation.

For customers of DNB companies in Norway:
If you have any questions about this privacy protection statement or about how DNB handles your personal data, you can contact DNB’s customer service centre 24 hours a day by means of the chat function in the Internet bank, on telephone number +47 915 04800 or via dnb.no. Click here if you want to send a complaint to DNB electronically. If you want, you can also send your complaint directly to the Norwegian Data Protection Authority. For more information, please see the Data Protection Authority’s website. DNB also has a data protection officer who can be contacted by email: personvernombudet@dnb.no or by post: DNB, c/o Personvernombud, P. O. Box 1600 Sentrum, 0021 Oslo, Norway. 

In DNB, we continuously seek to improve and develop our services, products and websites. In the event of any changes of the rules for processing personal data, changes of our services and products or other changes that affect this personal privacy statement, the information in this statement will be changed correspondingly.