DNV Group AS, including other DNV Group entities (“DNV”, “we”) use Digital Experience Analytics (“DXA”), a service provided by Qualtrics, LLC, to better understand how users engage with our websites and digital portals (“digital channels”). This allows us to analyze and improve the user experience of our digital channels. This privacy notice explains how personal data is collected, processed, and protected when using the DXA service.
Data Controller
The controller responsible for the processing of your personal data in accordance with the General Data Protection Regulation (“GDPR”) and national data protection laws is:
DNV AS
Veritasveien 1
P.O. Box 300,1363 Høvik
Norway
You can also reach our Global Data Protection Officer at dataprotection@dnv.com and, if applicable, the German Data Protection Officer at mkorrf@intersoft-consulting.de.
Purpose of Processing
The personal data collected via DXA is processed solely for the purpose of improving the user experience and the quality of DNV’s digital channels. This is achieved by analyzing user behavior to better understand how users interact with our digital channels and to identify any challenges or frustration they may encounter during navigation.
Legal Basis for Processing
The personal data processing is based on Article 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future by accessing the cookie settings in our Consent Management Platform (https://www.dnv.com/privacy/cookie-list/) and adjusting your preferences. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Personal Data Processed
When you engage with our digital channels, we may process the following types of personal data through the DXA service:
- Session recordings (Digital Assist Sessions)
- Clickstream data and frustration detection
- Digital Assist Funnels
- Heatmaps
- User-ID for logged-in environments
- Session-ID
In addition, we may process behavioural and session metadata, which is the types of personal data mentioned above in aggregated form, such as frustration signals and time stamp. This metadata includes information about your interactions with our digital channels, such as navigation patterns, clicks, scroll depth, and session replays.
Only the personal data strictly necessary to achieve the purpose described above is processed. Where possible, data is aggregated or anonymized for analysis.
Data Retention
We retain your personal data as long as it is necessary to fulfil the purpose of improving user experience and the quality of DNV’s digital channels. We store session recording data for 6 months and session metadata (such as frustration signals, time stamp, etc.) for 36 months after collection.
When and if personal data are being collected, records will be deleted alongside the rules previously described (6 and 36 months)
With whom we will share your personal data
In connection with the purpose above, your personal data is shared with:
Qualtrics, LLC, acting as our data processor for providing DXA services.
The data processor acts on the basis of a contract and are bound by data processing agreements that ensure your data is handled securely and only in accordance with our instructions.
For more information on Quatrics’ privacy practices, please visit: https://www.qualtrics.com/privacy-statement/
Transfers of personal data to countries outside the EU/EEA (“Third countries”)
The personal data is stored in the EU/EEA. However, Qualtrics, LLC which is based in the United States, may have access to this information. To the extent that data is processed outside the EU/EEA, Qualtrics, LLC is certified under the EU-US Data Privacy Framework (DPF). Data transfers to the USA are therefore legitimized based on the adequacy decision of the European Commission pursuant to Article 45 GDPR.
What are your rights regarding your personal data
With regard to your personal data processed by us, you have certain rights by law. Please note that these rights may be subject to certain conditions. You have the right to:
- Request access to your personal data. This enables you to receive information about the processing of your personal data and to request a copy of the personal data we hold about you (Art. 15 GDPR).
- Request correction of the personal data we hold about you to fix any incomplete or inaccurate information (Art. 16 GDPR).
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data (unless we are legally justified or obliged to retain the personal data).
- Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (Art. 18 GPDR).
- Receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent pursuant to Article. 6 (1)(a) or Article. 9(2)(a) or on a contract pursuant to Article. 6 (1)(b) GDPR and the processing is carried out by automated means (Article. 20 GDPR). You also have the right to transmit this data directly to another controller, where technically feasible.
- Withdrawing your consent at any time when processing of personal data is based on your consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Lodge a complaint with the competent supervisory authority and to take legal action against any potential breach of your rights regarding the processing of your personal data.
You may exercise the rights mentioned above or make any complaints regarding our data processing by contacting us under the contacting details set out above.
Revision of the Privacy Statement
DNV may change or update the privacy statement without notice. All such changes will take effect once they have been posted on the electronic application site. It is your responsibility to monitor such updates. The privacy statement was last updated on the date stated at the beginning of this privacy statement.