Privacy Policy for MyDaWinci application

General

This privacy policy contains information about why and how personal data registered in the DaWinci Personnel Logistics Solution (DaWinci) is processed.

What is personal data

Personal data is personal information that identifies you as a physical person. The personal data processed in DaWinci is listed in the table below.

Legal basis and purpose of data processing

The processing of data in DaWinci is based on the “Regulations relating to conducting petroleum activities (the Activities Regulations)” as stipulated by the Petroleum Safety Authority Norway – section 18 – according to which: ”The operator shall ensure that a comprehensive overview is available at all times of everyone staying on or on their way to or from a facility or vessel participating in the petroleum activities.”
Furthermore, the processing is based on contracts between the Data Controller and the Data Processor as well as legitimate interests where the purpose of the data processing is to enable follow up requirements for travel to the installations, the execution of personnel transportation, managing the stay on the installations, as well as accessing necessary information in an emergency situation and system hosting, maintenance and development where your interests and fundamental rights have been deemed do not override those interests.

What does processing of personal data imply

In this context, processing of personal data involves collecting, checking, storing, maintaining and making available information. The company being the operator of the installation you are travelling to is using DaWinci for personnel transport and personnel on board (POB) administration and is the Data Controller. This means that the Data Controller is the legal entity that decides what personal data to process and why.
Quorum Software Norway AS, org.no. 9927028387, having its registered address at Vestre Svanholmen 4, 4313 Sandnes, holds the role as a Data Processor, which processes personal data in accordance with its data processing agreement and further instructions from the Data Controller.

Information being processed

No sensitive personal data is stored or processed in DaWinci, only data required for the undertaking of the personnel logistics and the onboard management of the oil and gas installations. The personal data that may be registered and processed are:

Category	Data	Purpose
Personal information	Name, gender, date of birth, national ID, marital status, phone and e-mail, photo for mobile app profile picture	Enabling identification of correct person
Next of kin / emergency contact	Name, relation, address and phone	For use in an emergency preparedness situation
Certificate (image/pdf)	Health certificate and other certificates required and/or deemed necessary for travel to and work onboard installations	Enabling validation of travel requirements
Company information	Your company name and work category	Information needed as part of POB (personnel on board) management.
Location, travel and accommodation information	Location information based on check in and check out as well as part of real-time transportation tracking Transportation reservations and information about work and accommodation installation (incl. cabin, bed and lifeboat) Information about travel constraints	Enabling POB (personnel on board) management (including emergency preparedness situation and validation of travel requirements).
Other information	Passport details, survival suit details, shoulder width, passenger and luggage weight	Passport details, survival suit details, shoulder width, passenger and luggage weight Passport is not mandatory to register but may be used in conjunction with visa and/or work/residence permit information. Check in weight per individual is processed as part of the total flight weight calculation and is not stored beyond a person’s return of travel

Furthermore, information may be obtained about your use of DaWinci and the Data Processors related websites through "cookies" solely for the purpose of enabling an easier use of certain parts of DaWinci. When you enter DaWinci, information about your mobile device or computer, IP address, operating system and browser type, may for example be collected. This information generally comprises data which does not allow individual identification of information related to a specific user.
Aggregated data may be derived from your personal data but is not considered personal data by law as it does not directly or indirectly reveal your identity. For example, your usage data may be aggregated to calculate the percentage of users accessing a specific feature. However, if such aggregated data is combined or connected with your personal data so that it can directly or indirectly identify you, the combined data will be treated as personal data which will be used only in accordance with this privacy notice.
Special categories of personal data such as religious belief, trade union membership etc. are not processed in DaWinci.

Sharing of data

Sharing data with third parties may be done to comply with regulatory requirements or to accommodate contractual or legitimate interests. Examples of such sharing are:
* Reporting to the authorities
* Electronic mustering / tracking
* Handling of survival suits
* Emergency preparedness
* System hosting and maintenance
* Usage analytics

Only personal data that is strictly necessary to fulfill the purposes stated above will be provided to these third parties. All third-party providers will be bound by written data processor agreements and must implement appropriate technical and organizational measures for the protection of the personal data.

Where is your data processed?

Your personal data is primarily processed on servers within the EU/EEA.
DaWinci is a “cloud based” solution, and to ensure a safe and timely provision of DaWinci, third party vendors may occasionally need remote access to parts of the solution, where limited personal data is processed. Where the data is processed outside the EU/EEA and the UK, appropriate data protection safeguards (such as standard contractual clauses) is implemented between the vendors and the Data Processor to ensure that your personal data remains protected and secure. For more information on the appropriate safeguards in place or to obtain a copy of these safeguards, please contact us by using the contact details below.

Securing personal data

Quorum Software Norway AS - as Data Processor – ensures it will only process personal data for the purposes for which it was collected and as set out in this privacy notice. Quorum Software Norway AS has taken appropriate technical and organizational measures to keep your personal data secure from any access, extraction, deletion or distortion by unauthorized persons.

Storing of personal data

Your personal data will not be stored longer than is necessary to fulfill the purpose for which they were obtained, as well as to meet statutory requirements applicable to the Data Controller.

Your rights

Subject to applicable law, you may have certain rights regarding your personal data, including rights to:

Access – request a copy of or view the personal data we have registered on you and that we process and to have information relating to how it is processed. On the “My Page” in MyDaWinci web portal - you may download a report of all the personal data that have been registered;
Rectify – it is important that the personal data registered are correct, and you have the right to have incorrectly registered data to be corrected;
Erasure - have your personal data deleted if you should wish to do so, and this will be done when the data are no longer required in order to comply with legitimate interests and statutory or regulatory requirements;
Restrict – request that your personal data is no longer processed by us and if you should wish this to happen, this will be done when the data is no longer required in order to comply with legitimate interests and statutory or regulatory requirements;
Object – object to certain ways in which we process your personal data; and
Lodge a complaint – you are entitled to lodge a complaint with your local data protection authority (in Norway: Datatilsynet, www.datatilsynet.no).
To exercise any of your rights, please contact the Data Controller or Data Processor by using the below contact details.

Changes

This privacy notice may change over time and we will inform you if significant changes are made.

Contact

Any questions may either be directed to the Data Controller directly which is the Oil&Gas company operating the installation you are travelling to, or to the Data Processor Quorum Norway AS by submitting an email to dpp@quorumsoftware.com.