Privacy Notice
MUNCH processes personal data in accordance with this Privacy Notice.
Data Controller
OSLO KOMMUNE MUNCHMUSEET (ORG. NO.: 995 138 670)
Postboks 3304, Sørenga
0140 OSLO
Email: info@munch.com
Data Protection Officer
MUNCH is subject to the Data Protection Officer of the City of Oslo, who may be contacted at: personvernombud@oslobystyre.no
- Personal data
-
MUNCH processes personal data relating to individuals who:
- visit the museum
- make purchases in the café, shop, or online shop
- are registered members
- participate in events or summer school
- are invited by us
- contact us
- visit our website
- receive newsletters or interact with our marketing
- own or loan artworks to us
- rent premises from us
-
Purchases
When you make a purchase at the ticket desk, café, shop, or online shop, we process personal data necessary to complete the transaction. The legal basis is the performance of a contract.
The personal data we process includes:
- name
- contact details
- delivery information
- payment details
- order data
For purchases linked to a user account (membership account/online shop), we retain data for up to three years after the account is closed.
For ticket sales, we also process your preferred visit time to manage visitor numbers. The legal basis is our legitimate interests in operating safely and efficiently.
We are legally obliged to further process sales data to comply with accounting legislation. Data is deleted in accordance with statutory requirements once the retention obligation ceases.
Membership
When you become a member of MUNCH, we process personal data to administer your membership and send you relevant communications.
The data includes:
- name
- contact details
- membership profile (e.g. year of birth and stated interests)
- administrative membership data
For under-25 memberships, we also process date of birth to verify eligibility.
The legal basis is the membership contract.
Data is retained for up to one year after the membership ends.Events
MUNCH organises various events, including previews, guided tours, concerts, talks, workshops and family activities.
We process personal data to:
- inform relevant audiences about events
- manage participation
The data includes:
- name
- contact details
- participation details
For children’s activities, we may also process age information to ensure suitability.
The legal basis is our legitimate interests in promoting and administering events.
For certain activities (e.g. competitions), separate consent is required.
Data is stored for three years after the last participation.
Special categories of data
For some events, we may process sensitive personal data (e.g. food allergies or health conditions) to make necessary adjustments.
The legal basis is explicit consent.Invitations
We may process personal data to send invitations to individuals such as journalists, artists, public figures, and business representatives.
The data includes:
- name
- contact details
- employer
- role
The legal basis is consent and/or legitimate interests in inviting relevant individuals.
Data is retained for up to three years after last contact.
Enquiries
We process enquiries from the public, including:
- general questions
- feedback
- survey responses
- artwork enquiries
The data processed is what the individual provides.
The legal basis is:
- legitimate interests, or
- consent, depending on the nature of the enquiry
Retention:
- up to three years after last contact (legitimate interests)
- as specified when consent is obtained
Group Visits and School Visits
For group and school visits, we process personal data to plan and manage visits.
The data includes:
- contact person’s name and details
- other information provided in correspondence
The legal basis is the contract.
Retention period: up to three years after the visit.
Special categories of data
Where necessary (e.g. allergies or health conditions), we process sensitive data to facilitate participation.
The legal basis is explicit consent.Venue Hire
When hiring out our premises, we process personal data to communicate with current and prospective hirers and to administer rental arrangements.
The data includes:
- name
- contact details
- information provided in correspondence
The legal basis is our legitimate interests.
Retention period: up to three years after the rental ends.
Newsletter and Marketing
We primarily market our services through newsletters and advertising.
Newsletters
We process:
- name
- contact details
- age group
- interest profile
The legal basis is consent.
You may withdraw consent at any time by unsubscribing via the link in the email.
Retention period: up to 36 months after unsubscribing.
Advertising
We process data about interactions with adverts to measure effectiveness.
The data includes:
- digital identifiers (e.g. advertising ID)
- interaction data (timing and engagement)
The legal basis is our legitimate interests.
Retention period: up to three years after last interaction.
Website Use
When you visit our website, we process data using cookies to:
- ensure functionality
- improve the website
- compile statistics
The data includes:
- digital identifiers (e.g. IP address, consent ID)
- browser type and operating system
- session data (pages visited, clicks, duration)
Processing is based on:
- legitimate interests (necessary cookies)
- consent (other cookies)
Consent can be withdrawn via the icon in the browser window.
Retention period: up to three years after last interaction.
CCTV
MUNCH uses CCTV to ensure the safety of individuals, artworks, and property.
The legal basis is our legitimate interests.
Recordings are deleted on an ongoing basis in accordance with applicable law.
-
Our staff
Only employees who require access to perform their duties process personal data.
Processors (suppliers)
We use third-party processors (e.g. for ticketing, payments, CRM, analytics, marketing).
Data is mainly stored within the EU/EEA.
Where transfers outside the EU/EEA occur, these are based on: -
You have the right to:
- access your personal data
- request rectification
- request erasure
- object to processing
- request restriction of processing
- request data portability
You may withdraw consent at any time.
If you are a member, you can update most details via “My Page”.
You can unsubscribe from newsletters via the link in any email.To exercise your rights, contact: info@munch.com
If you believe your privacy rights have been infringed, please contact us so we can resolve the matter. You may also contact the Data Protection Officer of the City of Oslo.
You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
For more information about your rights, please visit the Datatilsynet website.
Copyright:
The content on this website is copyright protected and belongs to MUNCH.