Norstat AS, Fridtjof Nansens plass 5, 0160 Oslo, Norway, is responsible for the processing of your personal information, and for keeping it safe. As a professional data provider in Europe, we are committed to fully following the rules laid down in the GDPR as well as national privacy legislation in all the countries where we operate. We naturally take appropriate technical and organisational measures to safeguard your personal data, such as using firewalls, encryption and access control to our premises and files. Your information is treated confidentially.

This privacy notice explains how we work with personal data.

For survey respondents in general

Types of personally identifiable information being processed

Whenever we at Norstat approach members of the public regarding a survey, we process some personal information (such as e-mail address or phone number, name, age and zip code). The personal information we use to get in touch with respondents is normally either publicly available data from public registers, or lists of customers or users from the client we are collecting the survey data on behalf of – for instance when we are doing customer or employee satisfaction surveys or user experience research.

For members of the Norstatpanel, see the section below for information with specific information pertaining to the Norstatpanel.

Purpose of the processing

We process your contact information in order to be able to approach you for participation in the surveys and opinion polls we conduct. Information you give us as part of responding to the survey will be combined with answers from other respondents and conveyed to our clients in aggregate form only, for statistical use.

Basis of the data processing

Contact information is used to be able to get in touch with you for survey participation purposes. Market and opinion polls are a legitimate interest, as the data collected is an important basis for decision-making for our clients, which range from government bodies to institutions and organizations of all kinds.

While we contact you based on a legitimate interest, participation in our surveys is always voluntary, and data collected from you in our surveys is collected on the basis of consent. You have the right to withdraw consent for processing your personal data at any time.

Sharing information with third parties

Norstat will never share, sell, transfer or in other ways exchange your personally identifiable information with a third party without collecting your explicit consent for this beforehand.

Deletion of data

Information that we process in connection with market research studies is stored in our systems for six months after the data collection is completed. After that, all personally identifiable information will automatically be deleted.

For Norstatpanel members

Purpose of the processing

When you are a Norstatpanel member, you have consented to being contacted by us for the purpose of inviting you to surveys.

As long as we have your permission, we keep some personal information about you for the purpose of being able to predict which of the target groups we are trying to reach you will belong to, like information about where you live, how old you are, your gender and also some information about your preferences and circumstances. This helps us to send you surveys that are relevant, and reduces the risk of wasting your time by sending you studies where you will get screened out because you don’t belong to the target group. We may also in some cases use this stored information to save you the trouble of having to answer the same questions over and over again.

In some cases, we may even ask you for special category data to determine whether you are in the correct target group for specific studies. Whenever we do, responding is always completely voluntary, and please feel free to use the “would rather not disclose” option if you ever feel that the information we are asking you for is too personal to share. Special category information is kept highly confidential and not accessible even by our own employees.

Information in your panel member profile will be kept on file as long as you remain a Norstatpanel member and used solely for research purposes.

If you wish to view or change any of the information you have provided us with, you can do so directly from your membership page in the Norstatpanel.

You can stop being a Norstatpanel member at any time by contacting our panel support team, using the Unsubscribe button on your account page or clicking the Unsubscribe link in one of our emails. Closing your account means we will delete all personally identifiable information about you.

Redemptions

When you redeem Norstat coins, Norstat will log the IP address used to minimize the risk of fraudulent redemptions.

Cookie tracking studies

If you consent to the placement of cookies for cookie tracking purposes (this consent can be given and withdrawn in your personal Norstatpanel page), we place cookies in your browser on behalf of clients that want to measure exposure of their websites. We can then tell our clients to what degree different target groups within our panel have seen one of their pages.

Cookies placed during surveys do not contain personal data but help identify target groups for future studies. Third-party cookies may be used in some surveys to link response data (not personal data) for research insights. No personally identifiable data is shared with any client as a result of participating in cookie tracking studies.

Use of the Norstatpanel app

The Norstatpanel app is for panel members only, designed to enhance survey participation and personalize the experience.

Data processed in the Norstatpanel app:

Location data: Collected only with explicit consent. Data are used for anonymous survey targeting and analysis. Data is anonymized, deleted after 60 days, and never used for marketing. Location data are stored by a subcontractor using random user IDs.

App identifiers: Collected with consent to measure exposure to internet campaigns. Used for statistical reporting only, not advertising. Consent can be withdrawn anytime via the profile page.

Users can revoke consent to sharing location data and delete data directly in the app.

Third party processing

On sign up to our panel we may share your mobile phone number and/or email with a third party processor to verify your country and origin and prevent fraudulent accounts. These checks may continue to be performed once the sign-up process is complete.

Further fraud prevention measures may be required for some aspects of our panel site and this may require the provision of a photograph and identification documents.

A list of our third party processors and links to their sites and privacy policies can be found here.

Third Party Sub Processors

The following list identifies the third party sub processors that are currently relied upon by Norstat group companies in their panel maintenance activities and may be used in connection with Norstat’s processing of personal data in the context of the provision of its services. This list may be updated from time to time as sub processors are added or removed.

When you submit a request to our panel support service, we use the third party platform Freshdesk to manage tickets. The data being processed and stored in this context is your e-mail address and the content of your request, as well as the responses from our panel support team. Freshdesk data will be subject to automatic deletion three years after you last sent in a ticket, but you can also request earlier deletion from our panel support team.

For visitors to the Norstat.co website and sub-sites

What data we collect when you use this website and how it is used

We collect and process your personal data based on your consent in the following ways:

• We collect personal data that you submit through our contact form (name and e-mail address) for the purpose of contacting you.
• Information you submit when downloading materials from our website (name, e-mail address, company name) will be used to e-mail you the requested media and may also be used to send you relevant updates.
• Personal information submitted when subscribing to our newsletter (name and e-mail address) is used to send the newsletter.
• We will never share your personal information with a third party without asking your explicit consent in advance.

Cookie policy

A cookie is a small text file which stores information on your computer. It is used on many websites to give visitors access to various features such as logging in and remembering previous actions. On this website, we use cookies to improve your user experience. You can disable cookies by adjusting the settings of your browser.

Google Analytics 4

Our websites use Google Analytics 4 (GA4) to help us understand how you interact with our content, but we put your privacy first. When you visit our site, you will see a cookie banner that allows you to choose whether to allow analytics cookies. If you decline, no analytics data will be collected.

You can also adjust your browser settings to block third-party cookies. Our server-side tagging setup reduces reliance on them and anonymizes IP addresses, keeping data processing within a controlled environment.

If you would like more details, please refer to Google’s privacy documentation.

LinkedIn

The LinkedIn Insight Tag allows LinkedIn to record site visit information and user behaviour on the website. We use this to deliver relevant advertising on the LinkedIn platform and third-party websites.

Sugar Market Web Tracking

This tag allows us to view website visitor behaviour such as visit duration, referral pages and pages visited. It helps improve website performance and usability and connects website visitor data to contacts in our CRM system.

Consent and opt-out for these tags can be managed in cookie permissions.

For Norstat clients

We collect and process your data based on legitimate business interests in the following ways:

• We collect data submitted to our CRM and accounting systems, including name, email address, website activity, emails, quotes, meeting records and invoicing records.
• When using our client portal “MyNorstat”, we may collect personal and activity data necessary to deliver services and fulfil contractual obligations. We will never use your personal information to improve or develop our services, including connected AI models.
• When using self-service solutions such as “Norstat Express” or “Norstat Create”, we collect contact and organizational information to deliver services, invoice and provide support.
• We may send product updates in the form of newsletters.
• We may provide tailored advertising via third-party platforms such as Google, LinkedIn and Microsoft.
• We retain your data only as long as necessary or as required by law.
• Your data may be shared with trusted third parties when necessary and is protected during any transfer.

Information security

We safeguard your personal information using physical and virtual access control and encryption. Norstat AS maintains an internal IT security control system approved according to the ISAE3000 assurance standard.

We comply with the ESOMAR International Code on Market, Opinion and Social Research and Data Analytics and are certified according to the ISO9001:2015 quality standard.

Your rights as a data subject

You have the right to access, amend or delete your personal data and to withdraw consent at any time. You may also lodge a complaint with your national data protection authority.

Data Protection Officer

Norstat has a Data Protection Officer responsible for ensuring compliance with privacy legislation. They can be contacted at dpo[at]norstatgroup.com.