Menu

Privacy Notice – Processing of Personal Data in the Media Bank (Imageshop)

1. Data Controller

SINTEF is the data controller responsible for the processing of personal data in connection with the use of the media bank solution Imageshop. The processing is carried out in accordance with applicable data protection legislation, including the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).

2. Data Processor

Imageshop AS is the data processor and the provider of the technical solution for the media bank. Imageshop AS processes personal data on behalf of SINTEF and only in accordance with documented instructions from the data controller. The relationship between the parties is regulated by a separate data processing agreement in accordance with GDPR Article 28.

3. Purpose of the Processing

Personal data are processed for the following purposes:

  • to provide users with access to the content of the media bank
  • to administer user accounts and authentication
  • to make ordered files available and distribute them
  • to ensure that images and other material are used in accordance with agreed usage rights
  • statistical and reporting purposes, based on aggregated data, for further development of the media bank

4. Categories of Personal Data

The following categories of personal data may be processed:

  • name
  • email address
  • password (stored securely)
  • organization/employer or commissioning entity
  • information about ordered files and the time of ordering
  • purpose for the use of ordered material

5. Legal Basis

The processing of personal data is based on the following legal grounds under the GDPR:

  • Article 6(1)(b) (necessary for the performance of a contract with the data subject)
  • Article 6(1)(f) (legitimate interests), where SINTEF’s interest in secure and controlled management of media material is considered to outweigh the data subject’s privacy interests

6. Storage and Retention Period

Personal data are stored only for as long as necessary to fulfill the purposes of the processing. If a user is inactive for 3 months, the personal data will be automatically deleted.

7. Disclosure and Access

Personal data are not shared with third parties beyond the data processor Imageshop AS. Access to the data is restricted to authorized personnel at SINTEF and Imageshop AS.

8. Information Security

The data processor shall implement appropriate technical and organizational measures to ensure confidentiality, integrity, and availability in accordance with the requirements of GDPR Article 32.

9. Data Subject Rights

The data subject has the right to:

  • access their own personal data
  • correction and updating of data
  • erasure of data
  • restriction of processing
  • object to the processing
  • data portability, where applicable

These rights can be exercised by logging into the media bank (“My page”) or by contacting SINTEF.

10. Amendments

This privacy notice may be updated. Significant changes that affect the processing of personal data will be communicated in an appropriate manner.

For further questions, please contact us at:

Email: foto@sintef.no

These guidelines were last updated on 30.04.2026