Privacy notice
Version 2026-10-28
This notice explains which personal data the Norwegian Association for Quantitative Finance (NFKF) processes, why, who has access, and what your rights are. We collect as little as possible.
In short
- We use your data to administer your membership and plan events.
- You only receive invitations and news by email if you ticked the box for it.
- We do not sell data and do not share the member list with partners or sponsors.
- We count visits with Matomo on our own server in Norway, without cookies, with a shortened IP address and without marketing tracking.
- You can view, update, download and delete your data yourself, without a password.
Data controller
The Norwegian Association for Quantitative Finance (registered name: Norsk Forening for Kvantitativ Finans), org. no. 921 180 071, c/o Mesh / Fintech Neo, Tordenskiolds gate 2, 0160 Oslo, Norway. The board is responsible. Send privacy questions to info@nfkf.no.
What we process, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, primary email address, affiliation (student, professional, academic, other), language and membership status | Register and administer your membership, and contact you about it | Membership, Art. 6(1)(b) |
| University, programme and expected graduation year (students). Employer or institution, position and field (professionals and academics) | Know who our members are, plan relevant events, produce anonymous statistics on member composition, and remind students to update their affiliation after graduating | Membership, Art. 6(1)(b). Fields marked "optional" are only filled in if you choose to |
| Backup address (optional) | Reach you if your primary address stops working | Membership, Art. 6(1)(b) |
| Professional interests (optional) | Choose topics and speakers | Membership, Art. 6(1)(b) |
| Your choice about invitations and news by email | Send invitations to seminars and news from NFKF | Consent, Art. 6(1)(a). You can withdraw it at any time |
| Log of confirmations and consents: what you confirmed, when, and which version of this notice | Document that sign-up and consent were given | Legal obligation and legitimate interest, Art. 6(1)(c) and (f), see Art. 7(1) |
| Pseudonymised key derived from your IP address (the IP address itself is not stored) | Limit spam and repeated submissions | Legitimate interest, Art. 6(1)(f) |
| Visitor statistics: which pages are viewed, where the visit came from, clicks on links and buttons such as joining, event registration and email, browser type, screen size and approximate country. The IP address is shortened before storage | Understand how the website is used, and improve it | Legitimate interest, Art. 6(1)(f). You can opt out (see “Visitor statistics”) |
| Technical server logs at our web host (IP address, time, page) | Operations and security | Legitimate interest, Art. 6(1)(f) |
| Internal practical notes from the board (rarely used, for example that you asked to be contacted in a particular way) | Practical administration of your membership | Membership, Art. 6(1)(b). Notes are included when you download your data |
| When you leave or are deleted: member ID, registration time and a cryptographic checksum of your email address (not the address itself) | Ensure the deletion also applies if we have to restore a backup | Legal obligation, Art. 6(1)(c), see Art. 17 |
| Email waiting to be sent (recipient and content) | Send confirmations, links and receipts | Membership, Art. 6(1)(b) |
| The content of emails you send us | Reply to your enquiry | Legitimate interest, Art. 6(1)(f) |
We do not ask for date of birth, address, phone number or other data we do not need. Your employer is recorded in its own field and is never derived from your email address.
Who has access
Only board members with administrator access can see the member register. Signing in requires a one-time code sent to the administrator's email address. Access is split into roles: some can view and correct data, and only administrators can export or delete. Actions in the register are logged.
Partners and sponsors do not get access to the member list or attendee lists.
Services we use (processors)
- Webhuset AS (Norway): hosting of the website, database and email for nfkf.no. Data is stored on our web hosting account at Webhuset.
We use no third-party analytics tools on the website, no ad networks, social media plug-ins or third-party fonts. Links to LinkedIn are plain links. LinkedIn receives no data unless you click through.
To see how the website appears in search, we use Google Search Console and Bing Webmaster Tools. They show aggregated figures from the search engines' own data. These services use no code on the website, and we share no data about visitors with them.
We do not transfer personal data outside the EEA.
Visitor statistics
We count visits with Matomo to understand how the website is used, for example which pages are read, where visitors come from and how many sign up. Matomo runs on our own server at Webhuset in Norway, and the data is not shared with anyone.
- No cookies are used, and we do not follow you across websites.
- Your IP address is shortened (the last two parts removed) before it is stored.
- Pages with one-time links, member details and administration are not counted. Addresses are sent without parameters, except the campaign tags (utm_source, utm_medium and utm_campaign), which show which service or campaign the visit came from.
- Raw data is deleted after six months. We keep only aggregated figures.
You can opt out. Your choice is stored in your browser on this device.
Cookies and local storage
- Public pages set no cookies.
- When you are signed in to update your details, we use one necessary session cookie (
nfkf_sid). It is deleted when you sign out, close the browser, or after 30 minutes of inactivity. - The intro animation on the home page stores a technical flag in your browser's session storage (
sessionStorage) so that it does not play again. The flag is never sent to us and disappears when you close the tab. - If you switch language with the language selector, your browser remembers the choice in local storage (
localStorage), so that the home page opens in the same language next time. The choice is never sent to us, and you can delete it by clearing site data in your browser.
How long we keep data
- Unconfirmed sign-ups are deleted automatically after 30 days.
- Members: for as long as you are a member. We ask members to confirm their details at least every two years. If we receive no reply after a reminder, we end the membership and delete the data.
- Sign-ups that are not approved are deleted after 90 days.
- Leaving: your data is deleted from the member register immediately. It may remain in backups for up to three months. Backups are only used if something goes wrong, and if we restore one, the deletion is applied again automatically. The checksum that ensures this is deleted after 120 days.
- Backups: the latest 30 copies on our web host (about 30 days), Webhuset's own copies (at least 14 days) and one encrypted copy per month kept by the board (three months).
- One-time links are deleted one day after use or expiry. Form data and email in the job queue (sign-ups and emails waiting to be processed) are deleted once the job is done, usually within seconds and after three days at the latest. Spam protection data is deleted after 24 hours.
- The audit log of administrator actions is deleted after 12 months.
- Visitor statistics: raw data is deleted after six months. Aggregated figures without data on individuals are kept.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and to object. You can withdraw consent to email at any time. Most of this you can do yourself:
- Go to Update your details and enter your email address.
- Open the link we send. There you can view and change all details, turn invitations on or off, download your data (JSON) or leave.
You can also email info@nfkf.no. We reply within 30 days. If you believe we process data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.
Security
All traffic is encrypted over HTTPS. One-time links are stored only as a cryptographic hash, expire, and can be used once. Administrators sign in with a one-time code sent by email. The database is stored outside the public part of the web host, and we take regular backups.
Changes
For material changes we update this page and the version number at the top. If we change the purpose of processing, we notify members by email.