Vedlegg til Markedsdialog print as a service
Fil: OIDF_Privacy-Policy_Final_2025-07-17.pdf
Vedlegg til anbudet Markedsdialog print as a service fra Vestfold fylkeskommune.
OPENID FOUNDATION
PRIVACY POLICY
(Effective September 3, 2024)
PURPOSE
This OpenID Foundation Privacy Policy (“Privacy Policy”) explains the data collection and usage
practices of the OpenID Foundation (“OIDF,” “we, “our,” or “us”) with respect to personal data that we
collect, store, use, transfer, and otherwise process.
If and to the extent you are in the European Union (an “EU Individual”), in the UK (a “UK
Individual”), or in Switzerland (a “Swiss Individual”), this Policy provides you with the information
required by the Regulation (EU) 2016/679 of the European Parliament and Council on the protection of
natural persons with regard to the processing of personal data (General Data Protection Regulation)(“EU-
GDPR”) the General Data Protection Regulation as it forms part of UK law under the European Union
(Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications
(Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR”), and the Swiss Federal Act on Data
Protection (“Swiss-FADP”).
APPLICABILITY
This Privacy Policy applies to all of the personal data that we collect or process from or about individuals
from all sources. It does not apply to personal data collected or processed by any OIDF chapter (including
the Japan chapter), which are separate legal entities governed by separate privacy policies.
POLICY
1. Definitions
“Personal data” means any information that relates to an identified or identifiable natural person who
can be identified from it.
“Processing” means any operation or set of operations which is performed upon personal data, whether
or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.
“You” means any individual person identified or identifiable by personal data, as relevant for the context
in which it is used in this Privacy Policy.
2. Who Has Responsibility for Your Personal Data
OIDF, an Oregon State non-profit public benefit corporation located in the United States, is responsible
for the processing of your personal data under this Privacy Policy. You may contact OIDF regarding any
questions or complaints as specified in the “How to Contact Us” section below.
If you are an EU Individual, OIDF’s designated representative under the EU-GDPR is:
1
Rickert Rechtsanwaltgesellschaft mbH
OpenID Foundation
Colmantstrasse 15
5315 Bonn
Germany
[skjult]@rickert.law
If you are a UK Individual, OIDF’s designated representative under the UK-GDPR is:
Rickert Rechtsanwaltgesellschaft mbH
OpenID Foundation
P.O. Box 1487
Peterborough
PE1 9XX
United Kingdom
[skjult]@rickert.law
If you are a Swiss Individual, OIDF’s designated representative under the Swiss-FADP is:
HÄRTING Attorneys-at-Law Ltd.
Landis + Gyr-Strasse 1
6300 Zug
E-Mail: [skjult]@haerting.ch
3. Categories of Individuals About Whom We Process Personal Data
We process personal data from or about the following categories of individuals:
• Users of an OIDF website;
• Individuals who are, or are associated with, OIDF members, prospective members, OIDF
chapters, participants in the OpenID Certification Program, vendors, or other business contacts
with whom we interact or seek to establish a relationship, including individuals who participate in
OIDF activities, attend OIDF events, communicate with OIDF, or subscribe to its blogs,
newsletters, or other materials, or who are identified in data provided by or on behalf of OIDF
members or participants in the OpenID Certification Program or otherwise in connection with
their participation in OIDF; or
• Individual contractors who provide services to OIDF.
4. Categories and Sources of Personal Data Processed
We may collect and store various types of personal data about you. The following describes the personal
data about you that we may process and the sources of such personal data
4.1. Users of an OIDF Website
You do not have to submit any personal data in order to use our Website.
Categories: When you visit an OIDF website, we may collect two types of data: (1) personal data about
you that you voluntarily choose to provide to us, and (2) information related to your activities on the
2
OIDF website that we automatically collect as you interact with the Website (“Website Usage
Information”).
• Information You Voluntarily Provide: We collect personal data that you voluntarily provide in
response to requests we may make at various places and through various mechanisms on an OIDF
website. The personal data we collect is business-oriented data and is usually limited to contact
information necessary for the relationship, such as name, company name, job title, and email
address. We may collect such information, for example, when you fill out and submit a form,
such as if you register for an event, register to receive a newsletter or email communications,
when you submit an inquiry or request to us using a form or e-mail address link on an OIDF
website, and when you send an email to an OIDF address or OIDF mail list that is listed on an
OIDF website. In such case, we will collect whatever personal data you voluntarily provide in
response to our request.
• Special Categories of Personal Data: In connection with the registration for and provision of
access to an in-person meeting, event, or seminar, we may ask for information about your health
for the purpose of identifying and accommodating any disabilities or special dietary requirements
you may have. Any use of such information is based on your consent. If you do not provide any
such information about disabilities or special dietary requirements, we will not be able to take any
respective precautions.
• Website Usage Information and Cookies: The OIDF websites use cookies for analytical and
functionality purposes that allow us to improve our website based on visitor experience. Cookies
are small text files placed on a computer hard drive to record a visitor’s information such as user
ID and browsing behavior. Our cookies do not collect any personal data such as your name or
email address. We use the following types of cookies:
(a) Necessary cookies. These are cookies that are required for the operation of our website.
They include, for example, cookies that enable the website to perform as intended and to
access secure areas of our website.
(b) Analytical/performance cookies. They allow us to recognize and count the number of
visitors and repeat visitors, to see how visitors move around our website when they are using
it, to see which search engine is being used to access our website, the region a visitor is
browsing from, and the type of device a user is visiting from. This helps us to improve the
way our website works, for example, by ensuring that users are finding what they are looking
for easily. We use third-party services, currently Google Analytics, to collect standard
internet log information and details of visitor behavior patterns to optimize our website
content. This information is only processed in a way that does not identify anyone. To opt out
of being tracked by Google Analytics across all websites visit
http://tools.google.com/dlpage/gaoptout.
If you do not wish to receive cookies, most browsers allow you to change your cookie settings.
Please note that if you choose to change cookie settings you may not be able to use the full
functionality of our website. These settings will typically be found in the "options" or
"preferences" menu of your browser. Further, most browsers permit individuals to decline
cookies. To find out more about cookies, including how to see what cookies have been set and
how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.
3
• Links to Third Party Websites. OIDF websites may contain links to other third party websites, all
of which are separate legal entities whose information practices may be different from ours. This
Privacy Policy does not cover any such third party websites. If you provide personal data to such
third party websites all information you disclose will be subject to the privacy policy and
practices of such third parties. We are not responsible for the privacy policies and practices of
such third parties and, therefore, you should review the specific privacy policies posted on those
websites prior to submitting personal data to them.
• Information about Children. Neither any OIDF website nor any of our products or services are
directed to children younger than age sixteen (16). We do not knowingly collect personal data
from children under the age of sixteen (16) via any OIDF website and we will delete any such
information later determined to be from a person younger than age sixteen (16).
Sources: We obtain data about you from your use of OIDF Websites (i) directly from you if you
voluntarily choose to enter personal data on an OIDF website, and (ii) from the data analytics software,
cookies, and web beacons that we may use on an OIDF website.
4.2. OIDF Members, Participants in OIDF Activities, Business Contacts, and Associated
Individuals
As any business, we collect, receive, and process Personal Data regarding our members, potential
members, and other third parties (e.g., vendors, industry participants, participants in the OpenID
Certification Program, and other business and professional contacts) with whom we may interact from
time to time. This includes participants in OIDF working groups, projects, meetings, conferences,
seminars, and other activities or events, and individuals whose data is provided to us by our members.
Categories: The Personal Data that we collect and process typically consists of information such as your
name, title, position, employer, email address, other business contact data (e.g., business card data), and
similar relationship type data.
Sources: We obtain Personal Data about you (i) directly from you, such as when you contact us, attend a
meeting, seminar, or another event, or sign up to receive newsletters, emails, or other information from
us, when you or your organization participate in the OpenID Certification Program, or when you or your
organization offer to provide or provide services to us, (ii) from members and others (e.g., referrals), (iii)
from third parties, such as industry groups or government agencies, and (iv) from publicly available
sources, such as websites (e.g., LinkedIn, your business’ website, etc.).
4.3. Individual Contractors We Engage to Provide Services
Where we engage self-employed individual contractors to provide services, we collect and process
information relating to those contractors or proposed contractors.
Categories. The personal data we collect and process consists of information we require in connection
with the engagement, such as your name, address, title, position, email address, bank account information,
tax and social security related information, and information relating to any background checks.
Sources: We obtain such Personal Data primarily from the contractor or proposed contractor and
sometimes from organizations who carry out background checks on our behalf.
4
5. Purposes and Legal Basis for the Processing:
We process Personal Data for the following purposes:
• building relationships with, or providing products and services to, existing and potential OIDF
members, participants in OIDF activities, and other interested parties, including communicating
with such parties;
• analyzing and improving the OIDF websites;
• keeping people informed of the latest industry developments and notifying them of projects,
products, seminars, and hosted events;
• providing products and services to our members and the general public;
• publishing material which has been submitted by members or other individuals for publication;
• engaging individuals as contractors;
• generally operating OIDF’s business; and
• in connection with an actual or proposed merger, sale or other organizational change of OIDF.
For EU, UK, and Swiss Individuals, the legal basis for such processing is that:
• it is necessary for legitimate business interests pursued by OIDF which are not overridden by
your interests, rights or freedoms;
• in some cases because it is necessary for the performance of a contract with you or to take steps
at your request before entering into a contract;
• in some cases because it is necessary to comply with our legal obligations (such as record-
keeping obligations), compliance screening, or recording obligations;
• in some cases, on your freely given consent which is specific to the processing.
6. Sharing of Personal Data - Recipients
We may share selected personal data about you with the following parties or in the following
circumstances.
6.1. OIDF Chapters. We may share personal data with OIDF Chapters (such as OIDF-Japan) that
require access to personal data for business purposes related to processing any application,
request, inquiry, membership service, event, project, or other participation activity consistent
with the business of OIDF.
6.2. Third Party Service Providers. We may share personal data about you with third parties who
perform services for us or on our behalf, for the limited purpose of carrying out such services.
This includes, without limitation, third parties that assist in managing our organization, hosting
meetings, hosting or administering the OIDF websites or other systems, sending communications
on our behalf, maintaining or analyzing our data, or in otherwise providing services to us or our
members.
6.3. Visitors to OIDF Websites. We may publish and make available to all OIDF website visitors,
personal data submitted in connection with work group Contribution Agreements and other
intellectual property agreements, and participation in the OpenID Certification Program. Such
5
personal data typically consists of name, affiliation, title, and contact information. If you are an
an EU, UK, or Swiss Individual, we will only do this with your specific consent.
6.4. Corporate Change. We reserve the right to disclose and transfer personal data about you in
connection with a merger, consolidation, restructuring, financing, sale of substantially all assets,
or other organizational change of OIDF.
6.5. Legal Requirements and Law Enforcement. We may disclose personal data about you to
governmental authorities or a court when we believe in good faith that the law requires it; at the
request of governmental authorities conducting an audit or investigation; pursuant to a court
order, subpoena, or discovery request in litigation; to verify or enforce compliance with our
agreements or policies and applicable laws, rules, and regulations; or whenever we believe
disclosure is necessary to limit our legal liability or to protect or enforce the rights, interests, or
safety of OIDF, its users, or other third parties. We also reserve the right to report to law
enforcement agencies any activities that we, in good faith, believe to be unlawful.
6.6. Consent. We may also share personal data about you in accordance with any express consent
you or your authorized agent give us which is specific to the purposes of the processing which
you will be informed about at the time we request such consent. You do not have to give such
consent. If you do give consent, you may withdraw it at any time by contacting us (see “How to
Contact Us” section below), however please be aware that such withdrawal will not affect the
lawfulness of personal data collected and processed prior to the date of your withdrawal of
consent. In addition, if you withdraw your consent you may also forfeit other benefits, such as
the participation in projects or participation in the OpenID Certification Program.
7. Choice
If personal data covered by this Privacy Policy is to be used for a new purpose that is materially different
from that for which the personal data was originally collected or subsequently authorized, or is to be
disclosed to a non-agent third party in a manner not specified in this Policy, OIDF will provide you with
an opportunity to choose whether to have your personal data so used or disclosed. Requests to opt out of
such uses or disclosures of Personal Data should be sent to us as specified in the “How to Contact Us”
section below.
Certain personal data, such as information about medical or health conditions, racial or ethnic origin,
political opinions, religious or philosophical beliefs, is considered “Sensitive Information.” OIDF will not
use Sensitive Personal for a purpose other than the purpose for which it was originally collected or
subsequently authorized by the individual unless OIDF has received your affirmative and explicit consent
(opt-in).
8. Accountability for Onward Transfer
If you are an EU, UK, or Swiss Individual, where we transfer your personal data to third party service
providers (see above) who perform services for us or on our behalf, we are responsible for the processing
of that data by them and shall remain liable if they process your personal data in a manner inconsistent
with the EU-GDPR, UK-GDPR, or Swiss-FADP, as applicable, or the DPF Principles referred to below,
unless we prove that we are not responsible for the event giving rise to the damage.
6
9. Cross-Border Transfers of Personal Data
OIDF is located in the United States, and many of its members, participants, events, and projects are
located in different countries. The OIDF websites (and all personal data collected via such OIDF
websites) are hosted in the United States. All personal data that we collect and maintain via the OIDF
websites will also be processed and stored in the United States, where data protection and privacy
regulations may provide different levels of protection compared with your jurisdiction.
Whenever OIDF transfers personal data from one country to another, it will do so in compliance with
applicable privacy and data protection law.
If you are an EU, UK, or Swiss Individual, please be aware that we will transfer your personal data to the
United States, where we are established. The United States does not have the same data protection laws as
the EU, UK, or Switzerland. To provide the relevant safeguards in relation to your personal data
transferred to the United States, OIDF complies with the EU-U.S. Data Privacy Framework (“EU-
U.S. DPF”) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework
(“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. OIDF has certified to the U.S.
Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-
U.S. DPF Principles”) with regard to the processing of personal data received from the European Union
in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the the
UK Extension to the EU-U.S. DPF. OIDF has certified to the U.S. Department of Commerce that it
adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with
regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If
there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the
Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy
Framework (“DPF”) program, and to view our certification, please
visit https://www.dataprivacyframework.gov/ (“DPF Website”).
10. DPF Recourse, Enforcement, and Liability.
OIDF uses a self-assessment approach to assure compliance with this Privacy Policy and annually verifies
that this Privacy Policy is accurate, comprehensive for the information intended to be covered,
prominently displayed, completely implemented and accessible and in conformity with the DPF
Principles.
OIDF’s DPF commitment extends to personal data received from the EU, UK, and Switzerland. We
encourage EU, UK, and Swiss Individuals to contact us should you have a DPF-related (or general
privacy-related) question or complaint.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-
U.S. DPF, OIDF commits to resolve DPF Principles-related complaints about our collection and use of
your personal information. EU, UK, and Swiss Individuals with inquiries or complaints regarding our
handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-
U.S. DPF, or the Swiss-U.S. DPF should first contact OIDF as specified in the “How to Contact Us”
section below. We will investigate your compliant, take appropriate action, and report back to you within
forty-five (45) days.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF,
OIDF commits to refer unresolved complaints concerning our handling of personal data received in
reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to the
7
International Dispute Centre of the American Arbitration Association (“ICDR/AAA”), an alternative
dispute resolution provider located in the United States. If you do not receive timely acknowledgment of
your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related
complaint to your satisfaction, please visit ICDR/AAA at https://go.adr.org/dpf_irm.html for more
information or to file a complaint. The services of ICDR/AAA are provided at no cost to you.
Under certain conditions, more fully described on the DPF Website, you may be entitled to invoke
binding arbitration when other dispute resolution procedures have been exhausted. In addition, under the
DPF, OIDF is subject to the investigatory and enforcement powers of the U.S. Federal Trade
Commission.
11. Data Retention Period.
All personal data retained by OIDF will be deleted when such personal data are no longer necessary for
the purposes for which it was processed, unless applicable law requires a longer retention period, in
accordance with our retention policy noted below.
Our policy is that if you engage in any transaction or contract with us, such as membership, self-
certification participation, working group Contribution Agreements, or other intellectual property
agreements, we will usually retain your personal data for 5 years from the later of the date the contract
expires or the last transaction with you is concluded. Otherwise, we will usually delete your data 2 years
from the date on which we last received a communication (e.g., event registration) from you, except that
if you sign up for a listserv we will retain your data until you unsubscribe. This is however subject to the
requirements of applicable data protection laws and the purpose for which the data is collected and used,
taking into account legal and regulatory requirements to retain data for a minimum period.
12. Individual Rights as Data Subjects under EU, UK, or Swiss GDPR
If you are an EU, UK, or Swiss Individual, you have the following rights under the EU-GDPR, UK-
GDPR, or Swiss-FADP, as applicable:
• to obtain confirmation as to whether we process your personal data
• to access a copy of your personal data that we do process, along with information on what
personal information we use, why we use it, who we share it with and, how long we keep it for
• to request the correction of inaccurate personal data we hold about you
• to request that we delete your data, or stop processing it or collecting it, in some circumstances
• in certain cases, to request that we transfer or port elements of your personal data either to you or
a third party providing you with similar services
We do not generally impose any charge for these requests (except where excessive or unfounded). For
any such request, you can contact us by e-mail, postal mail, or phone as specified in the “How to Contact
Us” section below. We will endeavor to respond to all reasonable requests in a timely manner, but in no
event longer than the amount of time required by applicable law.
To the extent OIDF is not the controller of your data, we will notify the controller of your request if
required by applicable law.
Updating personal data about you
If any of the personal data that you have provided to us changes, for example if you change your email
address or if you wish to cancel any request you have made of us, or if you become aware we have any
inaccurate personal data about you, please contact us as specified in the “How to Contact Us” section
8
below. We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or
incomplete personal data that you provide to us.
Withdrawing consent
Where the lawful basis of our processing under the EU-GDPR, UK-GDPR, or Swiss-FADP, as
applicable, is that you have consented to it for a particular identified purpose, you have the right to
withdraw that consent at any time. To do so, please contact us as specified in the “How to Contact Us”
section below. If you do withdraw consent, this will not affect the lawfulness of any processing that was
based on your consent before its withdrawal.
Filing a Complaint
In addition to the foregoing, you have the right to lodge a complaint in respect of your data protection
rights with the applicable supervisory authority for data protection in your jurisdiction. If you are in the
United Kingdom, that supervisory authority is the UK’s Information Commissioner’s Office:
https://ico.org.uk/.
13. Security of Personal Data
We have implemented appropriate technical and organizational measures to protect your personal
information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into
account the risks involved in the processing and the nature of the personal information.
14. Data Integrity and Purpose Limitation
OIDF shall only process personal data in a way that is compatible with and relevant for the purpose for
which it was collected or authorized by you. To the extent necessary for those purposes, OIDF shall take
reasonable steps to ensure that personal data is accurate, complete, current and reliable for its intended use.
15. Privacy Policy Changes
We may revise this Privacy Policy from time to time, which will become effective as of posting on our
OIDF websites. We will use personal data about you in a manner consistent with the Privacy Policy in
effect at the time you submitted the information, unless we receive your consent to the new or revised
policy.
16. How to Contact Us
For any questions about this Privacy Policy, to exercise any of your rights as a data subject, or for any
questions or complaints regarding the manner in which we handle or protect personal data, we can be
contacted as follows:
By e-mail: [skjult]@oidf.org;
By phone: +1 925.275.6648;
By postal mail:
OpenID Foundation
2603 Camino Ramon, Suite 200
San Ramon, CA 94583
United States
ATTN: Privacy Matters
9
Tekst er automatisk ekstrahert fra originaldokumentet. For autoritativt innhold, se originalfilen.