Cookies and Personal Data Protection

This privacy policy explains how The Norwegian National Opera & Ballet AS (‘DNO&B’) processes personal data in accordance with the General Data Protection Regulation (‘GDPR’) when you purchase tickets, use operaen.no, receive our newsletter or contact us. The policy is organised by purpose, so you can see what data we collect, why we do so, the legal basis for processing and how long we store the data.

Last updated: 26 March 2026

1. Data controller

The Norwegian National Opera & Ballet AS
Kirsten Flagstads plass 1, N-0150 Oslo
Email for privacy enquiries: thore.naess@operaen.no

The managing director is the data controller for the company’s processing of personal data.

2. General information about the personal data we process

Personal data means any information that can be directly or indirectly linked to an individual. We process personal data to deliver and manage ticket purchases and services, provide customer service, send relevant information and marketing where you have consented, and to analyse and improve our services. Some data are necessary to complete ticket purchases and provide services to you. Other data are optional, such as your name when signing up for the newsletter.

3. Processing activities by purpose

3.1 Newsletters and marketing

Purpose

• To send newsletters, information and offers.
• To invite you to take part in voluntary customer surveys.

What data we process

• Email address.
• Name (optional).
• Log of newsletters received and opened.
• Purchase history, including, for example, genre and purchase frequency, where this is used to measure performance and adapt mailings.
• Segment information derived from the above data, such as interest groups based on purchase history and responses to mailings. In some mailings, segmentation may also be based on age and geography, where this information is available in the customer data.

Legal basis for processing

• Consent, cf. GDPR Article 6 (1)(a). Consent to electronic marketing and the use of personal data for this purpose. Consent is required for marketing communications by email (section 15 of the Marketing Control Act).

Sources and recipients

• MarketHype Sweden AB (data processor), storage within the EU/EEA.

Storage period

• The consent is stored until you withdraw it.
• The mailing log and associated data are stored for as long as the consent remains valid, and thereafter for a limited period to document the consent and manage opt-outs and unsubscribes.

How to withdraw consent

• You can stop receiving our newsletters by using the unsubscribe function at the bottom of the newsletter or by sending an email to post@operaen.no

3.2 Ticket purchases and administration of customer relationships

Purpose

• To complete ticket purchases and deliver the ticket to you.
• To send you practical information about the performance and your visit to us.
• To manage customer categories, discounts and seat selection.
• To invite you to take part in voluntary customer surveys.
• To compile statistics to improve the service.

What data we process

• Name, contact details, purchase history, seat selection, discounts and customer type.

Legal basis for processing

• Contract, cf. GDPR Article 6 (1)(b). The processing is necessary to complete purchases and perform customer management.
• Legitimate interest, cf. GDPR Article 6 (1)(f). We have a legitimate interest in compiling statistics and improving the service, including the analysis of sales and visitor patterns.

Sources and recipients

• Ticketing system provider Tixly AS (data processor), with storage within the EU/EEA.

Storage period

• Transaction and accounting-related documentation is stored for 5 years, in accordance with the Accounting Act and the Bookkeeping Act.
• Customer profiles and purchase history are stored for as long as necessary for the purposes described above. The data are then erased or anonymised unless they must be stored for longer in accordance with statutory requirements or to address legal claims.
• Customer surveys are stored in accordance with the purpose of the individual survey.

3.3 Customer enquiries by email and telephone

Purpose

• To respond to enquiries and document dialogue.
• To provide customer service.
• To compile statistics to improve customer service.

What data we process

• Email address, name (if provided).
• Telephone number (if provided).
• Subject, category, content and response history.
• Customer category (where relevant to resolving the enquiry).

Note: Do not send sensitive personal data by email.

Legal basis for processing

• Contract or pre-contractual measures, cf. GDPR Article 6 (1)(b). The processing is necessary to respond to enquiries and provide customer service.
• Legitimate interest, cf. GDPR Article 6 (1)(f). We have a legitimate interest in compiling statistics and improving customer service.

Sources and recipients

• Salesforce, with storage within the EU/EEA
• Puzzel AS, with storage within the EU/EEA.

Storage period

• 2 years for general enquiries.
• 3 years for gift card-related enquiries.
• Cases of archival value are stored in secure archives for as long as necessary for the archiving purpose.

3.4 Use of operaen.no – cookies, analytics and advertising tools

3.4.1 Cookies, analytics and behaviour-based advertising targeting

Purpose

• To operate and secure the website.
• To measure website usage (statistics).
• To improve content and the user experience.
• To carry out advertising targeting for our performances on other websites and advertising platforms (on Facebook, Instagram, Snapchat, TikTok, Google and Microsoft), including ongoing remarketing and measurement of advertising performance.

What data we process when you consent

• IP address (partially masked).
• Device information.
• Page views and interactions (behaviour).
• Events (e.g. purchases, clicks, searches on the website).
• Identifiers from cookies/pixels.

We use necessary cookies that are required for the operation, functionality and security of the website. These are set without consent.

Legal basis for processing

• Consent pursuant to section 3‑15 of the Electronic Communications Act and GDPR Article 6 (1)(a) (for non‑necessary cookies).
• Necessary cookies are set without consent because they are necessary for the operation and security of the website. You can change or withdraw consent by clicking ‘Cookie settings’ at the bottom of the website.

Sources and recipients

When you consent to cookies, we share data with:

• Google (Analytics/Ads).
• Meta (Facebook/Instagram Pixel).
• TikTok Pixel.
• Snapchat Pixel.

Some of our providers, particularly those providing analytics and advertising services, may process personal data outside the EU/EEA, for example, in the United States of America. Where this occurs, we ensure that there is a valid basis for the transfer, such as the EU-US Data Privacy Framework under which the provider is certified, or other appropriate safeguards.

When you consent to marketing cookies, we may reach you with advertisements for our performances on other websites and on social media. This may happen, for example, if you are included in a target audience based on visits to specific pages or events on the website.

Joint controllership

When we use these advertising tools, DNO&B and the relevant platform are joint controllers for the collection of data from your browser on operaen.no for purposes such as measurement and marketing, provided you have consented to this. We are responsible for obtaining consent, providing information about this collection and for our use of data to measure campaigns and conduct marketing for our performances. The platforms are responsible for the further processing of data within their advertising and analytics services, including any purposes they themselves determine.

3.4.2 Storage period

Storage periods for analytics and marketing data vary by provider and purpose. They can range from 30 days to 14 months. Data are erased or anonymised when they are no longer necessary for the purposes.

Details of the individual cookies, providers and storage periods can be found under ‘Cookie settings’ on the website.

3.5 CRM, automation and analytics in MarketHype

Purpose

• To manage communication with our audience who have consented to receive marketing from us.
• To send newsletters and other marketing communications to those who have consented to this, including automated mailings where this has been enabled.
• To produce general statistics and insights that help us to plan, measure performance and improve our communication and offers.

 

What data we process

• Contact details (email address and name).
• Consent status and the channels you have consented to. To send newsletters and other marketing communications to those who have consented to this, including automated mailings where this has been enabled.
• Purchase history and visit-related events when used for reporting, performance measurement and general analysis.

 

Segmentation and insight

• We may divide our audience into segments based on data such as purchase history and interaction with newsletters. This is used to send more relevant communications to those who have consented to marketing and to improve planning and reporting.
• MarketHype may display statistics and distributions regarding audience demographics and interests based on public sources and/or statistical probability models (‘Lifestyle insights’). We use these insights for analysis and reporting at a general level. We do not use them as a basis for sending marketing communications to individuals. Access to this functionality is managed internally.
• We do not engage in automated decision-making that has legal effects or a similarly significant impact on you.

Legal basis for processing

• Consent, cf. GDPR Article 6 (1)(a). To send marketing communications and to manage consents and opt-outs relating to this.
• Legitimate interest, cf. GDPR Article 6 (1)(f). For segmentation, performance measurement and analysis of mailings and purchases, as well as for using insight for planning, reporting and improvement. Our legitimate interest is to understand our audience and improve planning, reporting and communication.

 

Sources and recipients

• MarketHype Sweden AB (data processor), storage within the EU/EEA.

Storage period

• Data relating to marketing and consent are stored for as long as the consent remains valid, and thereafter for a limited period to document the consent and manage unsubscribes and opt-outs.
• Analysis and reporting data are stored for as long as necessary for the purposes described above and are subsequently erased or anonymised.

 

3.6 Safety and security in and around the Oslo Opera House

Purpose

• To ensure the safety and security of the audience, employees and visitors.
• To prevent and investigate unwanted incidents, including theft, vandalism and security breaches.
• To administer access to areas with access control and to manage visitor flow.

What data we process

• Video recordings from areas under video surveillance.
• Access data, such as names or identifiers linked to access cards, and logs of access events.
• Visitor data, such as name, contact details where these are recorded, and the time of check-in and check-out.

Legal basis for processing

• Legitimate interest, cf. GDPR Article 6 (1)(f). Our legitimate interest is to ensure security and safe operations, as well as to prevent and investigate incidents.

Sources and recipients

• Video surveillance: Kentima Etheris. Stored locally at DNO&B.
• Access control: Bravida Integra. Stored locally at DNO&B.
• Visitor registration: Bravida Check In. Cloud-based storage in Sweden.
• Where necessary, recordings or logs may be disclosed to the police or other public authorities where we have a legal basis for doing so.

Storage period

• Video recordings are stored for 7 days and are automatically overwritten, unless recordings need to be preserved in connection with a specific incident.
• Access logs in Bravida Integra are normally stored for 180 days.
• Visitor data in Bravida Check In are normally stored for 24 hours. After this period, personal data are anonymised by masking, so that the anonymisation cannot be reversed. Upon termination of the agreement, the data are erased, and the provider can confirm the erasure.

4. Your rights

You may request access to and rectification or erasure of your personal data, or restriction of processing, or you may object to processing based on legitimate interest. You may also request that the data you have provided to us be supplied to you in a structured, commonly used and machine-readable format, and in some cases transferred to another provider (data portability).

If the processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of the processing carried out before consent was withdrawn.

Enquiries are to be sent to: post@operaen.no

You may lodge a complaint with the Norwegian Data Protection Authority if you believe that your rights have not been upheld.

5. Sharing of personal data

We only share personal data with:

• Subcontractors who help us provide our services.
• Third parties you have consented to us sharing data with (e.g. advertising tools).

All providers who process data on our behalf are subject to data processing agreements. For certain analytics and advertising providers, separate terms and conditions and a division of roles may apply, including joint controllership for parts of the processing activities, as described in the policy.

6. Changes to this policy

We may update the privacy policy as necessary. We will notify you of any significant changes before they come into effect, for example, on the website or in connection with relevant services.