Personal Data Policy

Which people are covered?

Website visitors who have given consent via the cookie banner.

For what purposes is personal data used?

Marketing, statistics, preferences and features.

You can read more about the purposes via the cookie banner.

What types of personal data are used?

User ID, geographical location, interests, IP address, operating system, browser type, device type, website traffic, MAC address, click behaviour, interaction with ads, data filled in when purchasing, and search history.

What is the legal basis for the processing?

The processing of personal data in relation to necessary cookies is based on an agreement to use the websites' functions (Article 6(1)(b) of the General Data Protection Regulation).

The processing of personal data in relation to statistical and preference cookies is based on our legitimate interest in offering you the best possible products and services (Article 6(1)(f) of the GDPR).

The processing of personal data in relation to marketing cookies, including on the basis of your preferences, is based on your prior consent (GDPR Article 6(1)(a)).

In addition, we always obtain a valid cookie consent in accordance with the cookie regulation before cookies are placed via your terminal equipment.

When is the personal data deleted?

See the cookie banner where the deletion periods (expiration periods) are indicated. You can open the cookie banner by clicking on this link.

Which people are covered?

Visitors and suppliers.

For what purposes is personal data used?

To provide security, to prevent crime and to secure evidence for police investigations.

What types of personal data are used?

Images of your movements and in some cases criminal information in case of theft or other crimes.

What is the legal basis for the processing?

Pursuing our legitimate interest in creating security, preventing crime and securing evidence for police investigations (Article 6(1)(f) of the General Data Protection Regulation and Section 8(3) of the Data Protection Act).

When will the personal data be deleted?

30 days from the time of recording.

Which people are covered?

Users.

For what purposes is personal data used?

Profile creation for the purpose of purchasing/registering annual passes and tickets and to obtain benefits.

What types of personal data are used?

Code, name, address, date of birth, discounts, email and purchases.

What is the legal basis for the processing?

Entering into and honouring a contract (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

1 year after the user is deleted.

Which people are covered?

Members.

For what purposes is personal data used?

Being a member and obtaining related benefits, ensuring compliance with membership conditions and membership administration.

Charging and payment.

Marketing and statistics.

What types of personal data are used?

Name, email, phone number, interests, marketing consent, date of birth, discounts applied, payment information and benefits.

What is the legal basis for the processing?

Entering into a membership agreement (Article 6(1)(b) of the General Data Protection Regulation.

Consent to receive marketing (Article 6(1)(a) GDPR).

We may also process your personal data on the basis of our legitimate interests in e.g. handling enquiries, marketing, developing existing and new services and products, analyses and statistics of our customer segments, products and services (Article 6(1)(f) GDPR).

When will the personal data be deleted?

1 year after cancellation of membership.

A copy of the consent is stored 2 years after revocation of consent or 2 years after cancellation of membership.

Which persons are covered?

People who make purchases via the webshop.

For what purposes is personal data used?

To fulfil the purchase agreement entered into with you, including to deliver tickets, gift cards and annual passes, as well as to handle order confirmations, complaints and send terms and conditions.

What types of personal data are used?

Name, address, email, telephone, nationality, purchase history, geolocation, IP address, and payment information.

*It will be stated whether it is mandatory to provide the information or not.

What is the legal basis for the processing?

To enter into and fulfil a purchase agreement (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

2 years after the last purchase.

However, data subject to bookkeeping obligations will be stored 6 years after the purchase in accordance with the Bookkeeping Act.

Which persons are covered?

Visitors who make purchases at ARoS, including Information, the ARoS Shop, Cafe & Orangery.

For what purposes is personal data used?

To enter into a purchase agreement.

What types of personal data are used?

Name, date of birth, address, e-mail and possibly picture and discounts granted. If we register who has purchased something, it must be corrected with the information provided.

What is the legal basis for the processing?

To enter into and fulfil a purchase agreement (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

2 years after the last purchase.

Which people are covered?

People who have given consent to receive newsletters.

For what purposes is personal data used?

To send marketing as described in the consent.

What types of personal data are used?

Email, name and phone number.

What is the legal basis for the processing?

Consent (Article 6(1)(a) of the GDPR).

When will the personal data be deleted?

2 years after revocation of consent.

Which people are covered?

People who have given consent to receive newsletters.

For what purposes is personal data used?

Targeted marketing, including sending personalised emails and newsletters.

What types of personal data are used?

Email, name, click behaviour in relation to sent material, order history and preferences.

What is the legal basis for the processing?

Legitimate interests in improving and developing our services (Article 6(1)(f) of the General Data Protection Regulation).

When will the personal data be deleted?

As long as your consent to receive newsletters is active.

Which people are covered?

People who contact customer service or otherwise communicate with us.

For what purposes is personal data used?

Handling your enquiry and possibly your order, compliance with your rights, general communication, statistics and analysis.

What types of personal data are used?

E-mail, name, telephone number, the subject of your enquiry, date of enquiry and other information you provide.

We encourage you not to provide us with sensitive personal data or social security number unless it is strictly necessary for the processing of your enquiry.

What is the legal basis for the processing?

We may process your personal data on the basis of our legitimate interests in handling your enquiry, communicating with you and developing our products and services (Article 6(1)(f) of the General Data Protection Regulation).

If your enquiry concerns the (potential) conclusion of a contract, we process your data in order to implement pre-contractual measures (Article 6(1)(b) of the GDPR).

When will the personal data be deleted?

General enquiries and cases are generally stored for 2 years, but the retention period may vary depending on the content of the cases.

Accounting material, including personal data that we are obliged to store in accordance with the Danish Bookkeeping Act, is stored for up to 6 years.

Which people are covered?

Annual pass holders.

For what purposes is personal data used?

Issuing and managing your annual pass and ensuring identification when purchasing an annual pass access control.

What types of personal data are used?

Name, address, phone number, nationality, date of birth*

*Valid for purchase of ARoS30 annual pass / pensioner 1+1 annual pass

What is the legal basis for the processing?

To enter into a contract and ensure identification (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

5 years after the card has expired.

On ARoS’ website, we offer a chatbot designed to ensure fast and efficient customer service. When you interact with the chatbot, information that you choose to share during the conversation may be collected and processed.

Purpose of the processing

The information is processed in order to:

• Answer your questions quickly and provide customer support

• Improve our service and user experience

• Ensure the quality of our customer service

Storage of conversations

Conversations with the chatbot may be stored and reviewed by our staff as part of quality assurance and service improvement. The information is retained only for as long as necessary to fulfil these purposes.

Do not share sensitive information

We recommend that you do not share sensitive personal data or financial information with the chatbot.

Processing of your information

Your information is processed in accordance with applicable data protection legislation and our general privacy policy. The processing of your personal data is based on your consent, cf. Article 6(1)(a) of the GDPR. If you share sensitive personal data with the chatbot, such data will only be processed based on your explicit consent, cf. Article 9(2)(a).

Your rights

You have the right at any time to request access to, rectification of, or deletion of your information in accordance with applicable data protection rules.

Which people are covered?

Restaurant visitors.

For what purposes is personal data used?

Creating and managing bookings.

What types of personal data are used?

Contact details and other information you provide in connection with table reservations.

What is the legal basis for the processing?

To enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

1 year after the last booking.

Which people are covered?

Contact person for booking.

For what purposes is personal data used?

Creating and managing booking.

What types of personal data are used?

Name, contact details and other information you provide when booking.

What is the legal basis for the processing?

To enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

2 years after the last booking.

Which persons are covered?

Individuals who have given consent to receive newsletters and/or marketing cookies.

For what purposes is personal data used?

To create target groups for subsequent advertising for sales and marketing purposes via banners and adverts.

What types of personal data are used?

Non-reversible hashed email address, user ID, geographical location, interests, IP address, MAC address, click behaviour, interaction with ads, data filled in when purchasing, and search history.

What is the legal basis for the processing?

ARoS's interest in publicising our products and services, including in relation to other persons with similar interests (Article 6(1)(f) of the General Data Protection Regulation).

If you wish to object to Google, you can do so by controlling your advertising on Google services via "Google Custom Match" in your Google Ads settings: https://support.google.com/google-ads/answer/6379332?hl=en.

You can also read more about how Google acts as a joint data controller with us. You can read more about their processing of your personal data via this link: https://policies.google.com/privacy?hl=en.

When will the personal data be deleted?

Follow the deletion deadlines for newsletters and cookies.

Which persons are covered?

Individuals who have given consent to receive newsletters and/or marketing cookies.

For what purposes is personal data used?

To create target groups for subsequent advertising for sales and marketing purposes via banners and adverts.

What types of personal data are used?

Non-reversible hashed email address, user ID, geographical location, interests, IP address, MAC address, click behaviour, interaction with ads, data filled in when purchasing, and search history.

What is the legal basis for the processing?

Our interest in publicising our products and services, including in relation to other persons with similar interests (Article 6(1)(f) of the General Data Protection Regulation).

You can object to Facebook by changing your settings on Facebook and deactivating "Facebook

Custom Audiences and Lookalike Audiences" by following the instructions on the following link: https://facebook.com/settings/?tab=ads.

Meta (Facebook) acts as a joint data controller with us. You can read more about Facebook's processing of your personal data via this link: https://facebook.com/about/privacy.

When will the personal data be deleted?

Follow the deletion deadlines for newsletters and cookies.

Which people are covered?

Participants in competitions.

For what purposes is personal data used?

Entering the competition and sending prize if you win. Compliance with the terms and conditions of the competition.

Publicising the winner on social media.

The competition is run collectively across our channels (e.g. website and social media). Only one winner in total will be drawn from all participants regardless of where you participate.

What types of personal data are used?

Name and email and possibly information that you have won. We will also collect your address if you win a prize that needs to be physically shipped.

What is the legal basis for the processing?

Legitimate interest to fulfil the competition and possibly publish your name and send the prize if you have won (Article 6(1)(f) of the GDPR).

Comply with the conditions of the competition (Article 6(1)(b) of the GDPR).

When will the personal data be deleted?

1 year after the end of the competition.

Which people are covered?

Participants in events, tours, events and happenings.

For what purposes is personal data used?

Registration, organisation and administration.

What types of personal data are used?

Email, phone number, and information about participation in the event, event, tour or happening.

What is the legal basis for processing?

Entering into a contract (Article 6(1)(b) of the GDPR).

When will the personal data be deleted?

1 year after the end of the event.

Which people are covered?

Visitors or images you have uploaded on social media.

For what purposes is personal data used?

Marketing purposes.

What types of personal data are used?

Images/videos and contact information.

Your signature and copy of contract.

Copy of consent and copy of consent from your parents or guardian if you are under 15 years old.

What is the legal basis for the processing?

We base the processing of your personal data on our legitimate interest in being able to market ourselves on, among other things, social media and the website if it is a mood picture where it is difficult or impossible to identify you. (Article 6(1)(f) of the General Data Protection Regulation). In accordance with the Danish Data Protection Agency's current guidelines, we conduct an overall assessment to determine whether publication of the image requires your prior consent.

If the overall assessment shows that publication requires your prior consent or the conclusion of a contract, we will obtain this or conclude the contract before we use the image or video of you for marketing purposes (Article 6(1)(a) of the GDPR (consent) and Article 6(1)(b) of the GDPR (contract).

When will the personal data be deleted?

When the consent is revoked or when the contract expires.

Storage of mood images depends on the specific situation, but will generally not be deleted from social media unless you object. See below how you can object.

Which people are covered?

Injured persons.

For what purposes is personal data used?

To manage physical damage occurring at ARoS and to defend or establish legal claims.

What types of personal data are used?

Name, address, telephone, e-mail and description of the injury.

The description of the damage may contain sensitive personal data in the form of health information.

What is the legal basis for the processing?

Legitimate interest in managing the claim, including in relation to compensation, legal claims and insurance (Article 6(1)(f) GDPR).

Establish and defend legal claims where it is strictly necessary to process health data (Article 9(2)(f) GDPR).

When will the personal data be deleted?

3 years from the end of claims handling.

Which people are covered?

People involved in incidents in violation of legislation or internal guidelines/bylaws.

For what purposes is personal data used?

To defend, establish and determine legal claims and in some cases to exclude people from future visits or report the matter to the police.

What types of personal data are used?

Description of the incident, which can involve general information, criminal offence information and in special cases sensitive information such as race or health.

What is the legal basis for the processing?

Legitimate interest to establish, defend and pursue legal claims and to exclude persons from future visits if the person has acted in violation of guidelines or legislation.

Article 6(1)(f) of the General Data Protection Regulation (general personal data:

Section 8(3) of the Data Protection Act (criminal data).

Article 9(2)(f) of the General Data Protection Regulation (if sensitive data such as race or health is included).

When will the personal data be deleted?

At the end of the case or 3 years after notification. The list of suspended persons is kept for the duration of the quarantine.

Which persons are covered?

People who have purchased products from us or participated in events, happenings or similar.

For what purposes is personal data used?

To inform you about your purchase or visit.

What types of personal data are used?

Email or phone number.

What is the legal basis for the processing?

Legitimate interest to inform about a variety of matters, including in case of pandemics, practicalities, cancellations, changes and other significant matters related to the purchase or visit (Article 6(1)(f) GDPR).

When will the personal data be deleted?

3 years after the last purchase or participation.

Which persons are covered?

People who have purchased products from us, visitors or people who have participated in events or similar.

For what purposes is personal data used?

To improve our products and services and marketing. In addition, to generally ensure customer satisfaction.

What types of personal data are used?

Contact information, language, nationality and information about purchases and satisfaction.

What is the legal basis for the processing?

We base the processing of your personal data on our legitimate interest to conduct statistics and analyses in order to develop and improve our products and services and to contact you if your response indicates that you have had a bad experience with us. Your participation in the survey is voluntary (Article 6(1)(f) of the General Data Protection Regulation).

When will the personal data be deleted?

3 years after the last purchase, visit or participation.

Which people are covered?

Gift voucher recipients.

For what purposes is personal data used?

Registering, issuing and managing the gift voucher. .

What types of personal data are used?

Contact information, including name,

email and phone number, payment information and gift voucher content.

What is the legal basis for the processing?

To enter into and fulfil a gift card agreement (Article 6(1)(b) of the GDPR).

Ensure compliance with the Payment Act in relation to electronic gift cards (GDPR Article 6(1)(c)).

When will the personal data be deleted?

1 year after expiration of gift vouchers.

Accounting material, including personal data that we are obliged to store in accordance with the Danish Bookkeeping Act, is stored for up to 6 years.

Which people are covered?

Payers.

For what purposes is personal data used?

To ensure documentation of the purchase in accordance with the Bookkeeping Act.

What types of personal data are used?

Transaction data.

What is the legal basis for processing?

Legal obligation cf. the Bookkeeping Act (Article 6(1)(c) of the General Data Protection Regulation).

When is the personal data deleted?

Accounting material, including personal data that we are obliged to store in accordance with the Bookkeeping Act, is stored for up to 6 years.

Which people are covered?

Sponsors / contributors.

For what purposes is personal data used?

Managing the sponsorship and issuing invoices.

What types of personal data are used?

Name, address, email, telephone, size of sponsorship, company name, position, signature and in some cases CPR number.

What is the legal basis for the processing?

Legal obligation cf. the Bookkeeping Act and tax legislation (Article 6(1)(c) of the General Data Protection Regulation).

Legal obligation cf. Article 11(2)(1) of the Danish Data Protection Act if the CPR number is required for reporting to the tax authorities.

Enter into a sponsorship/contribution agreement (Article 6(1)(b) of the General Data Protection Regulation).

When will the personal data be deleted?

7 years from the completion of the sponsorship.

Which people are covered?

Participants in training programmes.

For what purposes is personal data used?

Recording and organising training.

What types of personal data are used?

Name, email, address, postcode, and phone number.

What is the legal basis for processing?

To enter into a training agreement (Article 6(1)(b) of the General Data Protection Regulation).

Legitimate interest to register and verify participants (Article 6(1)(f) GDPR).

When will the personal data be deleted?

6 months after the end of the training.

Which people are covered?

Visitors.

For what purposes is personal data used?

To initiate cases about the behaviour of other visitors.

What types of personal data are used?

Contact details and description of incidents.

What is the legal basis for processing?

Legitimate interest to manage conflicts and ensure proper behaviour in accordance with guidelines (Article 6(1)(f) GDPR).

When will the personal data be deleted?

6 months after the case is closed.

Which people are covered?

People who complain about our products, visits or services.

For what purposes is personal data used?

To handle the complaint according to applicable laws, guidelines and terms of trade.

What types of personal data are used?

Description of complaint, time of purchase, visit or experience and contact details.

What is the legal basis for the processing?

To assess compliance with the agreement (Article 6(1)(b) of the General Data Protection Regulation).

To assess the complaint in relation to the Danish Sale of Goods Act and the Danish Consumer Contracts Act (Article 6(1)(c) GDPR).

When will the personal data be deleted?

2 years from the conclusion of the complaint.

Which people are covered?

Suppliers and business partners.

For what purposes is personal data used?

General planning, fulfilment and administration of collaborations, including contracts.

Administration such as processing payments, evaluating credit ratings, accounting, auditing, as well as to provide support.

Product and service development.

Statistics and analysis.

Conflict management.

What types of personal data are used?

Name, email address, phone number and similar contact information

Individual information, e.g. preferred language

Organisational information, such as company name and address, job title, area of employment, primary work location and country

Contractual information such as orders, invoices, contracts and other agreements between your company that may contain, for example, your contact details.

Financial information such as payment terms, bank details and credit ratings (in the case of a sole trader).

What is the legal basis for the processing?

In certain cases, the processing of your personal data is necessary for the performance of a contract (Article 6(1)(b) GDPR).

We may process your personal data based on our legitimate interests in e.g. managing day-to-day operations in accordance with lawful and fair business practices, including planning, execution and administration of the collaboration or our legitimate interest in e.g. performing credit assessments, statistics, analyses, marketing activities (where consent is not required), providing support, improvement and development of our products and services. The processing may also be necessary for our legitimate interest of preventing fraud or establishing, defending or exercising legal claims (Article 6(1)(f) of the GDPR).

The processing of your personal data will in some cases be necessary for compliance with legal obligations, such as our obligation to prevent illegal activities (Article 6(1)(c) GDPR).

When will the personal data be deleted?

2 years after last contact.

Category of recipients

Lawyers, insurance companies, authorities, police and courts.

Types of personal data

Relevant information in relation to a specific dispute, including in some cases video recordings and claims incidents.

Legal basis

Article 6(1)(f) of the General Data Protection Regulation (legitimate interest).

Article 6(1)(c) GDPR (legal obligation to report descriptions of injuries to security authorities).

Categories of recipients

Tax related to sponsorships

Types of personal data

Contact details and social security number.

Legal basis

Article 6(1)(c) of the General Data Protection Regulation (legal obligation), cf. tax legislation.

Categories of recipients

Payment acquirers.

Types of personal data

Payment and card details.

Legal basis

Article 6(1)(b) (contract) of the General Data Protection Regulation.