6. To whom do we entrust your personal data?

Suppliers (third parties) may have access to your personal data on the basis of a contractual relationship with ARoS when providing relevant services to ARoS, such as the providers of video surveillance solutions, hosting providers, conducting satisfaction surveys, sending newsletters, placing cookies and for marketing in general. Such suppliers (data processors) will only process personal data on the basis of a data processing agreement and in accordance with our instructions.

7. Do we transfer your personal data to unsafe third countries?

If your personal data is transferred to data processors or data controllers established in countries outside the EU/EEA that do not have an adequate level of protection, such transfer will only take place when a transfer is based on the EU Commission's standard contractual clauses. Transfer of personal data to the USA may also take place based on the EU-US Data Privacy Framework. If you have any questions about the basis for transfers to countries outside the EU/EEA, please contact us at info@aros.dk.

8. If you visit our profiles otherwise social media pages

This section contains the policy for ARoS's processing of personal data collected through ARoS's profiles or social media pages.

ARoS have profiles or pages on the following social media:

Facebook (Meta Platforms Ireland Ltd.)
- Facebook's privacy policy is available here
- Meta and ARoS are joint data controllers of Facebook pixels, which you can accept via cookies as further described above. Meta's privacy policy and the information in this section also apply to Facebook pixels, with the exception of the information relating solely to our profile on Facebook.
YouTube (Google Ireland Ltd.)
- Google's privacy policy is available here
LinkedIn (LinkedIn Ireland Unlimited Company)
- LinkedIn's privacy policy is available here
X (X Corp (X))
- X’ privacy policy is available
Instagram (Meta Platforms Ireland Ltd.)
- Instagram's privacy policy is available here
TikTok (TikTok Technology Limited and TikTok Information Technologies UK Limited)
- TikTok's privacy policy is available here

For LinkedIn, Facebook, TikTok, Instagram ARoS together with the social media providers are joint data controllers for the processing of personal data collected in connection with your interactions with the profiles, including the profiles' postings.

ARoS and the providers of LinkedIn, Facebook, TikTok, Instagram and Pinterest have entered into an agreement on the distribution of the data protection tasks. According to these agreements, ARoS and the social media providers are each responsible for the tasks associated with the processing they each undertake. However, it has been agreed between ARoS and the provider of Facebook and Instagram that the provider is responsible for enabling you to exercise your rights as described in the 'Your rights' section below in connection with the use of Facebook and Instagram, and that it is ARoS that is responsible for providing you with the information described below. In addition, it is agreed between ARoS and LinkedIn that LinkedIn is responsible for responding to requests from you regarding the rights described in the 'Your Rights' section below.

ARoS also uses the provider of YouTube as a data processor in connection with these entities' use of YouTube and in this connection also shares certain information about your interactions, interests, etc. with YouTube. This sharing takes place on the basis of our and Google's legitimate interest in optimizing marketing and the service, including our videos on YouTube (Article 6(1)(f) of the GDPR).

Collection of personal data

When you visit or interact with our social media profiles, ARoS and the social media provider in question may collect, process and store the following types of personal data about you:

Information available on your profile, including your name, gender, marital status, workplace, interests, photo and city
Whether you "like" or have used other reactions to our profile
Comments you leave on our posts
That you have visited our profile
Your IP address

Purposes of processing

ARoS processes your personal data for the following purposes:

Improving our products and services, including our social media profiles and pages
Statistics and analysis
To communicate with you if you comment on a post, leave a review or send us a message
Marketing in general

The social media providers process, among other things, your personal data for the following purposes:

Improving their ad system
To provide ARoS with statistics that social media providers compile on the basis of, among other things, your visit to our profiles and pages
Advertising and personalization of activities on the Site

Basis for processing

The processing of your personal data is based on the following basis:

Legitimate interests: ARoS the processing of your personal data is based on our legitimate interests in being able to communicate with and market ourselves to you on our social media profiles, as well as our legitimate interest in improving our products and services (Article 6(1)(f) of the GDPR)

Storage period

Your personal data will be stored for 2 years. However, the information may be stored longer in anonymised form. Please refer to the privacy policy of the individual social media providers for information on how long they keep your personal data.

Who do social media providers share your personal data with?

The social media providers may, among other things, share your personal data with the following categories of recipients:

Other entities within the group of which the social media provider is part of
External partners providing analysis and survey services
Advertisers
Other individuals who visit our social media profile or page (to the extent your information is publicly available)
Researchers and other academics
Forskere og andre akademikere

You can find more information about who the social media providers share your personal data within the privacy policy of the individual providers.

The social media providers may transfer your personal data to recipients outside the EU/EEA in accordance with applicable data protection legislation. You can read more in the privacy policies of the individual providers.

You can read more about who ARoS shares your personal data within the sections above titled "To whom do we disclose your personal data?" and "To whom do we entrust your personal data?".

9. What rights do you have?

General rights
When ARoS processes personal data about you as stated above, you have several rights under applicable data protection legislation:

You have the right to access the personal data we process about you
You have the right to object to our collection and further processing of your personal data
You have the right to rectification and erasure of your personal data, however, with certain statutory exceptions, including the Danish Consolidated Bookkeeping Act
You have the right to request the restriction of the processing of your personal data
In certain circumstances, you can request to receive a copy of your personal data as well as to transmit the personal data you have provided to us to another data controller (data portability)
You can withdraw any consents you may have given at any time. We will then delete your personal data unless we can continue processing on other grounds. Our newsletter can be unsubscribed by clicking on the link at the bottom of the newsletter. Withdrawal of consent will have effect on the future processing of your personal data. Withdrawal of your consent does not affect the lawfulness of the processing we carried out based on the consent before the withdrawal.

Right to object
You always have the right to object to the collection and further processing of your personal data, including the right to object to our processing based on the balancing of interests rule pursuant to Article 6(1)(f) of the GDPR. This applies, among other things, when we process your information for marketing purposes.

Required information
Please note that the processing of your personal data as stated under section 2 above may be required by law or contractually necessary as a prerequisite for us to comply with the law and to be able to manage purchases and visits. This will be the case if we have indicated that the legal basis for the processing is Article 6(1)(b) (contract) or (c) (legal obligation) of the GDPR. Information you must provide to enter into a contract may also be indicated by an asterisk (*) via the website.

Refusal to provide this information, objection to our processing of this information or demand for deletion of this information may result in you not being able to purchase our services or enter into an agreement with us.

10. Do you have questions and do you want to exercise your rights?

If you have any questions about this privacy policy or if you wish to complain about the way we process your personal data, please feel free to contact us:

ARoS Aarhus Kunstmuseum
Adress: Aros Allé 2, 8000, Aarhus C
CVR no.: 39 79 99 28
Email: info@aros.dk
Phonenumber: + 45 8730 6600

If your complaint is not resolved by us and you want to proceed with the case, you can complain to the Danish Data Protection Agency:

The Danish Data Protection Agency
Carl Jacobsens Vej 35
DK-2500 Valby
Phone: 33 19 32 00
Email: dt@datatilsynet.dk

11. Links to other websites

Our website may contain links to other websites. We are not responsible for the content of other websites (third party websites) or for the procedures such third parties have for collecting and processing personal data. When you visit a third-party website, you should read the website owner's privacy policy and other relevant policies.

12. Changes to the Privacy Policy

This privacy policy does not constitute an agreement between ARoSand you, but instead forms the basis of our duty of disclosure under data protection legislation. We reserve the right to make changes to this Privacy Policy from time to time in accordance with applicable data protection laws. In case of changes, the date and version number at the top of the privacy policy will be changed. The privacy policy in force at any time will always be available via link. In case of material changes to the Privacy Policy, you will receive an email or other notification with reference to the updated Privacy Policy.