Which people are covered?  
Website visitors who have provided consent via the cookie banner.

For what purposes is the personal data used?
Marketing, statistics, preferences and features. 
You can read more about the purposes via the cookie banner.  

What types of personal data are used? User ID, geographical location, interests, IP address, operating system, browser type, device type, behavior on the website, MAC address, click behavior, interaction with ads, completed data upon purchase, and search history. 

What is the legal basis for the processing? The processing of personal data in relation to necessary cookies takes place on the basis of an contract to be able to use the functions of the website (Article 6(1)(b) of the GDPR).  

 
The processing of personal data in relation to statistical and preference cookies takes place as a result of our legitimate interest in offering you the best possible products and services (Article 6(1)(f) of the GDPR).  

The processing of personal data in relation to marketing cookies, including on the basis of your preferences, takes place on the basis of your prior consent (Article 6(1)(a) of the GDPR).  

In addition, we always obtain a valid cookie consent in accordance with the Executive Order on Cookies before cookies are placed via your terminal equipment. 

When will the personal data be deleted? 
See the cookie banner where the deletion periods (expiration periods) are indicated. You can open the cookie banner by clicking on this link.

Which people are covered?  
Visitors and suppliers.  

For what purposes is the personal data used? 
Create security, to prevent crime and secure evidence for use in police investigations.

What types of personal data are used? 
Pictures of your whereabouts and, in some cases, criminal information in the event of theft or other crimes.  

What is the legal basis for the processing? 
Pursue our legitimate interest in creating security, preventing crime, and securing evidence for use in police investigations (Article 6(1)(f) of the GDPR and section 8(3) of the Danish Data Protection Act). 

When will the personal data be deleted? 
30 days from the moment of recording.  

Which people are covered?  
Users.  

For what purposes is the personal data used? 
Creating a profile for the purpose of purchasing / registering annual passes and entrance tickets as well as to obtain benefits.  

What types of personal data are used? 
Code, name, address, date of birth, picture, discounts, email, and purchase.  

What is the legal basis for the processing? 
Enter into and comply with a contract (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
1 year after the user is deleted.

Which people are covered? 
Members

For what purposes is the personal data used?
Be a member and obtain associated benefits, ensure compliance with membership conditions and administration of membership. 

Collection and payment.

Marketing and statistics.

What types of personal data are used? 
Name, email, phone number, interests, marketing consent, date of birth, discounts used, payment information and benefits.

What is the legal basis for the processing? 
Enter into a contract on membership (Article 6(1)(b) of the GDPR.

Consent to receive marketing (Article 6(1)(a) of the GDPR). 

We may also process your personal data on the basis of our legitimate interests in handling e.g. inquiries, conducting marketing, developing existing and new services and products, conducting analyses and statistics of our customer segments, products and services (Article 6(1)(f) of the GDPR).

When will the personal data be deleted? 
1 year after termination of membership.

A copy of the consent is kept 2 years after withdrawal of consent or 2 years after termination of membership.

Which people are covered? 
People who make purchases through the webshop.

For what purposes is the personal data used?
Fulfil the purchase agreement entered into with you, including to be able to deliver the ordered goods and/or tickets, handle order confirmation, complaints, returns and send terms and conditions.

What types of personal data are used? 
Name, address, email, phone, nationality, purchase history, geolocation, IP address, and payment information.

*It may be stated whether or not it is mandatory to provide the information. 

What is the legal basis for the processing? 
Enter into and comply with the purchase agreement (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
2 years after last purchase.

However, bookkeeping information will be stored 6 years after purchase in accordance with the Danish Consolidated Bookkeeping Act.

Which people are covered? 
Visitors making purchases at ARoS Information, ARoS Shop Cafe & Orangeri.

For what purposes is the personal data used?
Conclude agreement on purchase.

What types of personal data are used? 
Name, date of birth, address, e-mail and possibly photo.

What is the legal basis for the processing? 
Enter into and comply with the purchase agreement (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
2 years after last purchase.

Which people are covered? 
Persons who have consented to receive newsletters.

For what purposes is the personal data used?
Send marketing as further described in the consent.

What types of personal data are used? 
Email, name and phone number.

What is the legal basis for the processing? 
Consent (Article 6(1)(a) of the GDPR).

When will the personal data be deleted? 
2 years after withdrawal of consent. 

Which people are covered? 
Persons who have consented to receive newsletters.

For what purposes is the personal data used?
Targeted advertising, including by sending personalised emails and newsletters.

What types of personal data are used? 
Email, name, click behavior in relation to forwarding material, order history and preferences.

What is the legal basis for the processing? 
Legitimate interests in being able to improve and develop our services (Article 6(1)(f) of the GDPR).

When will the personal data be deleted? 
As long as your consent to receive newsletters is active.

Which people are covered? 
People who contact customer service or otherwise communicate with us.

For what purposes is the personal data used?
Handling your inquiry and possibly your order, observing your rights, general communication as well as statistics and analysis.

What types of personal data are used? 
E-mail, name, telephone number, what your inquiry relates to, date of inquiry and other information you provide.

We encourage you not to provide sensitive personal data or social security numbers (CPR) to us unless they are strictly necessary for the processing of your inquiry

What is the legal basis for the processing? 
We may process your personal data on the basis of our legitimate interests in handling your inquiry, communicating with you, and developing our products and services (Article 6(1)(f) of the GDPR).

If your inquiry concerns a (potential) conclusion of a contract, we process your data in order to be able to carry out pre-contractual measures (Article 6(1)(b) of the GDPR).

When will the personal data be deleted? 
General inquiries and cases are generally stored for 2 years, but the storage time may vary depending on the content of the cases.

Accounting material, including personal data, which we are obliged to store in accordance with the Danish Consolidated Bookkeeping Act, is stored for up to 6 years.

Which people are covered? 
Annual tick et holders.

For what purposes is the personal data used?
Issue and administer your annual pass as well as ensure identification when purchasing an annual pass.

What types of personal data are used? 
Name, address, telephone number, date of birth, and possibly picture.

What is the legal basis for the processing? 
To enter into a contract and ensure identification (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
5 years after the ticket expires.

Which people are covered? 
Restaurant visitors.

For what purposes is the personal data used?
Create and manage booking.

What types of personal data are used? 
Contact information and other information you provide in connection with table reservations.

What is the legal basis for the processing? 
To enter into an agreement (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
1 year after last booking.

Which people are covered? 
Contact person for booking.

For what purposes is the personal data used?
Create and manage booking.

What types of personal data are used? 
Name, contact information and other information you provide in connection with booking.

What is the legal basis for the processing? 
To enter into an agreement (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
1 year after last booking.

Which people are covered? 
Persons who have consented to receive newsletters and/or marketing cookies.

For what purposes is the personal data used?
Create audiences for subsequent advertising for sales and marketing purposes through banners and advertisements.

What types of personal data are used? 
Non-reversible hashed email  address, user ID, geographic location, interests, IP address, MAC address, click behavior, interaction with ads, filled in data upon purchase, and search history.

What is the legal basis for the processing? 

Our interest in spreading awareness of our products and services, including in relation to other persons who have similar interests (Article 6(1)(f) of the GDPR).         

If you wish to object to Google, you can do so by controlling your ads on Google services via "Google Custom Match" in your Google Ads settings: https://support.google.com/google-ads/answer/6379332?hl=en.

You can also read more about how Google acts as joint data controller with us. You can read more about their processing of your personal data via this link: https://policies.google.com/privacy?hl=en. 

When will the personal data be deleted? 
Follows the deletion deadlines for newsletters and cookies.

Which people are covered? 
Persons who have consented to receive newsletters and/or marketing cookies.

For what purposes is the personal data used?
Create audiences for subsequent advertising for sales and marketing purposes through banners and advertisements.

What types of personal data are used? 
Non-reversible hashed email  address, user ID, geographic location, interests, IP address, MAC address, click behavior, interaction with ads, filled in data upon purchase, and search history.

What is the legal basis for the processing? 
Our interest in spreading awareness of our products and services, including in relation to other persons who have similar interests (Article 6(1)(f) of the GDPR). 

You can object to Facebook by changing your settings on Facebook and disabling "Facebook Custom Audiences and Lookalike Audiences", following the instructions at the following link: https://facebook.com/settings/?tab=ads#.

Meta (Facebook) acts as joint data controller with us. You can read more about Facebook's processing of your personal data via this link: https://facebook.com/about/privacy

When will the personal data be deleted? 
Follows the deletion deadlines for newsletters and cookies.

Which people are covered? 
Participants in competitions.

For what purposes is the personal data used?
Enter the contest and sending the prize if you win. Compliance with the conditions of competition.

Announce the winner on social media.

What types of personal data are used? 
Name and e-mail as well as any information that you have won. We will also collect your address if you win a prize that needs to be physically shipped.

What is the legal basis for the processing? 
Legitimate interest in conducting the competition and possibly publishing your name and sending the prize if you have won (Article 6(1)(f) of the GDPR).

Comply with the competition conditions (Article 6(1)(b) of the GDPR).

When will the personal data be deleted? 
1 year after the end of the competition.

Which people are covered? 
Participants in events, tours, events and events.

For what purposes is the personal data used?
Registration, holding and administration.

What types of personal data are used? 
Contact information and information about participation in the event, event, tour or event.

What is the legal basis for the processing? 
Enter into an agreement (Article 6(1)(b) of the GDPR). 

When will the personal data be deleted? 
1 year after completion of the event.

Which people are covered? 
Visitors or photos you have uploaded on social media.

For what purposes is the personal data used?
Marketing.

What types of personal data are used? 
Photos/videos and contact information.

Your signature and copy of contract.

Copy of consent and copy of consent from your parent or guardian if you are under 15 years old.

What is the legal basis for the processing? 
We base the processing of your personal data on our legitimate interest in being able to market ourselves on, among other things, social media and the website in the case of a mood / current image where it is difficult or impossible to identify you. (Article 6(1)(f) of the GDPR). In accordance with the Danish Data Protection Agency's current guidelines, we carry out an overall assessment in order to assess whether publication of the image requires your prior consent.

If the overall assessment shows that publication requires your prior consent or conclusion of a contract, we will obtain this or conclude the contract before using the image or video of you for marketing purposes (Article 6(1)(a) (consent) of the GDPR and Article 6(1)(b) (contract) of the GDPR). 

When will the personal data be deleted? 
When consent is revoked or when the contract expires.

Storage of mood images depends on the specific situation but is generally not deleted from social media unless you object. See below how you can object.

Which people are covered? 
Injured.

For what purposes is the personal data used?
Handle physical damage occurring at the museum and defend or establish legal claims.

What types of personal data are used? 
Name, address, telephone, e-mail and description of the damage.

Description of the damage may contain sensitive personal data in the form of health information.

What is the legal basis for the processing? 
Legitimate interest in handling the damage, including in relation to damages, legal claims and insurance (Article 6(1)(f) of the GDPR).

Establish and defend legal claims where it is strictly necessary to process health data (Article 9(2)(f) of the GDPR).

When will the personal data be deleted? 
3 years from completion of claims handling.

Which people are covered? 
Persons involved in incidents in violation of legislation or internal guidelines/bylaws.

For what purposes is the personal data used?
Defend, exercise and establish legal claims and, in certain cases, exclude persons from future visits or report the matter to the police. 

What types of personal data are used? 
Description of the incident, which may involve general information, criminal information and, in special cases, sensitive information such as race or health. 

What is the legal basis for the processing? 
Legitimate interest in establishing, defending, and asserting legal claims, as well as to exclude persons from future visits if the person has acted contrary to guidelines or legislation.

Article 6(1)(f) of the GDPR (general personal data:

Section 8(3) of the Danish Data Protection Act (criminal information).

Article 9(2)(f) of the GDPR (if sensitive information such as race or health is included).

When will the personal data be deleted? 
At the end of the case or 3 years after notification.

The list of expelled persons is kept for as long as the quarantine is in force. 

Which people are covered? 
People who have purchased products from us or participated in events, events or similar.

For what purposes is the personal data used?
To inform about your purchase or visit.

What types of personal data are used? 
Email or phone number.

What is the legal basis for the processing? 
Legitimate interest in informing about a variety of circumstances, including in case of pandemics, practical conditions, cancellations, changes and other significant matters related to the purchase or visit (Article 6(1)(f) of the GDPR). 

When will the personal data be deleted? 
3 years after last purchase or participation.

Which people are covered? 
People who have purchased products from us, visitors or people who have participated in events or the like.

For what purposes is the personal data used?Improve our products and services and marketing. In addition, to generally ensure customer satisfaction.

What types of personal data are used? 
Contact information, language, nationality and purchase information and satisfaction.

What is the legal basis for the processing? 
Legitimate interest in informing about a variety of circumstances, including in case of pandemics, practical conditions, cancellations, changes and other significant matters related to the purchase or visit (Article 6(1)(f) of the GDPR). 

When will the personal data be deleted? 
3 years after last purchase or participation.

Which people are covered? 
Gift card recipients.

For what purposes is the personal data used?Register, issue, and manage the gift card.

What types of personal data are used? 
Contact information, payment information and content of gift cards.

What is the legal basis for the processing? 
Enter into and comply with an agreement on gift cards (Article 6(1)(b) of the GDPR).

Ensure compliance with the Danish Payment Act in relation to electronic gift cards (Article 6(1)(c) of the GDPR).

When will the personal data be deleted? 
1 year after gift card expiration.

Accounting material, including personal data, which we are obliged to store in accordance with the Danish Consolidated Bookkeeping Act, is stored for up to 6 years.

Which people are covered? 
Payers.

For what purposes is the personal data u
Ensure documentation of the purchase in accordance with The Danish Consolidated Bookkeeping Act.

What types of personal data are used? 
Transaction Information.

What is the legal basis for the processing? 
Legal obligation cf. the Danish Consolidated Bookkeeping Act (Article 6(1)(c) of the GDPR).

When will the personal data be deleted? 
Accounting material, including personal data, which we are obliged to store in accordance with the Danish Consolidated Bookkeeping Act, is stored for up to 6 years.

Which people are covered? 
Sponsor/contributors.

For what purposes is the personal data u
Manage the sponsorship and issue invoices.

What types of personal data are used? 
Name, address, e-mail, telephone, size of sponsorship, company name, position, signature and in some cases CPR number.

What is the legal basis for the processing? 
Legal obligation cf. the Danish Consolidated Bookkeeping Act and the Danish Tax Act (Article 6(1)(c) of the GDPR).

Legal obligation, cf. section 11(2)(1) of the Danish Data Protection Act, whose social security number (CPR-number) is required in relation to reporting to the tax authorities.

Enter into an agreement on sponsorship / contribution (Article 6(1)(b) of the GDPR).

When will the personal data be deleted? 
7 years from completion of the sponsorship.

Which people are covered? 
Participants in training

For what purposes is the personal data u
Register and conduct training.

What types of personal data are used? 
Name, address, email and telephone number.

What is the legal basis for the processing? 
Legal obligation cf. the Danish Consolidated

Enter into an agreement on teaching (Article 6(1)(b) of the GDPR).

Legitimate interest in registering and verifying participants (Article 6(1)(f) of the GDPR).

When will the personal data be deleted? 
6 months after completion of training.

Which people are covered? 
Visitors.

For what purposes is the personal data u
Initiate cases about other visitors' behavior.

What types of personal data are used? 
Contact information and description of incidents.

What is the legal basis for the processing? Legitimate interest in handling conflicts and ensuring proper behaviour in accordance with guidelines (Article 6(1)(f) of the GDPR).

When will the personal data be deleted? 
6 months after case closed.

Which people are covered? 
People who complain about our products, visits, or services.

For what purposes is the personal data u
Handle the complaint in accordance with applicable legislation, guidelines and terms and conditions.

What types of personal data are used? 
Description of complaint, time of purchase, visit or experience and contact information.

What is the legal basis for the processing?
To assess whether the agreement has been complied with (Article 6(1)(b) of the GDPR).

To assess the complaint in relation to the Danish Sale of Goods Act and the Consumer Contracts Act (Article 6(1)(c) of the GDPR). 

When will the personal data be deleted? 
2 years from the closure of the complaint.

Which people are covered? 
Suppliers and partners.

For what purposes is the personal data u
General planning, fulfillment and administration of collaborations, including contracts.

Administration such as processing payments, evaluating credit ratings, accounting, auditing, as well as providing support.

Product and service development.

Statistics and analysis.

Conflict management.

What types of personal data are used?
Name, email address, telephone number and corresponding contact details

Individual information, such as preferred languages

Organisational information such as company name and address, job title, area of employment, primary place and country of work.

Contractual information such as orders, invoices, contracts and other agreements between your company that may include, for example, your contact information.

Financial information, such as payment terms, bank details and credit ratings (in the case of a sole proprietorship).

What is the legal basis for the processing?
In certain cases, the processing of your personal data is necessary for the performance of a contract (Article 6(1)(b) of the GDPR).

We may process your personal data on the basis of our legitimate interests in, for example, managing day-to-day operations in accordance with lawful and fair business practices, including planning, executing and administering the cooperation or our legitimate interest in, for example, carrying out credit ratings, statistics, analyses, marketing activities (where consent is not required), providing support, improvement and development of our products and services. The processing may also be necessary for our legitimate interest in preventing fraud or establishing, defending or asserting legal claims (Article 6(1)(f) of the GDPR).

The processing of your personal data will in some cases be necessary for compliance with legal obligations, such as our obligation to prevent illegal activities (Article 6(1)(c) of the GDPR).

When will the personal data be deleted? 
2 years after last contact.

Types of personal data
Relevant information in relation to a specific dispute, including in some cases video recordings and damage incidents.

Legal basis 
Article 6(1)(f) of the GDPR (legitimate interest).

Article 6(1)(c) of the GDPR (legal obligation to report descriptions of damage to security authorities).

Types of personal data
Contact information and social security number.

Legal basis 
Article 6(1)(c) of the GDPR (legal obligation) cf. tax legislation.

Section 11(2)(1) of the Danish Data Protection Act, whose CPR number is required in relation to reporting to the tax authorities.

Types of personal data
Payment and card information.

Legal basis 
Article 6(1)(b) (contract) of the GDPR.