Privacy Policy

Who does this apply to?
Website visitors who have given their consent via the cookie banner.

For what purposes are personal data used?
Marketing, statistics, preferences and functionality.
You can read more about the purposes via the cookie banner.

What types of personal data are used?
User ID, geographical location, interests, IP address, operating system, browser type, device type, browsing activity on the website, MAC address, click behaviour, interaction with advertisements, data provided when making a purchase, and search history.

The processing of personal data in relation to necessary cookies is based on an agreement to enable you to use the functionality of the websites (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

What is the legal basis for the processing?
The processing of personal data in relation to statistical and preference cookies is based on our legitimate interest in providing you with the best possible products and services (Article 6(1)(f) of the GDPR).

The processing of personal data in relation to marketing cookies, including processing based on your preferences, is based on your prior consent (Article 6(1)(a) of the GDPR).

In addition, we always obtain valid cookie consent in accordance with the Danish Executive Order on Requirements for Information and Consent when Storing or Accessing Information in End-User Terminal Equipment before cookies are placed on your terminal equipment.

When are personal data deleted?
Please refer to the cookie banner, where the retention periods (expiry periods) are specified.

You can view the cookie banner by clicking this link.

Which individuals are covered?
Visitors and suppliers.

For what purposes are personal data used?
To create a safe and secure environment, prevent crime, and preserve evidence for use in police investigations.

What types of personal data are processed?
Images of your movements and, in certain cases, information relating to criminal offences in connection with theft or other crimes.

What is the legal basis for the processing?
We process the personal data based on our legitimate interest in creating a safe and secure environment, preventing crime, and preserving evidence for use in police investigations (Article 6(1)(f) of the General Data Protection Regulation (GDPR) and Section 8(3) of the Danish Data Protection Act).

When are the personal data deleted?
The recordings are deleted 30 days after they were made.

Which individuals are covered?
Users.

For what purposes are personal data used?
To create a user profile for the purpose of purchasing and registering annual passes, season passes and tickets, as well as obtaining benefits.

What types of personal data are processed?
Username, password, name, address, date of birth, photograph, discounts, email address and purchase history.

What is the legal basis for the processing?
To enter into and perform a contract (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
One year after the user profile has been deleted.

Which individuals are covered?
Users.

For what purposes are personal data used?
To create a user profile for the purpose of purchasing and registering annual passes, season passes and tickets, as well as obtaining benefits.

What types of personal data are processed?
Username, password, name, address, date of birth, photograph, discounts, email address and purchase history.

What is the legal basis for the processing?
To enter into and perform a contract (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
One year after the user profile has been deleted.

Which individuals are covered?
Individuals who make purchases via the webshop.

For what purposes are personal data used?
To enter into and fulfil the purchase agreement with you, including delivering the ordered goods and/or tickets, handling order confirmations, complaints and returns, and sending the terms and conditions.

What types of personal data are processed?
Name, address, email address, telephone number, country code, purchase history, geolocation, IP address and payment information. It will be indicated whether providing the information is mandatory or optional.

What is the legal basis for the processing?
To enter into and perform a purchase agreement (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
Two years after the most recent purchase. However, information subject to statutory accounting requirements will be retained for six years after the purchase in accordance with the Danish Bookkeeping Act.

Which individuals are covered?
Individuals who have given their consent to receive newsletters.

For what purposes are personal data used?
To send marketing communications as described in the consent.

What types of personal data are processed?
Email address, name and telephone number.

What is the legal basis for the processing?
Consent (Article 6(1)(a) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
Two years after the consent has been withdrawn.

Which individuals are covered?
Individuals who have given their consent to receive newsletters.

For what purposes are personal data used?
For targeted marketing, including sending personalised emails and newsletters.

What types of personal data are processed?
Email address, name, click behaviour in relation to distributed materials, order history and preferences.

What is the legal basis for the processing?
Our legitimate interests in improving and developing our services (Article 6(1)(f) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
As long as your consent to receive newsletters remains active.

Which individuals are covered?
Individuals who contact customer service or otherwise communicate with us.

For what purposes are personal data used?
To handle your enquiry and, where applicable, your order, exercise your rights, communicate with you generally, and for statistical and analytical purposes.

What types of personal data are processed?
Email address, name, telephone number, the subject of your enquiry, the date of the enquiry, and any other information you provide.

We encourage you not to provide sensitive personal data or your Danish CPR number unless it is strictly necessary for handling your enquiry.

What is the legal basis for the processing?
We may process your personal data based on our legitimate interests in handling your enquiry, communicating with you, and developing our products and services (Article 6(1)(f) of the General Data Protection Regulation (GDPR)).

If your enquiry concerns entering into a potential or actual agreement, we process your personal data in order to take steps at your request prior to entering into an agreement (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
General enquiries and cases are generally retained for two years, but the retention period may vary depending on the nature and content of the case.

Accounting records, including personal data that we are required to retain under the Danish Bookkeeping Act, are retained for up to six years.

Which individuals are covered?
Season pass holders / annual pass holders.

For what purposes are personal data used?
To issue and administer your season pass / annual pass, ensure identification when purchasing a season pass / annual pass, and manage access control.

What types of personal data are processed?
Name, address, telephone number, date of birth, and, where applicable, photograph.

What is the legal basis for the processing?
To enter into an agreement and ensure identification
(Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
Two years after the pass has expired.

Which individuals are covered?
Restaurant guests.

For what purposes are personal data used?
To create and manage restaurant reservations.

What types of personal data are processed?
Contact details and other information you provide in connection with table reservations.

What is the legal basis for the processing?
To enter into an agreement (
Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
Two years after the most recent booking.

Which individuals are covered?
Guests staying overnight.

For what purposes are personal data used?
To manage your booking and enter into an agreement for accommodation.

To comply with the Danish Passport Regulations and the Danish Aliens Regulations.

What types of personal data are processed?
Name and contact details, payment information, and any special requests or preferences relating to your stay, including specific dietary requirements.

Identification information collected at check-in. This may include your name, date of birth, occupation, nationality, permanent residence, date of arrival, and the type and number of your passport or other travel document.

What is the legal basis for the processing?
To enter into and perform an agreement for accommodation
(Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

To comply with our legal obligation to comply with the Danish Passport Regulations and the Danish Aliens Regulations
(Article 6(1)(c) of the General Data Protection Regulation (GDPR)).

When are the personal data deleted?
Two years after the most recent overnight stay.

Which individuals are covered?
Individuals who have given their consent to receive newsletters and/or to the use of marketing cookies.

For what purposes are personal data used?
To create audiences for subsequent advertising for sales and marketing purposes, including through banners and other advertisements.

What types of personal data are used?
Non-reversibly hashed email addresses, user IDs, geographic location, interests, IP addresses, MAC addresses, click behaviour, interactions with advertisements, data provided when making a purchase, and search history.

What is the legal basis for the processing?
Our legitimate interest in increasing awareness of our products and services, including among other individuals with similar interests, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).

If you wish to object to Google's processing, you can do so by managing your advertising preferences on Google's services via “Google Custom Match” in your Google Ads settings.

You can also read more about how Google acts as a joint controller together with us. You can read more about Google's processing of your personal data via this link.

When are personal data deleted?
Personal data are deleted in accordance with the retention periods applicable to newsletters and marketing cookies.

Which individuals are covered?
Individuals who have given their consent to receive newsletters and/or to the use of marketing cookies.

For what purposes are personal data used?
To create audiences for subsequent advertising for sales and marketing purposes, including through banners and other advertisements.

What types of personal data are used?
Non-reversibly hashed email addresses, user IDs, geographic location, interests, IP addresses, MAC addresses, click behaviour, interactions with advertisements, data provided when making a purchase, and search history.

What is the legal basis for the processing?
Our legitimate interest in increasing awareness of our products and services, including among other individuals with similar interests, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).

You can object to Facebook's processing by changing your settings on Facebook and disabling “Facebook Custom Audiences and Lookalike Audiences” by following the instructions provided via this link.

Meta (Facebook) acts as a joint controller together with us. You can read more about Facebook's processing of your personal data via this link.

When are personal data deleted?
Personal data are deleted in accordance with the retention periods applicable to newsletters and marketing cookies.

Which individuals are covered?
Participants in competitions.

For what purposes are personal data used?
To enable you to participate in the competition and to send the prize if you win, as well as to ensure compliance with the competition terms and conditions.

To publish the winner's name on social media and on our website.

What types of personal data are used?
Name and email address and, where applicable, information that you have won the competition. We also collect your address if you win a prize that needs to be sent physically.

What is the legal basis for the processing?
Our legitimate interest in conducting the competition, potentially publishing your name, and sending the prize if you win, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).

To comply with the competition terms and conditions, in accordance with Article 6(1)(b) of the General Data Protection Regulation (GDPR).

When are personal data deleted?
Personal data are deleted one year after the competition has ended.

Which individuals are covered?
Participants in events, tours, activities and other events.

For what purposes are personal data used?
For registration, organisation and administration of the event, tour, activity or other event.

What types of personal data are used?
Contact details and information about participation in the event, activity, tour or other event.

What is the legal basis for the processing?
To enter into and perform an agreement, in accordance with
Article 6(1)(b) of the General Data Protection Regulation (GDPR).

When are personal data deleted?
Personal data are deleted two years after the event has ended.

Which individuals are covered?
Visitors or individuals whose photos or videos have been uploaded to social media.

For what purposes are personal data used?
For marketing purposes.

What types of personal data are used?
Photos and/or videos and contact details.

Your signature and a copy of the contract.
A copy of your consent and, if you are under 15 years of age, a copy of the consent provided by your parent or legal guardian.

What is the legal basis for the processing?
We base the processing of your personal data on our legitimate interest in marketing our organisation, including on social media and our website, where the image is a general atmosphere photo in which it is difficult or impossible to identify you (Article 6(1)(f) of the General Data Protection Regulation (GDPR)). In accordance with the applicable guidelines issued by the Danish Data Protection Agency, we make an overall assessment to determine whether publication of the image requires your prior consent.

If the overall assessment shows that publication requires your prior consent or the conclusion of a contract, we will obtain your consent or enter into the contract before using the photo or video of you for marketing purposes (Article 6(1)(a) of the GDPR (consent) and Article 6(1)(b) of the GDPR (contract)).

When are personal data deleted?
When consent is withdrawn or when the contract expires.

The retention period for general atmosphere photos depends on the specific circumstances. However, such photos will generally not be deleted from social media unless you object to their use. See below for information on how to object.

Which individuals are covered?
Individuals who have been injured.

For what purposes are personal data used?
To handle physical injuries occurring at the museum and to establish, exercise or defend legal claims.

What types of personal data are used?
Name, address, telephone number, email address and a description of the injury. The description of the injury may contain special categories of personal data in the form of health information.

What is the legal basis for the processing?
Our legitimate interest in handling the injury, including in relation to compensation, legal claims and insurance, in accordance with 
Article 6(1)(f) of the General Data Protection Regulation (GDPR).

To establish, exercise or defend legal claims where the processing of health information is strictly necessary, in accordance with
Article 9(2)(f) of the GDPR.

When are personal data deleted?
Personal data are deleted three years after the handling of the injury has been completed.

Which individuals are covered?
Individuals involved in incidents that are contrary to applicable legislation or internal guidelines/articles of association.

For what purposes are personal data used?
To establish, exercise and defend legal claims and, in certain cases, to exclude individuals from future visits or report the matter to the police.

What types of personal data are used?
A description of the incident, which may include ordinary personal data, information relating to criminal offences and, in certain cases, special categories of personal data, such as information about racial or ethnic origin or health.

What is the legal basis for the processing?
Our legitimate interest in establishing, exercising and defending legal claims and in excluding individuals from future visits if they have acted in breach of applicable guidelines or legislation, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).

For ordinary personal data: Section 8(3) of the Danish Data Protection Act.

For information relating to criminal offences: Section 8(3) of the Danish Data Protection Act.

If the processing involves special categories of personal data, such as information about racial or ethnic origin or health: Article 9(2)(f) of the GDPR.

When are personal data deleted?

Personal data are deleted when the case is closed or three years after the matter has been reported.

A list of individuals who have been banned from visiting is retained for as long as the ban remains in effect.

Which individuals are covered?
Individuals who make payments.

For what purposes are personal data used?
To ensure documentation of purchases in accordance with the Danish Bookkeeping Act.

What types of personal data are used?
Transaction information.

What is the legal basis for the processing?
Compliance with a legal obligation under the Danish Bookkeeping Act, in accordance with Article 6(1)(c) of the General Data Protection Regulation (GDPR).

When are personal data deleted?
Accounting records, including personal data that we are required to retain under the Danish Bookkeeping Act, are retained for up to six years.

Which individuals are covered?
Sponsors and contributors.

For what purposes are personal data used?
To administer the sponsorship or contribution and issue invoices.

What types of personal data are used?
Name, address, email address, telephone number, amount of the sponsorship or contribution, company name, position, signature and, in certain cases, CPR number (Danish personal identification number).

What is the legal basis for the processing?
Compliance with a legal obligation under the Danish Bookkeeping Act and tax legislation, in accordance with Article 6(1)(c) of the General Data Protection Regulation (GDPR).

Where a CPR number is required for reporting to the Danish tax authorities, the legal basis is Section 11(2)(1) of the Danish Data Protection Act.

To enter into and perform an agreement concerning the sponsorship or contribution, in accordance with Article 6(1)(b) of the GDPR.

When are personal data deleted?
Personal data are deleted six years after the sponsorship or contribution has been completed.

Which individuals are covered?
Participants in educational programmes.

For what purposes are personal data used?
To register participants and conduct educational programmes.

What types of personal data are used?
Name, address, email address, telephone number, name of school and year group.

What is the legal basis for the processing?
To enter into and perform an agreement concerning the educational programme, in accordance with
Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Our legitimate interest in registering and verifying participants, in accordance with
Article 6(1)(f) of the GDPR.

When are personal data deleted?
Personal data are deleted six months after completion of the educational programme.

Which individuals are covered?
Individuals who submit complaints about our products, visits or services.

For what purposes are personal data used?
To handle the complaint in accordance with applicable legislation, guidelines and terms and conditions.

What types of personal data are used?
Description of the complaint, date and time of the purchase, visit or experience, as well as contact details.

What is the legal basis for the processing?
To assess whether the agreement has been complied with, in accordance with
Article 6(1)(b) of the General Data Protection Regulation (GDPR).

To assess the complaint in accordance with the Danish Sale of Goods Act and the Danish Consumer Contracts Act, in accordance with
Article 6(1)(c) of the GDPR.

When are personal data deleted?
Personal data are deleted two years after the complaint has been resolved.

Which individuals are covered?
Suppliers and business partners.

For what purposes are personal data used?
For general planning, performance and administration of business relationships, including contracts.

For administrative purposes, such as processing payments, evaluating credit assessments, maintaining accounts, conducting audits and providing support.

• Product and service development.
• Statistics and analysis.
• Handling disputes and conflicts.

What types of personal data are used?
Name, email address, telephone number and similar contact details.

Individual information, such as preferred language.

Organisational information, such as the company's name and address, job title, area of employment, primary place of work and country of employment.

Contractual information, such as orders, invoices, contracts and other agreements with your company, which may contain, for example, your contact details.

Financial information, such as payment terms, bank details and credit assessments (where you operate as a sole proprietor).

What is the legal basis for the processing?
In certain cases, the processing of your personal data is necessary to perform a contract, in accordance with Article 6(1)(b) of the General Data Protection Regulation (GDPR).

We may process your personal data based on our legitimate interests, including administering our day-to-day operations in accordance with lawful and fair business practices, including planning, carrying out and administering the business relationship. This may also include our legitimate interest in carrying out credit assessments, statistics and analyses, conducting marketing activities (where consent is not required), providing support, and improving and developing our products and services.

The processing may also be necessary for our legitimate interest in preventing fraud or establishing, exercising or defending legal claims, in accordance with Article 6(1)(f) of the GDPR.

In certain cases, the processing of your personal data may be necessary to comply with legal obligations, such as our obligation to prevent unlawful activities, in accordance with Article 6(1)(c) of the GDPR.

When are personal data deleted?
Personal data are deleted two years after the most recent contact.