VisitAarhus Data Protection Notice

1.    We are the Data Controller – How to Contact Us

This Data Protection Notice is intended to inform you about how VisitAarhus processes the personal data that you have provided to us, or that we have collected in connection with the purposes stated in section 3, when you act as a:

i)     job applicant,
ii)    website user,
iii)   newsletter subscriber,
iv)   partner or supplier,
v)    participant on insight and press trips,
vi)   participant on fairs and exhibitions, workshops, and partner events,
vii)  VisitAarhus guest or participant in market research, or
viii) competition contender.

We will process and handle your personal data solely in accordance with this Data Protection Notice and the legislation to which we are subject, including Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 regarding the protection of natural persons in relation to the processing of personal data and on the free movement of such data (the ‘General Data Protection Regulation’), Law No. 502 of 23 May 2018 on supplementary provisions to the General Data Protection Regulation (the ‘Data Protection Act’), and any other legislation supplementing these rules.

VisitAarhus is responsible for handling your personal data. Our contact information in found below:

VisitAarhus
Balticagade 19, 1.
DK – 8000 Aarhus C
Denmark
VAT Number 17579339
Phone: (+45) 87 31 50 10
Email: info@visitaarhus.com

2. The Personal Data We Collect, From Where We Collect It, the Purposes for Which We Collect It, and the Legal Basis for Our Handling of Your Personal Data

We are dedicated to protecting personal data and strive for as much transparency as possible surrounding our collection and processing of personal data. When we process personal data about you, you are entitled to receive information about the type of data we process and for which purposes.

In the following, we will provide information related to each of the particular groups of individuals we are processing data on. In order to receive further information on any of the groups, please select one.

Job Applicants 

In most cases, we will collect data directly from you. However, we may also collect data about you from other sources, including recruitment agencies, your references, as well as publicly accessible sources. When we gather references, it will be done with your prior consent.

We may also collect data about you from publicly accessible sources, including social media. When you submit your application with attachments, such as your CV, your photo, references, diplomas, and test results if relevant, we process your data as part of our evaluation of your qualifications in relation to the position in question and in deciding whether or not we wish to offer you an interview and possibly a position. Furthermore, we may also ask you to complete a qualification and/or personality test to assess your qualifications, skills, and personality in relation to the position in question.

As part of our exercise of authority, the purpose of this processing is related to hiring employees and to take necessary measures prior to entering into a potential contract of employment in accordance with Article 6(1)(b) and (e) of the General Data Protection Regulation.

After obtaining your consent, we may collect data about you from references, including data about your work experience and qualifications.

Website Users

When you visit VisitAarhus' websites www.visitaarhus.dk, www.visitaarhus.com, www.visitaarhus.de (as well as other pages owned by VisitAarhus: www.visitaarhusconvention.dk, www.visitaarhusconvention.com and discover.visitaarhus.com) we collect data about your use of the website such as your type of browser, which search words you use on the website, your IP address including your network location, technical data about your device and your browser behaviour as well as other data about your computer. We collect this data using cookies and similar technologies, including pixels. You can read more about our use of cookies in our cookie policy.

The purpose of this is to optimise user experience and the functionality of the website, including compiling statistics. Furthermore, data about your behaviour on VisitAarhus' websites is used in our efforts to better understand (profile) the individuals visiting the respective websites in order to improve marketing opportunities on our websites as well as by the use of third parties.

When we use cookies and similar technologies for the technical accessibility of VisitAarhus' websites, the processing is carried out for the purpose as a DMO of developing and marketing the Aarhus Region as Denmark's second largest tourist destination as part of our regulatory activities in accordance with Article 6 (1)(e). The same applies if, in connection with your inquiry, we process data about your name, email address, and any other information you choose to convey to us in connection with your inquiry. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

In other cases, e.g. when we use cookies and similar technologies to improve VisitAarhus' profiling, marketing, and websites, the processing is based on your consent, as it is stated on VisitAarhus' websites according to Article 6(1)(a) of the Data Protection Regulation.

Chatbot

GetKarla.ai is a data processor under our instructions and processes data for which we are the data controller. The chatbot answers questions based on content (texts) on www.visitaarhus.com, www.visitaarhus.de, www.visitaarhus.dk. Information collected in connection with enquiries is deleted every 12 months. All conversations containing personal information are automatically masked. This happens once every 24 hours. All data is encrypted in GetKarla.ai's database to ensure that it is legally protected.

The chatbot is provided by GetKarla.ai. The chatbot is created to help visitors easily find the information they are looking for and to improve the user experience. To optimise the performance of the chat function, data from visitors' interactions is collected and analysed. We therefore encourage users to avoid sharing sensitive personal data in the chat. You can read more about how data is handled and stored here: getkarla.ai/data-and-security.

All data collected via the chat solution is exclusively hosted in the EU - server (Frankfurt) language model (Stockholm). None of the data collected is used for language model retraining.

Newsletter Subscribers

When subscribing to one or more of our newsletters, we collect data about your name, email address, possible interests, which newsletter(s) you wish to receive, and that you have consented to receiving newsletters by email. Depending on which newsletter(s) you sign up for, we also collect data about the company/organisation you work for, your job title, phone number, address, and the name of your Instagram profile, blog, or similar.

The purpose of this is to send you the newsletter(s) you have requested and to market the Aarhus Region as a tourist destination with your prior consent in accordance with the General Data Protection Regulation Article 6(1)(a).

Partners and Suppliers

When you communicate with us as a representative for one of our suppliers or business partners or enter into agreements with us on behalf of the company, organisation, or authority you represent, we collect and process data about your name, phone number, email address, workplace, and position.

The purpose of this is to communicate with you and the company, organisation, or authority you represent as well as carry out VisitAarhus' work as a DMO to market the Aarhus Region as a tourist destination in relation to the task of developing and promoting the Aarhus Region as Denmark's second largest tourist destination. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

In most cases, we will collect the data directly from you. However, we will also gather data about you from other sources, including your employer and colleagues.

Participants on Insight and Press Trips

When you as a tour operator, travel agent, journalist, influencer, or other representative participate in insight and press trips, we may collect and process data such as your name, address, email address, phone number, job title, gender, marital status, nationality, date of birth, passport number, data about next of kin, links to your social media profiles, as well as special preferences and dietary needs.

The purpose of this is to be able to communicate with you and tailor a programme specifically for you in connection with your insight or press trip, including ensuring the necessary travel arrangements and precautions as well as carry out VisitAarhus' work as a DMO to market the Aarhus Region as a tourist destination in relation to the task of developing and promoting the Aarhus Region as Denmark's second largest tourist destination. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

In most cases, we will collect the data directly from you in our communication with you and when you fill out one of our forms in relation to your upcoming insight and press trip. However, we will also gather data about you from other sources, including our partners and suppliers, printed articles, and other public media.

Participants on Fairs and Exhibitions, Workshops, and Partner Events

When you take part in fairs and exhibitions, workshops, and partner events, we may collect and process data such as your name, email address, phone number, organisation, and job title.

The purpose of this is to be able to communicate with you as well as carry out VisitAarhus' work as a DMO to market the Aarhus Region as Denmark's second largest tourist destination. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

We only collect and process health data if we deem it relevant and justified in relation to your participation and provided you have expressed your explicit consent to do so in accordance with Article 9 (2)(a) of the General Data Protection Regulation.

In most cases, we will collect the data directly from you, including when we communicate with you, when you give us your business card, and when you sign up for trade fairs and exhibitions, workshops, or partner events.

Guests at VisitAarhus

When you visit VisitAarhus and log on to our guest network, we collect and process data on your MAC address, your IP address, the host name of your computer/device, as well as the web pages you receive data from during your visit.

The purpose of this is to obtain insight into the activities that take place on VisitAarhus’ guest network in order to optimise the solution and perform error detection. This is necessary action in relation to VisitAarhus' work as a DMO to develop and market the Aarhus Region as Denmark's second largest tourist destination. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

Participant in Market Research

When you participate and provide responses in market research or satisfaction surveys as a contact person or representative of a company or organisation, we may collect and process your name, email address, as well as the responses you have provided in the satisfaction survey, including data on the company’s/organisation’s satisfaction with VisitAarhus’ activities and events.

The purpose of this is to collect data on the company’s/organisation's participation and activity level in relation to courses and conferences and to measure satisfaction with our activities and events for the purpose of carrying out VisitAarhus' work as a DMO to market the Aarhus Region as a tourist destination in relation to the task of developing and promoting the Aarhus Region as Denmark's second largest tourist destination. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

In most cases, we collect data about your name and email address from other tourism organisations. However, we may also have your contact information from previous relevant communications, including if the company or partner you work for is a partner or supplier to VisitAarhus.

Competition Contenders

When you enter one of our competitions, we may collect and process data about your name, your email address, your postal code, and phone number.

The purpose of this is to be able to communicate with you and carry out VisitAarhus' work as a DMO to market the Aarhus Region as a tourist destination in relation to the task of developing and promoting the Aarhus Region as Denmark's second largest tourist destination. These responsibilities have been assigned to VisitAarhus by the seven municipalities in the Aarhus Region; the Municipality of Aarhus, the Municipality of Favrskov, the Municipality of Norddjurs, the Municipality of Syddjurs, the Municipality of Randers, the Municipality of Silkeborg, and the Municipality of Viborg.

In most cases, we will collect the data directly from you in connection with your registration to enter the competition.

Personal-Data Recipients

Your personal data may be transferred to suppliers, partners, contract parties, or other third parties who process data on behalf of VisitAarhus. These companies may be data processors who process your personal data in accordance with our instructions and for which we are the data controller. Data processors are not allowed to use the data for any other purposes than fulfilling their agreement with us and are bound by confidentiality regarding this data. We have entered into a data processing agreement with all of our data processors which complies with the requirements of Article 28 of the General Data Protection Regulation. Among other things, this imposes that the data processors take appropriate technical and organisational measures in such a way that the processing complies with the requirements of the regulation and ensures the protection of your rights.

Furthermore, your personal data may also be disclosed to public authorities to the extent required by legal obligations or it is necessary to perform the task assigned to VisitAarhus. In most cases, these authorities will be independently responsible for processing your personal data.  

In addition to this, VisitAarhus may in certain cases be joint data controller alongside the recipients of your personal data. This especially applies to the processing of your personal data collected in connection with your visits to the VisitAarhus websites.

In certain cases, we may transfer personal data outside of the EU/EEA to recipients who may not necessarily have the same level of protection for personal-data processing as it is the case within EU/EEA countries. When this is the case, we will inform you of the required or appropriate safeguards and where you can find or request them.

In the following, we will provide information on the transmission of data related to each of the particular groups of individuals we are processing data on. In order to receive further information on any of the groups, please select one.

Job Applicants

Your personal data may be disclosed to our data processors, including our e-recruitment system suppliers, providers of personality assessment programmes, as well as our hosting providers to the extent that we register your data in our IT systems.

Website Users

We use external partners for technical operations, improvement and hosting of the website as well as other purposes. These companies are data processors and operate under our instructions, processing data for which we are the data controller.

Additionally, we collaborate with certain third parties for targeted marketing purposes. These include Meta, based in Ireland, Google Analytics operated by Google LLC, and Google Tag Manager operated by Google LLC, based in the US, and Matomo, based in New Zealand.

Meta Ireland is also a joint data controller for the joint processing that takes place in connection with your visit to VisitAarhus websites, and the information required in accordance with Article 13(1)(a) and (b) of the General Data Protection Regulation can be found in Meta Ireland's data policy at www.facebook.com/about/privacy. Among other things, this policy includes information on Meta Ireland’s processing of personal data, including the legal basis on which Meta Ireland's processing is based, as well as on the ways in which it is possible for you to exercise your rights against Meta Ireland.

VisitAarhus has acceded to Meta's appendix on data controller to determine the respective responsibilities for compliance with the obligations under the General Data Protection Regulation in connection with joint processing (as specified in the applicable product terms). VisitAarhus and Meta have in this respect agreed to the following:

i)   VisitAarhus is responsible for providing you with the information specified above as a minimum.

ii)  Meta Ireland is responsible for enabling your rights to be exercised in accordance with Articles 15-20 of the General Data Protection Regulation in relation to the personal data held by Meta Ireland after the joint processing.

Google is also a joint data controller for the joint processing that occurs in connection with your visit to VisitAarhus websites. [OBS på kommentar i DK-version.]

The necessary guarantees for the transfer of data to the USA are ensured through Google and Meta's certification under the EU-U.S. Data Privacy Framework in accordance with Article 45 of the General Data Protection Regulation.

Newsletter Subscribers

We use the services of ActiveCampaign and Yulsn for sending out newsletters. These companies are data processors and operate under our instructions, processing data for which we are the data controller.

One of the data processors, ActiveCampaign, is based in the USA. The necessary safeguards for the data transfer to the USA are ensured through ActiveCampaign's certification under the so-called EU-U.S. Data Privacy framework.

Partners and Suppliers

Your personal data may be disclosed to our data processors including our hosting providers to the extent that we register your data in our IT systems.

Furthermore, your personal data may be disclosed to other external partners or suppliers to the extent necessary.

Participants on Insight and Press Trips

Your personal data may be disclosed to our data processors including our hosting providers to the extent that we register your data in our IT systems.

Furthermore, your personal data may be disclosed to external partners, including destination partners, travel agents, hotels, and restaurants to the extent necessary in order for us to plan and carry out the trip you will be taking part in.

We disclose particular categories of data to our partners solely upon your explicit consent to do so.

Participants on Fairs and Exhibitions, Workshops, and Partner Events

Your personal data may be disclosed to our data processors including our hosting providers to the extent that we register your data in our IT systems.

Furthermore, your personal data may be disclosed to external partners to the extent necessary in order for us to plan and carry out the fair or exhibition, workshop, or partner events you will be taking part in. We disclose particular categories of data to our partners solely upon your explicit consent to do so.

Your personal data may also be shared with other participants of the event in the form of a list of participants including the names and companies of the participants.

Guests at VisitAarhus

Your personal data may be disclosed to our data processors including our hosting providers to the extent that we register your data in our IT systems.

Market Research Participants

Your personal data may be disclosed to our data processors including our hosting providers and market research institutes to the extent that we register your data in our IT systems.

In some instances, we publish the results of our analyses and research. The published data will then be presented at an aggregated level, which means that the information is no longer personally identifiable.

Competition Contenders

Your personal data may be disclosed to our data processors including our hosting providers to the extent that we register your data in our IT systems.

Furthermore, your personal data may be made available to VisitAarhus staff with the purpose of drawing a winner.

In certain countries, your personal data will be shared with external parties, including notaries and lawyers, in accordance with local regulations. In these situations, information will be available in the competition terms and conditions.

Storage of Your Personal Data

We delete your personal data when we no longer have valid purpose for storing and processing it.

Special laws including for instance legislation on archive practice, the Danish Limitation Act, and the Danish Bookkeeping Act may provide us with a right or an obligation to store your personal data for a longer period of time. Furthermore, we reserve the right to store your personal data for a longer period than stated below if we assess that it will be necessary for us to establish, raise, or defend a legal claim.

Below, we will provide separate information on the storage of data for each of the groups of individuals we process data on. Select a group to receive further information.

Job Applicants

Applications from applicants who are not offered employment will be after the completion of the application round, unless you have expressed consent to a longer retention period.

Unsolicited applications that are not part of a specific recruitment process will be deleted no later than six months after receipt, unless you have expressed consent to a longer retention period, or we are legally obligated to retain the application.

Website Users

Data collected in relation to your visits to VisitAarhus websites will be deleted when we no longer have a valid purpose for storing and processing it.

Data collected in relation to general inquiries is deleted as the enquiries have been responded to, unless we are legally obligated to retain the inquiry.

Newsletter Subscribers

Data collected in relation to your signing up for our newsletters is deleted upon the withdrawal of your consent to receive the newsletters, unless we are legally obligated to retain the data.

Partners and Suppliers

Your personal data will be deleted upon the termination of the collaboration with the partner or supplier in question, unless we are legally obligated to retain the data. To the extent that your personal data has been collected in relation to negotiations and the conclusion of specific agreements, offers, or similar, we will retain these for a period of up to three years after the termination of the collaboration for documentation purposes.

Participants on Insight and Press Trips

Data collected in relation to our communication with you will be deleted when we no longer have a valid purpose for storing and processing it.

Data collected in relation to the planning and carrying out of insight trips will be deleted no later than three months after returning from the trip, unless we are legally obligated to store the data. Particular types of personal data that we process based on your consent will be deleted no later than at the time when the data is no longer needed, or when you withdraw your consent, unless we are legally obligated to store the data.

Participants on Fairs and Exhibitions, Workshops, and Partner Events

Data collected in relation to our communication with you will be deleted when we no longer have a valid purpose for storing and processing it.

Data collected in relation to your participation on fairs and exhibitions, workshops, or partner events will be deleted no later than three months after the event, unless we are legally obligated to store the data. Particular types of personal data that we process based on your consent will be deleted no later than at the time when the data is no longer needed, or when you withdraw your consent, unless we are legally obligated to store the data.

Guests at VisitAarhus

Data collected in relation to your logging on to our network will be automatically deleted one month after having been collected, unless we are legally obligated to store the data.

Market Research Participants

Your personal data will be deleted or aggregated, i.e. anonymised, immediately upon having completed our market analysis, unless otherwise stated in relation to the specific study or us being legally obligated to retain the data.

Competition Contestants

Data collected in relation to our communication with you will be deleted when we no longer have a valid purpose for storing and processing it.

Data collected in relation to any competition will be deleted no later than three months after drawing its winner. In certain countries, local legislation requires the storage of data for a longer period of time. In these situations, information will be available in the competition terms and conditions.

Your Rights

The General Data Protection Regulation grants you a number of rights in relation to our processing of data about you. In the following, we inform you of your rights in order to provide transparency regarding the processing of this data. Please note, that your rights may be subject to certain conditions or exceptions.

You can read more about your rights in the Danish Data Protection Agency’s guide on the rights of data subjects, which is available at www.datatilsynet.dk.

The Right of Access

At any given time, you have the right to put forward a request for information about e.g. the personal data we have registered about you, the purpose of the registration, the possible types of personal data and data recipients involved, as well as information on the origin of the personal data in question.

You have the right to receive a transcript of the personal data we process about you. Should you wish to request a copy of your personal data, we ask you to do so by emailing info@visitaarhus.com. You may be asked to provide documentation that you are in fact the person you claim to be.

The Right to Rectification

You have the right to the rectification of any incorrect personal data we have relating to you. Should you become aware of any incorrect information in the personal data, we have registered about you, we encourage you to contact us in writing in order for the personal data to be rectified.

The Right to Erasure

In certain cases, you have the right to have all or parts of your personal data in our systems erased at an earlier date than at the time of our standard general deletion. E.g. this applies if you withdraw your consent and we do not have other legal grounds to continue the processing. However, should continued processing of your data be necessary, e.g. for our compliance with legal obligations including the Danish Public Administration Act or the Danish Archives Act, or in order to establish, raise, or defend legal claims, we are not obligated to delete your personal data.

The Right to Restriction of Processing to Simply Storage

In certain cases, you have the right to restrict the processing of your personal data to comprising simply storage, e.g. if you believe that the data we process about you is incorrect.

If you invoke your right to restrict the processing and it is sustained, we may only process your data with your consent – apart from storage – or with the purpose of establishing, raising, or defending a legal claim, or to protect a person or vital societal interests.

The Right to Object

In certain cases, you have the right to object to our otherwise legal processing of your personal data. You also have the right to object to the processing of your data for direct marketing purposes.

The Right to Data Portability

In certain cases, you have the right to obtain the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have this personal data transferred to another data controller.

The Right to Withdraw Your Consent

You have the right at any time to withdraw any consent that you have granted to us for processing your personal data. Should you wish to withdraw your consent, please contact us at info@visitaarhus.com.

The Right to Complain

You have the right at any time to file a complaint to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, regarding VisitAarhus’ processing of your personal data. A complaint can be filed by e-mailing dt@datatilsynet.dk or by calling +45 33 19 32 00.

Versions

This is version 3 of VisitAarhus’ Data Protection Notice of 4th July 2024.

VisitAarhus 

Share your moments with us: