Data Protection Statement
- Objective and Responsibility
This Data Privacy Statement is to inform you about the nature, scope and purpose of GEBR. HEINEMANN RETAIL ApS’ ("Heinemann”, “we”, “us”) processing of personal data.
The data controller for the processing is GEBR. Heinemann RETAIL ApS (Vestvej 1, 2770 Kastrup, Denmark).
- Processing of your personal data through our online services
- Purchases in the webshop
When you use our web shop on www.taxfree-heinemann.dk, Heinemann processes your personal data. We may process, collect and store your first and last name, salutation, title, email address, payment information and information about your order/purchase history. We also process information concerning which airport or parcel shop you have chosen to pick up your order in (if you have chosen Click & Collect) or the delivery and invoice address (if you have chosen home delivery).
Your personal data will be processed for the purpose of completing your orders in Heinemann’s webshop and for carrying out statistics and analysis to improve our webshop and products.
If you register for a Heinemann X ME membership during checkout, we also collect and process your date of birth. Please refer to section 2.2 below for further information about our processing of your personal data in relation to Heinemann X ME memberships.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interest: We process your personal data based on our legitimate interest in being able to conduct statistics and analysis with the purpose of developing and improving our services in accordance with Article 6(1)(f) of the GDPR.
Contractual obligations: We process your personal data to fulfil the contract of purchase with you, including to be able to deliver the ordered goods, handle complaints, returns, etc. in accordance with Article 6(1)(b) of the GDPR.
Retention period
As a general rule, we will store your personal data for 2 years after your last purchase. If you have purchased products covered by a warranty, we will delete your personal data at the end of the warranty period.
Information relating to accounting material is kept for 5 years from the end of the financial year to which the data relate.
However, we can process your personal data for a longer period in anonymised form.
Disclosure of your personal data
During the order process in our online store, you have the option to select a payment method. Payments are processed via the payment service provider Adyen N.V. When you select a payment method your personal data will be transmitted to one of our payment service providers, including Adyen N.V., Klarna Bank AB, PayPal (Europe) depending on which method you chose.
You must be in possession of a valid flight ticket in order to purchase from us. During the purchase process, we will check your flight number and flight date in our online service to verify your eligibility to purchase. We use the services of FlightStats Inc.
If you choose home delivery, we will share your name and address with the freight carrier you choose. The legal basis of the transmissions is Article 6(1)(b) of the General Data Protection Regulation ("GDPR”).
- Registration for Heinemann X ME
When you register as a member of our customer loyalty program, Heinemann X ME, we process your personal data. Heinemann may collect, process and store your name, email address, country and title (if you provide this information), your birthday, gifts you have received as a benefit, competitions you participate in, loyalty points and whether you have subscribed to our newsletters, when you log in to your account and what purchases you have made with your account. The purpose of the processing is to manage your Heinemann X ME account and be able to provide you with the benefits of being a member as well as to optimize the offers provided to you. Further, such personal data will be used for the purpose of personalizing mail advertising for products, promotions and offers, as well as digital advertising.
As a member of our customer loyalty programme, the General Conditions of Participation for the Heinemann X ME programme apply in addition to this data protection declaration.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: We process your information based on our legitimate interest in managing your Heinemann X ME account, providing you with the promised benefits, managing competitions as well as our legitimate interest in conducting statistics and analyses to improve the user experience (cf. Article 6(1)(f) of the GDPR).
Consent: When we process your personal for the purpose of providing our email marketing to you and personalizing our email marketing, we do so on the basis of your consent (cf. Article 6 (1) (a)). You may withdraw your consent at any time by contacting us as stated above.
Retention period
Your personal data will be stored for as long as your account is active. When you delete your account, we will delete your personal data. However, the data can be stored for a longer period in anonymized form.
- Collection of personal data when you visit our website
We use cookies on www.taxfree-heinemann.dk and do in this connection processes your personal data. We may collect and process your IP-address, browsing history and information about your use of our website, including click-behaviour. We use cookies to collect the personal data. You can read more about the use of cookies in our cookie policy.
We process your personal data for the purpose of making our website available, to promote our brand and products and to improve our website.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: We base the processing of your personal data on our legitimate interests in making our website available to you, as well as improving our website (Article 6(1)(f) of the GDPR).
Consent: We base the processing of your personal data for marketing purposes on your consent (Article 6 (1) (a) of the GDPR).
When you visit our website, we ask for your informed consent to place cookies that are not necessary cookies according to the cookie rules. You have the right to withdraw your consent at any time. You can read more about how you change your cookie settings in our cookie policy
Retention period
The cookies are deleted in accordance with our cookie policy. However, the information may be stored for a longer period in anonymised form.
Disclosure
In some cases we will disclose your personal data to our cookie providers. The identity of all of our cookie providers is available in our cookie banner.
- Contact Form and Contacting us via E-Mail
When you contact us (via online form or e-mail), personal data such as, your name, e-mail, what your inquiry is about, date of your inquiry and other information you provide in connection with your inquiry will be processed for the purpose of processing the inquiry and its handling.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: We may process your personal data on the basis of our legitimate interests in handling your inquiry, communicating with you, and developing our products and services (Article 6(1)(f) of the GDPR).
Retention period
Your personal data will be stored for 2 years. However, the data can be stored for a longer period in anonymised form.
- If you sign up for our newsletter
When you sign up for our newsletter, we may collect, process, and store your personal data, including name and e-mails address, your consent, your interests, your click-behaviour in relation to published material, for the purpose of promoting our brand, products and services and for the purpose of improving our newsletters, marketing materials and marketing strategy.
Legal basis
The legal basis for our processing of your personal data is:
Consent: We will only use your personal data for direct marketing, including for sending out newsletters, if you have given your prior and explicit consent to this (Article 6(1)(a) of the GDPR).
Legitimate interests: The processing of your personal data will, in connection with analysis and statistics, be based on our legitimate interests in being able to improve and develop our service (Article 6(1)(f) of the General Data Protection Regulation)
Retention period
Your personal data will be stored as long as your consent to receive newsletters is active.
You can always withdraw your consent by clicking on the unsubscribe link at the bottom of each e-mail or by contacting us as described below. However, withdrawing your consent does not affect the legality of the processing that preceded the withdrawal.
Documentation of your marketing consent is kept for 2 years from the time you have withdrawn your consent to receive direct marketing material. The retention period is determined based on our legitimate interest in being able to document that direct marketing has been carried out in accordance with the applicable legislation (Article 6(1)(f) of the GDPR).
In addition, the information can be stored for a longer period in anonymised form.
- Purchases in the webshop
- Processing activities in our stationary shops
This section contains the policy for Heinemann’s processing of personal data of customers and other visitors to our stores.
When you visit or purchase something in one of our stores, we may collect, process, and store your personal data, including your purchases, payment information, boarding pass for the purpose of completing your purchases. Personal data collected through the scanning of the boarding pass is removed. Further, we process photo and video material related to the monitoring of our stores for the purpose of establishing, defend or invoke legal claims.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: In most cases, we base the processing of your personal data on our legitimate interests in being able to establish, defend or assert legal claims (Article 6(1)(f) of the GDPR). For example, this applies for the processing in relation to complaints. Information about offences collected through video surveillance is also processed in the light of our legitimate interest in solving criminal offences (Section 8(3) of the Danish Data Protection Act).
Contract: We process your payment and purchase information in order to conclude the contract we enter into with you when you purchase an item in our shop (Article 6 (1) (f) of the GDPR).
Legal obligation: The processing of information about your payment information and purchases is necessary for compliance with applicable accounting legislation, bookkeeping legislation, and VAT legislation (Article 6(1)(c) of the GDPR).
Retention period
Information relating to accounting material is kept for 5 years from the end of the financial year to which the data relate. However, we may process your personal data for a longer period in anonymised form.
Video surveillance material will be deleted after 30 days. Such material will only be stored for a longer period if this is necessary in the specific individual case for the enforcement of legal claims or for the prosecution of criminal offences.
Disclosure
Disclosure of video surveillance material to third parties (e.g. the police) will only take place if this is necessary for the investigation of criminal offences.
- Compliance with customs and tax regulations in the sales process
The sale of goods to travelers is exempt from excise duties and sales tax under certain conditions. The tax exemption allows goods to be offered to travelers at low prices.
In order to obtain tax exemption, appropriate evidence must be provided to the tax and customs office and necessary measures must be taken to prevent tax evasion, avoidance or abuse. The transaction data of the underlying sale (name and number of the airport store, date of the transaction, quantity and price of the goods sold, number of the cash register and the cash register receipt) must therefore be supplemented by boarding pass information as this serves as our documentation for rightful tax refunds.
Legal basis
The processing of your personal data is based on the following legal basis:
Legal obligation: We process your personal data on the basis of our legal obligations related to our tax exemption in our tax free shops (Article 6 (1) (c) of the GDPR).
Retention period
Information relating to accounting material is kept for 5 years from the end of the financial year to which the data relate. However, we may process your personal data for a longer period in anonymised form.
- Data Subject Rights
You have the following rights with regards to the processing of your personal data:
- Right of access to your personal data
- Right to rectification of your personal data
- Right to erasure (‘right to be forgotten’)
- Right to restriction of processing of your personal data
- Right to data portability
- Right to object to our processing of your personal data, including our processing for the purpose of sending you tailored marketing material.
- Right to not be subject to an automated decision, including profiling
- The right to lodge a complaint with €the Danish Data Protection Agency:
The Danish Data Protection Agency
Carl Jacobsens Vej 35
2500 Valby
Phone number: 33 19 32 00
E-mail: dt@datatilsynet.dk
- Sharing personal data with third parties
Besides what is described above, disclosure of personal data to third parties only occurs within the framework of legal requirements. We only disclose personal data of users to third parties, if this is required e.g. for billing purposes or other purposes, if the disclosure is necessary to ensure the fulfilment of contractual obligations towards the users (in accordance with Article 6 (1) (b) of the GDPR). We may also disclose personal data to accountants, lawyers and other external advisors based on our legitimate interests (in accordance with Article 6 (1) (f) of the GDPR).
In the context of Heinemann’s development, the corporate structure may change, e.g., by the total or partial sale of the company. In the case of a partial transfer of assets containing personal data, the processing basis for the related transfer of personal data is, as a rule, Article 6 (1) (f) of the GDPR, as we have an interest in transferring parts of our assets and making commercial/structural changes.
If we engage subcontractors for our online service, we have made appropriate contractual arrangements as well as adequate technical and organizational measures with these companies.
If we transfer your personal data to recipients whose registered offices are located in a third country, such transfer is based on the Data Privacy Framework or the EU Commission’s standard contractual clauses, which you may obtain a copy of by contacting us as stated above.
Status: January 2024