Data Protection Statement
Status: July 2026
-
Objective and Responsibility
This Data Privacy Statement is to inform you about the nature, scope and purpose of GEBR. HEINEMANN RETAIL ApS’ ("Heinemann", “we”, “us”) processing of personal data.
The data controller for the processing is GEBR. Heinemann RETAIL ApS (Vestvej 1, 2770 Kastrup, Denmark).
-
Processing of your personal data through our online services
-
Purchases in the webshop
When you use our web shop on www.taxfree-heinemann.dk, Heinemann processes your personal data. We may process, collect and store your first and last name, salutation, title, email address, payment information and information about your order/purchase history. We also process information concerning which airport or parcel shop you have chosen to pick up your order in (if you have chosen Click & Collect) or the delivery and invoice address (if you have chosen home delivery).
Your personal data will be processed for the purpose of completing your orders in Heinemann’s webshop and for carrying out statistics and analysis to improve our webshop and products.
If you register for a Heinemann X ME membership during checkout, we also collect and process your date of birth. Please refer to section 2.2 below for further information about our processing of your personal data in relation to Heinemann X ME memberships.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interest: We process your personal data based on our legitimate interest in being able to conduct statistics and analysis with the purpose of developing and improving our services in accordance with Article 6(1)(f) of the GDPR.
Contractual obligations: We process your personal data to fulfil the contract of purchase with you, including to be able to deliver the ordered goods, handle complaints, returns, etc. in accordance with Article 6(1)(b) of the GDPR.
Retention period
As a general rule, we will store your personal data for 2 years after your last purchase. If you have purchased products covered by a warranty, we will delete your personal data at the end of the warranty period.
Information relating to accounting material is kept for 5 years from the end of the financial year to which the data relate.
However, we can process your personal data for a longer period in anonymised form.
Disclosure of your personal data
During the order process in our online store, you have the option to select a payment method. Payments are processed via the payment service provider Adyen N.V. When you select a payment method, your personal data will be transmitted to one of our payment service providers, including Adyen N.V., Klarna Bank AB and PayPal (Europe), depending on which method you chose.
You must be in possession of a valid flight ticket in order to purchase from us. During the purchase process, we will check your flight number and flight date in our online service to verify your eligibility to purchase. We use the services of FlightStats Inc.
If you choose home delivery, we will share your name and address with the freight carrier you choose. The legal basis of the transmissions is Article 6(1)(b) of the General Data Protection Regulation ("GDPR").
-
Registration for Heinemann X ME
When you register as a member of our customer loyalty program, Heinemann X ME, we process your personal data. Heinemann may collect, process and store your name, email address, country and title (if you provide this information), your birthday, gifts you have received as a benefit, competitions you participate in, loyalty points and whether you have subscribed to our newsletters, when you log in to your account and what purchases you have made with your account.
The purpose of the processing is to manage your Heinemann X ME account and be able to provide you with the benefits of being a member as well as to optimize the offers provided to you. Further, such personal data will be used for the purpose of personalizing mail advertising for products, promotions and offers, as well as digital advertising.
As a member of our customer loyalty programme, the General Conditions of Participation for the Heinemann X ME programme apply in addition to this data protection declaration.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: We process your information based on our legitimate interest in managing your Heinemann X ME account, providing you with the promised benefits, managing competitions as well as our legitimate interest in conducting statistics and analyses to improve the user experience (cf. Article 6(1)(f) of the GDPR).
Consent: When we process your personal data for the purpose of providing our email marketing to you and personalizing our email marketing, we do so on the basis of your consent (cf. Article 6(1)(a) of the GDPR). You may withdraw your consent at any time by contacting us as stated above.
Retention period
Your personal data will be stored for as long as your account is active. When you delete your account, we will delete your personal data. However, the data can be stored for a longer period in anonymized form.
-
Collection of personal data when you visit our website
We use cookies on www.taxfree-heinemann.dk and in this connection process your personal data. We may collect and process your IP address, browsing history and information about your use of our website, including click behaviour. We use cookies to collect the personal data. You can read more about the use of cookies in our cookie policy.
We process your personal data for the purpose of making our website available, to promote our brand and products and to improve our website.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: We base the processing of your personal data on our legitimate interests in making our website available to you, as well as improving our website (Article 6(1)(f) of the GDPR).
Consent: We base the processing of your personal data for marketing purposes on your consent (Article 6(1)(a) of the GDPR).
When you visit our website, we ask for your informed consent to place cookies that are not necessary cookies according to the cookie rules. You have the right to withdraw your consent at any time. You can read more about how you change your cookie settings in our cookie policy.
Retention period
The cookies are deleted in accordance with our cookie policy. However, the information may be stored for a longer period in anonymised form.
Disclosure
In some cases we will disclose your personal data to our cookie providers. The identity of all of our cookie providers is available in our cookie banner.
-
Contact Form and Contacting us via Email
When you contact us via online form or email, personal data such as your name, email address, what your inquiry is about, date of your inquiry and other information you provide in connection with your inquiry will be processed for the purpose of processing the inquiry and its handling.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: We may process your personal data on the basis of our legitimate interests in handling your inquiry, communicating with you and developing our products and services (Article 6(1)(f) of the GDPR).
Retention period
Your personal data will be stored for 2 years. However, the data can be stored for a longer period in anonymised form.
-
If you sign up for our newsletter
When you sign up for our newsletter, we may collect, process and store your personal data, including name and email address, your consent, your interests and your click behaviour in relation to published material, for the purpose of promoting our brand, products and services and for the purpose of improving our newsletters, marketing materials and marketing strategy.
Legal basis
The legal basis for our processing of your personal data is:
Consent: We will only use your personal data for direct marketing, including for sending out newsletters, if you have given your prior and explicit consent to this (Article 6(1)(a) of the GDPR).
Legitimate interests: The processing of your personal data will, in connection with analysis and statistics, be based on our legitimate interests in being able to improve and develop our service (Article 6(1)(f) of the General Data Protection Regulation).
Retention period
Your personal data will be stored as long as your consent to receive newsletters is active.
You can always withdraw your consent by clicking on the unsubscribe link at the bottom of each email or by contacting us as described below. However, withdrawing your consent does not affect the legality of the processing that preceded the withdrawal.
Documentation of your marketing consent is kept for 2 years from the time you have withdrawn your consent to receive direct marketing material. The retention period is determined based on our legitimate interest in being able to document that direct marketing has been carried out in accordance with the applicable legislation (Article 6(1)(f) of the GDPR).
In addition, the information can be stored for a longer period in anonymised form.
-
Purchases in the webshop
-
Processing activities in our stationary shops
This section contains the policy for Heinemann’s processing of personal data of customers and other visitors to our stores.
When you visit or purchase something in one of our stores, we may collect, process and store your personal data, including your purchases, payment information and boarding pass for the purpose of completing your purchases. Personal data collected through the scanning of the boarding pass is removed. Further, we process photo and video material related to the monitoring of our stores for the purpose of establishing, defending or invoking legal claims.
Legal basis
The legal basis for our processing of your personal data is:
Legitimate interests: In most cases, we base the processing of your personal data on our legitimate interests in being able to establish, defend or assert legal claims (Article 6(1)(f) of the GDPR). For example, this applies to the processing in relation to complaints. Information about offences collected through video surveillance is also processed in the light of our legitimate interest in solving criminal offences (Section 8(3) of the Danish Data Protection Act).
Contract: We process your payment and purchase information in order to conclude the contract we enter into with you when you purchase an item in our shop (Article 6(1)(f) of the GDPR).
Legal obligation: The processing of information about your payment information and purchases is necessary for compliance with applicable accounting legislation, bookkeeping legislation and VAT legislation (Article 6(1)(c) of the GDPR).
Retention period
Information relating to accounting material is kept for 5 years from the end of the financial year to which the data relate. However, we may process your personal data for a longer period in anonymised form.
Video surveillance material will be deleted after 30 days. Such material will only be stored for a longer period if this is necessary in the specific individual case for the enforcement of legal claims or for the prosecution of criminal offences.
Disclosure
Disclosure of video surveillance material to third parties, for example the police, will only take place if this is necessary for the investigation of criminal offences.
-
Processing of boarding pass data for TAX FREE sales
When you purchase goods as a departing passenger in our TAX FREE stores at Copenhagen Airport, your boarding pass is scanned at the point of sale. Scanning of the boarding pass is mandatory for all departing passengers. Arriving passengers are not required to have their boarding pass scanned.
The boarding pass is scanned to verify and document the tax status of your purchase based on the flight number and the travel route (origin and destination) as proof of export. This documentation is required so that Heinemann can determine and apply the correct taxes payable on each sale, in accordance with the applicable licence issued by the Danish tax authorities and the relevant tax legislation.
The destination indicated on your boarding pass is used solely as a fast and reliable reference point to determine the tax rules applicable to the sale, in particular whether the destination lies within or outside the EU tax territory. Due to numerous territorial exceptions, the EU tax territory does not always coincide with the EU territory.
When your boarding pass is scanned, the globally standardized IATA BCBP (Bar-Coded Boarding Pass) data string encoded in the Aztec code on your boarding pass is read in its entirety. This is necessary because it is technically not possible to read only specific elements of the data string.
The data string contains personal data, including your first and last name and seat number. Therefore, the personal data that is not required for proof of export, in particular your first and last name and your seat number, is automatically and immediately anonymized within seconds after scanning and before any transfer to log files or databases. Once anonymized, the data cannot be restored and Heinemann can no longer identify you on the basis of the remaining data.
Legal basis
The legal basis for our processing of your personal data is:
Legal obligation (Article 6(1)(c) GDPR): Heinemann is under a statutory obligation to document that goods sold in its TAX FREE stores are exported to a destination outside the relevant tax territory. To fulfil this obligation, we process your flight number and from/to destination as proof of export, as required under the Danish Customs Act (Toldloven), the Danish Customs Processing Order (Toldbehandlingsbekendtgørelsen), and the applicable licence issued by the Danish tax authorities for our TAX FREE shops. Compliance with this legal obligation is a prerequisite for Heinemann’s entitlement to operate a TAX FREE shop.
Legitimate interest (Article 6(1)(f) GDPR): To ensure efficient processing of passengers in a busy airport environment, including minimizing waiting times, and to ensure correct and reliable documentation towards the tax authorities, Heinemann uses the IATA BCBP code and data elements technically embedded in the data string to automatically create proof of export. As mentioned above, this entails processing of personal data, including your first and last name and seat number, which are immediately anonymized within seconds after collection.
Heinemann has carried out a balancing test and concluded that its legitimate interests override your interests and fundamental rights, taking into account that the processing concerns ordinary personal data of limited scope, that the additional data is automatically and irreversibly anonymized immediately after collection, thereby significantly reducing any potential risks, and that customers purchasing goods in TAX FREE stores can reasonably expect boarding pass scanning as part of the statutory documentation process, because it is a well-established feature of TAX FREE sales at airports.There is no equally suitable, less intrusive alternative available that would ensure a comparably reliable and auditable basis for the correct tax classification of the sale.
Disclosure
Upon request and for tax compliance and reporting purposes, proof of export data, specifically your flight number and from/to destination, will be disclosed to the competent customs and tax authorities for verification purposes.
By the time of any such disclosure, all personal data collected from your boarding pass, including your name and seat number, will already have been irreversibly anonymized.
Disclosure is made on the basis of a legal obligation in accordance with Article 6(1)(c) GDPR, the Danish Customs Act (in Danish: Toldloven), the Danish Customs Processing Order (in Danish: Toldbehandlingsbekendtgørelsen) and the applicable licence for our TAX FREE shops.
For further information on the disclosure of personal data to independent data controllers and on transfers to third countries, please refer to Section 6 of this privacy notice.
Retention period
The following retention periods apply to the processing of boarding pass data:
The full IATA BCBP data string, including your first and last name and seat number, is held only in the temporary working memory (RAM) of the POS system and is immediately anonymized within seconds. It is not transferred to any log file or database in identifiable form.
The remaining anonymized boarding pass data collected for proof of export, which no longer constitutes personal data, are retained in accordance with the retention requirements of the Danish Bookkeeping Act (Danish: Bogføringsloven) for up to five years following the end of the financial year in which the transaction took place and are thereafter irretrievably deleted.
-
Data Subject Rights
You have the following rights with regards to the processing of your personal data:
- Right of access to your personal data
- Right to rectification of your personal data
- Right to erasure (‘right to be forgotten’)
- Right to restriction of processing of your personal data
- Right to data portability
- Right to object to our processing of your personal data, including our processing for the purpose of sending you tailored marketing material.
- Right not to be subject to an automated decision, including profiling.
-
The right to lodge a complaint with the Danish Data Protection Agency:
The Danish Data Protection Agency
Carl Jacobsens Vej 35
2500 Valby
Phone number: 33 19 32 00
Email: dt@datatilsynet.dk
-
Sharing personal data with third parties
Besides what is described above, disclosure of personal data to third parties only occurs within the framework of legal requirements. We only disclose personal data of users to third parties if this is required, for example for billing purposes or other purposes, or if the disclosure is necessary to ensure the fulfilment of contractual obligations towards the users (in accordance with Article 6(1)(b) of the GDPR).
We may also disclose personal data to accountants, lawyers and other external advisors based on our legitimate interests (in accordance with Article 6(1)(f) of the GDPR).
In the context of Heinemann’s development, the corporate structure may change, for example by the total or partial sale of the company. In the case of a partial transfer of assets containing personal data, the processing basis for the related transfer of personal data is, as a rule, Article 6(1)(f) of the GDPR, as we have an interest in transferring parts of our assets and making commercial or structural changes.
If we engage subcontractors for our online service, we have made appropriate contractual arrangements as well as adequate technical and organizational measures with these companies.
If we transfer your personal data to recipients whose registered offices are located in a third country, such transfer is based on the Data Privacy Framework or the EU Commission’s standard contractual clauses, which you may obtain a copy of by contacting us as stated above.
Status: July 2026