LEGO® House Privacy Policy 

Last amended: 1 February 2017

LEGO House A/S ("LEGO® House", "we", "us", "our") take our responsibility seriously and always have high ambitions. This Privacy Policy concerns collection, use and disclosure of information with LEGO House A/S as the data controller.

The purpose of our Privacy Policy is to give you knowledge of how we process information about you. We are highly focussed on processing any personal data with care, trust and respect.

If you have any questions or concerns regarding our Privacy Policy, please do not hesitate to contact us at LEGO House via emailing info@LEGOHouse.com

1. Our general principles of collecting, using and processing of data
2. The type of information we collect, use and process
3. Why and how we collect, use and process your information
4. How we use your information within the LEGO Group companies
5. Sharing your information with third parties
6. Your control and options
7. Cookie Policy
8. Children's privacy
9. Data security and integrity
10. Storage
11. Data transfer, storage and processing globally
12. Changes to this Privacy Policy
13. Contact details

1. Our general principles of data processing
In order to ensure that your data is processed correctly, we have adopted the following principles:
We only collect and process your personal data if we have a legal basis for the processing pursuant to existing legislation, e.g.:

• We have your permission (your consent)
• It is necessary to observe an agreement with you
• We are under legal obligation to do so

We will always inform you of the processing and its purpose, unless (and only in specific circumstances) we have a legitimate basis for not doing it.

By "processing", we mean our collection, use, disclosure, storage and eventually deletion of your data.
We only process your personal data for the original purpose or for other purposes that are not inconsistent with the original purpose.

We do not disclose your personal information to other people or companies outside the LEGO® Group, unless you have given us your consent, or unless we are under legal obligation to do so. For more details, see section 5.

As we are obligated to update our personal data, we will continuously ensure that your data processed by us is correct and updated.

We might choose to add information from other databases to your personal data to ensure that your information is correct and updated.

We do not store your personal data longer than necessary to serve the purpose for which they are processed.

2. The type of information we process
We process two basic types of information - personal information and anonymous information.

We collect your personal data when you visit LEGO® House in Billund, Denmark and when you interact with us on our different channels. Here we will present you with specific terms telling you which specific information that might be collected and for which purpose. We recommend that you read these specific terms on our channels carefully before you accept the terms. At present, our different channels are:

LEGO® House website with social media (Facebook, Instagram, YouTube.)

However, in general we typically process the following types of personal information:

• Information that you provide when you visit and use the facilities in LEGO® House:
  • Visit date, names of people included in your booking, the duration of your visit, and the results from challenges and experiences.
  • Application code, "My Brick" combination number and other information regarding your access to the LEGO® House app, etc.
• Registration information you provide when you register for our email marketing, including our newsletter or create an account on one of our channels, first name and surname, country of residence, gender, birth date, email address, user name and password.
• Transaction information you provide when you request information or purchase a product or a service from us (irrespective of whether it is through our websites or through our programmes), postal address, telephone number and payment details.
• Information you provide in public fora on our websites, channels and programmes.
• Information you provide when you use our websites, channels and programmes, our programmes on third party websites or platforms such as social networking sites, or when you link your profile with your registration account on third party websites or platforms.

Namely, location information that is delivered by either a mobile device which interacts with one of our websites or which is attached to your IP address and information of use and display and technical data, including your unit's id or IP address.

3. Why and how we process your personal data

• We process your personal information and anonymous information in order to run our daily business, and in connection with your physical stay at LEGO® House in Billund, Denmark and, subsequently, in the LEGO House application.
• We process the personal data you provide when you request products, services or information from us, register with us, join public fora or other activities on our website and programmes, respond to surveys or otherwise interact with us. Remember that when you provide us with personal data on a third party website or platform (e.g. via programmes or channels with social media), the personal data you provide will be processed individually by third party websites or the owner of the platform. The information we process is comprised by this Privacy Policy, whereas the personal information that the third party website or platform process is subject to personal data principles of said third party website or platform. The choice you have made in relation to confidentiality on the third party website or platform does not apply to our use of personal data that we have processed directly via our websites, channels or programmes.
• We process your personal data via special technology, e.g. cookies when you visit our websites, channels or programmes via third party websites or platforms. You may view our Cookie Policy for further information, including how you deactivate tracking and cookies www.legohouse.com/cookie-policy
• We collect information from other reliable sources in order to update or supplement the personal information you have provided or which we have processed automatically.
• Marketing via email or SMS: It is possible for you to subscribe to news from LEGO House. This news gives you information about the newest attractions, campaigns and offers on a regular basis. You need a valid email address or a valid telephone number in order to receive the newsletter, and you will be registered as a subscriber to our newsletter after you have confirmed the subscription in the first email we have sent you (double opt-in).
• The information that we collect in order for you to receive the newsletter is compared to the information we otherwise have collected (e.g. when you have purchased tickets or ordered other services). You may opt out of receiving the newsletter at any time via the opt out link at the bottom of all newsletters you receive.

4. How we use your information within the LEGO Group companies

LEGO House A/S is located in Billund and is the data controller. For more details about the LEGO Group and its subsidiaries, please visit http://www.lego.com/aboutus/lego-group/locations. Other companies within the LEGO Group may have access to your information if they carry out services on behalf of LEGO House (as data processing entity) and, unless this is illegal according to existing legislation, for their own use (as data controlling entity) for the following purposes:

• To provide products and services you request,
• To communicate with you about your account or transactions with us and to forward information of features on our websites and programmes or changes to our policies.
• To forward news if you have registered for this. You may unsubscribe at any time by following the steps for opting out of the subscription which can be found at the bottom in every communication.
• To register, examine and prevent activities that might violate our policies or be illegal.

Social Media (functions) and widgets
Our website contains social media functions, e.g. Facebook's "like" button and widgets, e.g. the "share" button or interactive Mini Programmes. These functions may collect your IP address if you actively click on the link while visiting our website and may use a cookie for making the function work properly. Social media functions and widgets are either hosted by a third party or hosted directly at our website. Your interactions with these functions are subject to the Privacy Policy for the company offering them.

5. Sharing your personal information with other companies

We do not share your personal information outside the LEGO® Group except in limited cases, e.g.:

• To enforce our Terms and Conditions for usage and other relevant rules which you have accepted;
• To ensure our customer's and third parties' rights and property;
•  To observe statutory rules or otherwise if we believe that forwarding is required by law, e.g. to observe a writ of summons or a similar legal process;
• To observe an agreement with you;
• When we share personal data with third parties in connection with a merger, acquisition or sale of all or parts of our assets. You will be notified via email and/or an explicit notification on our website about any changes to the ownership or use of your personal information and the choices you have in connection with your personal data;
• If you give your consent to share your personal data with another company for marketing purposes for them to send you offers and campaigns about their products and services. If you no longer wish for us to have that opportunity to share such information with third parties, please contact us at info@LEGOHouse.com in order to opt out of this. In some cases, it might be necessary to contact the third party directly;
• When you ask us to share your personal information with third party websites or platforms, e.g. social networking sites. Please note that if we share your personal data with another company for marketing purposes, the information that the other company receives will be subject to said company's Privacy Policy.
  
  

6. Your control and options

We give you the opportunity to exercise a certain control and make certain choices regarding our processing of your personal data, including:

• You may rectify, update and delete you registration account.
• You may change your options regarding subscriptions, newsletters and notifications.
• You may change whether you would like to receive offers and campaigns from us for our own products and services or for products and services which we believe will be of interest to you.
• You may choose whether we will be allowed to share your personal data with other companies for them to send you offers and campaigns about their products and services.
• You may request access to our storage of your personal information and you may ask us to change or delete the information and ask us to request third parties with whom we have shared the information to do the same.

You may exercise your control and options or request access to or deletion of inaccuracies in your personal data by visiting your account(s) or by contacting LEGO® House Customer Service at info@LEGOHouse.com. If you contact us through LEGO® House Customer Service, we will have to check your identity for security reasons. It may take up to 10 days before the changes become effective. Please note that if you do not enable us to process your personal information, we might not be able to deliver certain products or services, and some of our services might not take your interests and preferences into account. If you have any questions regarding our processing and storage of your personal data, you may contact LEGO® House Customer Service.

7. Cookie Policy

LEGO® House and our third party tracking partners and service providers use technologies such as cookies.

You may find more information on cookies in our Cookie Policy.

8. Children's privacy

Please note that the website, as a starting point, only is directed at persons of 18 years or older.

To the extent that we through other channels collect and process personal information of children, we acknowledge the need for processing the information with extra confidentiality and protection. When we process information from children, we take additional steps to protect their privacy, including:

• Notifying the parents of our procedures in relation to their children's personal information, including explaining the types of personal information we might collect, use and process from children, for which purpose we use the personal information, and whether we share and with whom we might share this information,
• Obtaining, if required by law, a permission from the parents to collect, use and process personal information from their children or to send information of our products and services directly to the children,
• Limiting our collection, use and processing of personal data from children for what is reasonably necessary in order to participate in an activity,
• Giving the parents access to or the possibility to request access to personal data which we have collected, used or processed about their children and the opportunity to request personal information to be changed or deleted.
   

LEGO® House and subsequent services

We offer our visitors a number of activities in LEGO® House, subsequent services on apps, channels and programmes of what some are primarily directed at families with users of all ages, and others are directed at children. LEGO House and our services, etc. offer a number of activities, including activities that might comprise collection of information from children. We process children's personal data as described above in sections "2. The type of information we process", 3. Why and how we collect, use and process your information, 4. How we use your personal information within the LEGO Group companies, and 5. Sharing your personal information with other companies".

Registration

Children may in certain cases register for our services and programmes, inter alia, in order to be able to view the content, join competitions and test special features. During the registration process, we may ask the child certain information for security reasons and for being able to send notifications, including a parent or guardian's email address, the child's first name and gender, the child's member or account username and the password. We may also request the child's birth date in order to approve their age. We strongly warn children never to use personal information in their usernames.

We do not ask children for more information than what is reasonably necessary in order to participate in an activity.

Collection of the parents' email address: In accordance with COPPA's requirements, we will in all services or programmes directed at children, or where we ask for age and conclude that the user is 12 years or younger, ask for a parent or guardian's email address before we collect any personal information from the child. If you believe that your child participates in an activity that collects personal data or you or another parent/guardian have not received an email with notification of or request for permission, please do not hesitate to contact our Data Privacy Officer at info@legohouse.com. We do not use a parent's email address which we have obtained in connection with the permission for marketing purposes directed at the parent, unless the parent explicitly has accepted to receive marketing material via email or specifically has participated in an activity that allow for such email contact.

Content generated by a child

Certain activities on our services, channels and programmes allow children to generate or manage content and store it with LEGO® House. Some of these activities do not require children to provide any personal information, for which reason you as a parent will not be requested to give permission. If an activity would give the child an opportunity to insert personal information in the content they have generated, we will beforehand review the forwarded material and delete any personal information, or we will request the parents for permission via email to collect this.

Parents' choice and control options

Parents may at any time reject to allow us to use and collect additional personal information from their children in connection with a LEGO® House activity or a specific account, and you may request us to delete any personal data that we have collected in connection with said account. Remember that requesting deletion of a registration may lead to a termination of the account, membership or other services.

Parents may contact the Customer Service to request access, or changes to or deletion of their child's personal information by email info@legohouse.com.

All other inquiries can be directed to LEGO House A/S (see the contact details below).

All inquiries by mail or email must contain the child's username and the parents' email address and telephone number. In order to ensure the childrens' privacy and security, we will take reasonable precautionary measures to verify a parent's identity before we provide access to any personal information.

9. Storage

We store your information as long as your account is active or as long as it is necessary in order to provide the services. If you delete your account or ask us to no longer use your information to provide the services, please contact us at info@legohouse.com. We store and use your data to the extent necessary in order to observe our legal obligations, determine disputes and execute our agreements.

We store your child's information as long as the account is active or as long as it is necessary in order to provide the child with services. If you wish to delete your child's account or ask us to no longer use this information to provide services to the child, please contact us at info@legohouse.com. We store and use the child's information to the extent necessary in order to observe our legal obligations, determine disputes and execute our agreements.

10. Data security and integrity

The security, integrity and confidentiality of your information are very important to us. We have established technical, administrative and physical precautionary measures that are intended for protecting personal information from unauthorised access, transfer, use and change.

Information regarding credit cart details is handled by approved service providers which observe the payment card industry's (PCI) standards and have established appropriate precautionary measures.

If you find an error or problems in our security, please contact us immediately at info@legohouse.com

If LEGO® House discovers a breach of the data security and your information is affected, we will contact you if there is a risk of misuse of your information and if we are legally obligated to do so. In some cases, LEGO® House can be legally obligated to contact (data protection) authorities in case of violation of the rules for processing personal data.

11. Data transfer, storage and processing globally

LEGO® House operates in Denmark whereas other companies within the LEGO Group operate globally. LEGO House may transfer or leave your personal information to individual companies within the LEGO Group or to third parties all over the world for the purposes stated in this Privacy Policy. If your personal information is transferred, stored or processed by us or other companies conducting such services on our behalf, we will take reasonable precautionary measures to ensure the confidentiality of your personal information.

12. Changes to this Privacy Policy

We may change this Privacy Policy occasionally so that it meets new technologies, industry practice, statutory requirements or for other reasons. We will inform you in advance by email or by notification on our website if these changes are significant and if required by law, we will obtain your consent.

13. Contact details
If you have any inquiries, comments or questions relating to this Privacy Policy, you may contact our Data Privacy Officer:

LEGO® House A/S
Butikstorvet 6, 7190 Billund, Denmark

(LEGO House A/S (P-number 1021673710) is a secondary name of selskabet KOLDINGVEJ 2, BILLUND A/S, Business Registration no. 16632635, Koldingvej 2, 7190 Billund).

- or contact our Customer Service directly by email info@legohouse.com

Our websites and programmes may contain links to other websites which are neither owned nor controlled by us, and we cannot be held responsible for the principles of personal data for these websites. We urge you to pay attention when leaving our websites or programmes and to read the privacy policy for other websites that might process your personal information.