Privacy Policy
Data protection and confidentiality are important to LEGO Fonden (“LEGO Foundation”, “we”, “us”, or “our”). This Privacy Policy sets out clear guidelines on the LEGO Foundation’s processing of your personal data when you visit our website, www.LEGOfoundation.com, or in other ways interact with the LEGO Foundation. 1) Data controller and contact information
The LEGO Foundation is data controller for the processing of your personal data:
LEGO FondenKoldingvej 2DK-7190 BillundBusiness reg. (CVR) no.: 12458339
Contact information
If you have any questions about our processing of your information, you are always welcome to contact the LEGO Foundation at e-mail: info@LEGOfoundation.com Att.: Head of Legal & Compliance
2) Purpose, legal basis, and types of personal data
Below we have listed for which purposes we may process your personal data when you interact with LEGO Foundation.
a. To reply to your inquiriesIf you contact us via our website, email or in other way, we will use your personal data to be able to act on your inquiries etc. We typically process the following personal data about you, including contact details such as name, email, phone number, address, company, position, and the nature/purpose of your inquiry as well as the material you have sent.
We use art. 6(1)(f) in the GDPR (the rule on balancing of legitimate interests) as our legal basis. Our legitimate interest is to be able to respond to your inquiries, communicate with you etc.
We collect the personal data directly from you and will only keep it for as long as necessary to be able to answer your inquiry and for e.g. documentation, which depends on the specific request.b. Use of our website
When you use our website, cookies are used to collect personal data about your behaviour. You may read more about this and locate a link to the privacy policies of such third-party providers in the cookie overview, which may be accessed through our cookie policy.
We process your personal data in connection with your use of our website as described above and as further described in our cookie overview, which may be access through our cookie policy, based on art. 6(1)(a) in the GDPR (consent). However, we may also use art. 6(1)(f) in the GDPR (the rule on balancing of legitimate interests) in respect of cookies necessary for the website’s functionalities. Our legitimate interest is to provide you the best possible experience on the Website.
You may read more about the use of cookies in our cookie policy.You may withdraw or change your consent by rejecting cookies in the cookie overview (bottom section of the policy) or by blocking and deleting cookies in your web browser. c. CCTV surveillance
CCTV surveillance is used to control access to the locations, for crime prevention as well as secure the safety of our employees and guests. The recordings may also be used to clarify and document a course of events.
The recordings will only be reviewed in case of suspicion of criminal acts or in case of internal/external audits.
We base the processing of your personal data on the Danish CCTV Act as well as the provision on legitimate interest stipulated in article 6 (1)(f) of the GDPR as it is necessary to register the personal data to ensure a sufficient degree of safety for our employees and guests in relation to unauthorized access, suspicious behaviour, protection of assets and to prevent and pursue crime. We use articles 8(3) of the Danish data protection law as legal basis if the surveillance reveals criminal acts.
We process the following categories of personal data about you:
CCTV recordings of traffic on the LEGO Foundation’s locations
The processed personal data originate from the CCTV recordings at LEGO Foundation’s locations.
We transfer the personal data to suppliers of different services (data processors) who process the personal data on behalf of LEGO Foundation and in accordance with our instructions. We use data processors for the supply of IT systems, software, support, or consultancy services.
Recordings from CCTV surveillance made for the purpose of preventing crime may be disclosed to the police in case of criminal acts, or if the disclosure is required by law. We may, furthermore, disclose the recordings to lawyers and other advisors as well as to public authorities in case it is required by law. If it is necessary to disclose the recordings for other purposes than above-mentioned, we will ask for your consent to such a disclose if you are in the recordings.
The CCTV recordings made for the purpose of preventing crime will be deleted or anonymized no later than 30 days after the recording, unless it is necessary to keep the recordings for the purpose of handling a specific case such as solving a criminal offence. If so, we will keep the recordings as long as it is necessary for the processing of the specific event.
Recordings from CCTV surveillance made for other purposes will be deleted when we no longer have a purpose for keeping the information.d. Meetings and Events
If you attend a meeting or an event in LEGO Foundation, we will use your personal data to be able to act on your registration and communicate with you before, during and after the meeting/event in question. For the purpose we will typically only process the following personal data about you: name, position, email, phone number, company, and the subject of the meeting/event.
We use art. 6(1)(f) in the GDPR as our legal basis (the rule on balancing of legitimate interests), when you register for a meeting or an event. Our legitimate interest is to administer events and meetings etc.
We generally obtain the personal data, that is collected, directly from you, but we can also receive the information from other parties, such as your employer or a third-party vendor, handling the registration on your behalf.
We will keep your personal data for the period necessary to complete the event/meeting in question and for the evaluation of such event/meetings, and possible longer if further processing is necessary e.g., if a partnership or contract is entered into.e. Cookies
We use cookies on our website. You can read more about the use of cookies in our Cookie Policy which you can find here.
f. Vacancies
If you apply for a vacant position and engage with our HR-department you will receive a specific privacy policy covering the interaction via the LEGO Foundations careers page.g. Grants
If you contact LEGO Foundation in relation to grants or funding from LEGO Foundation, we may process personal data about you to assess your request or proposition. We typically process the following personal data about you as part of handling such requests: name, email, phone number and other types of personal data of relevance to the specific proposition or project.
The personal data we process are provided by you, but we may also collect information from public available sources such as the Danish Business Register or similar outside Denmark or we may collect information from publicly accessible sources e.g., a company or project website.
We process your personal data on the basis of art. 6(1)(f) (the rule on balancing of legitimate interests). Our legitimate interest is to be able to assess your idea/proposal and manage the possible award of funding, according to the proposition. If LEGO Foundation invests or enters a partnership with you, we will furthermore process your personal data on the basis of art. 6(1)(c) of the GDPR (legal obligation), such as filing declarations to relevant authorities, comply with bookkeeping and foundation specific obligations as well as on the basis of art. 6(1)(b) of the GDPR (contract).
We will keep your personal data for the period necessary to complete the assessment of your proposition in question and for relevant documentation and monitoring pending on the outcome of the proposition.
If you receive funding, we will retain your personal data for the duration of our collaboration. When the collaboration ends, we will continue to store your data to document the completed project and its impact, and to comply with applicable legal and contractual obligations.h. Communication
As part of our communication activities, LEGO Foundation may process personal data in the form of photos, video and other media, for example from events, projects, campaigns or partnerships we are involved in. We typically process the following personal data in this connection: audio, images and video recordings of individuals, along with names and other contextual information where relevant to the specific communication material.
The personal data we process is generally collected directly by us, for instance at events or during project visits, but may also be provided to us by partners, photographers or other third parties producing the material on our behalf.
We process your personal data on the basis of art. 6(1)(a) of the GDPR (consent), where we rely on your consent to use photos or video in which you appear, and/or art. 6(1)(f) of the GDPR (the rule on balancing of legitimate interests), where our legitimate interest is to communicate about our activities, projects and results to the public and our stakeholders.
We will only process such personal data based on legitimate interest where the content of the material and the intended use is unlikely to have a significant impact on the individuals depicted, for example general depictions of events, activities or premises where individuals are not the main focus. Where individuals are portrayed more prominently, or the material is used in a way that could have a greater impact on them, we will instead rely on consent as the legal basis for processing.
Where processing is based on your consent, you have the right to withdraw it at any time. This does not affect the lawfulness of processing carried out prior to the withdrawal, but we will stop using new material in which you appear going forward and, where feasible, remove or anonymize existing material upon request.
We retain such personal data for as long as it remains relevant for our communication purposes, or until consent is withdrawn, after which the material is deleted or anonymized unless further retention is required for documentation purposes.
i. Facebook and Instagram
This privacy policy applies to LEGO Fonden's (in English: 'the LEGO Foundation', hereinafter 'LEGO Foundation') processing of the personal data you leave and/or submit when you visit the LEGO Foundation's Facebook page ('the Facebook page') and the LEGO Foundation's Instagram page. This privacy policy supplements Meta Platforms Ireland Limited ('Facebook') general privacy policy.
In the following, 'Facebook' and 'the Facebook page' are also used as designations for the Instagram page.
Who is the data controller
The LEGO Foundation and Facebook are joint data controllers of the processing of your personal data.
Facebook's company information is:
Meta Platforms Ireland Limited
ATTN: Privacy Operations
Merrion Road
Dublin 4
D04 X2K5, Irland
Facebook has published an appendix on the joint responsibility for “Facebook Insights”, which you can find here.
What personal data does Facebook collect
Depending on your behaviour on the Facebook page, the LEGO Foundation and Facebook may collect the following personal data about you:
Whether you 'like' or have used other reactions on the Facebook page
Comments you leave on the Facebook page
The fact that you have visited the Facebook page
Your behaviour and interests on the Facebook page
Furthermore, Facebook uses 'Facebook Insight' on the Facebook page to collect statistical information about visitors' behaviour on the page, including age, gender, relationship status, work, lifestyle, interests, information about purchases and geographical data. For this purpose, Facebook has placed cookies on your devices when you visit the Facebook page. Each cookie contains a unique identification code that will remain active for a period, unless it is deleted before the expiration of this period. Facebook receives, stores and processes your personal data through these cookies.
To read more about Facebook's use of cookies on the Facebook page, including deletion, please refer to Facebook's general cookies policy.
Go to Facebook's cookies policy via the following link:
What is the purpose of the processing
The LEGO Foundation also processes your personal data to, improve the Facebook page, compile statistics, develop and protect the LEGO Foundation's services and activities, including based on your feedback. In this connection, the LEGO Foundation uses aggregated data, which is made available by Facebook through cookies by 'Facebook Insight', e.g. information about age, gender, relationship status, work, lifestyle, interests and geographical data.
Facebook processes your personal data to enable Facebook to improve its advertising system and to provide the LEGO Foundation with statistics that Facebook produces based on your visit on the Facebook page, in order to advertise and customise the activities on the page. Through cookies, Facebook and the LEGO Foundation will know if you 'like' the Facebook page and use the page's applications, so that Facebook and the LEGO Foundation are able to customise the content on the Facebook page and develop functions that you might be interested in.
What is the legal basis
The LEGO Foundation processes your personal data based on the LEGO Foundation's legitimate interest in improving the LEGO Foundation's services and activities (Article 6(1)(f) of the GDPR).
Facebook processes your personal data based on Facebook's legitimate interests, including Facebook's interest in providing an innovative, individually tailored, secure and profitable service (Article 6(1)(f) of the GDPR). Facebook will also process your personal data in accordance with your consent, which you can withdraw at any time via the Facebook settings (Article 6(1)(a) of the GDPR).
For more information about Facebook's legal basis for the processing of personal data, please refer to Facebook's general privacy policy.
Go to Facebook's privacy policy via the following link:
Who receives my personal data
The LEGO Foundation does not disclose your personal data to other companies but uses data processors in the form of media agencies and IT providers and may in some cases transfer your personal data to third countries. If your personal data is transferred to countries outside the EU/EEA, such transfer will be made on the following legal basis: Binding company rules, the country has been approved as a so-called “safe” third country, or if the country has not been approved as a “safe” third country, we transfer data based on standard provisions adopted by the EU Commission or via approved certification schemes.
Facebook may share personal data with the following categories of recipients:
Internally among the Facebook companies
Externally with Facebook partners who use analytics services
Advertisers
Other people using the Facebook page
Measurement partners
Researchers and academics
For more information about who Facebook shares your personal data with, please refer to Facebook's general privacy policy.
Facebook can transfer your personal data to Facebook in the United States and other third countries. Facebook uses standard contracts approved by the European Commission and applies European Commission decisions on an adequate level of protection as the basis of transfer to third countries. You can find more information in Facebook's general privacy policy.
See Facebook's privacy policy via the following link:
j. LinkedIn
This privacy policy applies to LEGO Fonden's ('LEGO Foundation') processing of the personal data you leave and/or submit when you visit, follow or engage with the LEGO Foundation's LinkedIn page ('the LinkedIn page'). This privacy policy supplements LinkedIn Ireland Unlimited Company's ('LinkedIn') general privacy policy.
Who is the data controller
For the “Page Insights” function specifically, the LEGO Foundation and LinkedIn are joint data controllers pursuant to Article 26 of the GDPR. For all other processing carried out via the LinkedIn page (e.g. the LEGO Foundation's handling of comments or messages), the LEGO Foundation and LinkedIn each act as independent data controllers of their own processing.
LinkedIn's company information is:
LinkedIn Ireland Unlimited Company
Wilton Plaza, Wilton Place, Dublin 2
Ireland
The essential content of the agreement between the joint controllers is set out in LinkedIn's “Page Insights Joint Controller Addendum”, which you can find here.
What personal data does LinkedIn collect
Depending on your behaviour on the LinkedIn page, the LEGO Foundation and LinkedIn may collect the following personal data about you:
Whether you follow, like, comment on, or otherwise react to content on the LinkedIn page
Comments and messages you leave on the LinkedIn page
The fact that you have visited the LinkedIn page
Furthermore, LinkedIn uses “Page Insights” to provide aggregated statistical information about visitors to and followers of the LinkedIn page, including job function, country, industry, seniority, company size and employment status, based on data from your LinkedIn profile, as well as information on how you have interacted with the page. This data is provided to the LEGO Foundation in aggregated form only; LinkedIn does not enable the LEGO Foundation to link Page Insights back to individual members.
To read more about LinkedIn's use of cookies, please refer to LinkedIn's general cookie policy.
Go to LinkedIn's cookie policy via the following link: LinkedIn
What is the purpose
The LEGO Foundation processes your personal data to improve the LinkedIn page, compile statistics, develop and protect the LEGO Foundation's services and activities, and to respond to enquiries and comments, including based on your feedback. In this connection, the LEGO Foundation uses the aggregated “Page Insights” data made available by LinkedIn.
LinkedIn processes your personal data to provide, personalise and improve its services, including advertising, and to provide the LEGO Foundation with statistics about the LinkedIn page.
What is the legal basis for the processing
The LEGO Foundation processes your personal data based on the LEGO Foundation's legitimate interest in improving the LEGO Foundation's services and activities, (Article 6(1)(f) of the GDPR).
LinkedIn processes your personal data based on the performance of its contract with you (the LinkedIn User Agreement), LinkedIn's legitimate interests, compliance with legal obligations, and/or your consent, as further described in LinkedIn's privacy policy.
For more information about LinkedIn's legal basis for the processing of personal data, please refer to LinkedIn's privacy policy.
Go to LinkedIn's privacy policy via the following link: LinkedIn
Who receives my personal data
The LEGO Foundation does not disclose your personal data to other companies but uses data processors in the form of media agencies and IT providers and may in some cases transfer your personal data to third countries. If your personal data is transferred to countries outside the EU/EEA, such transfer will be made on the following legal basis: Binding company rules, the country has been approved as a so-called “safe” third country, or if the country has not been approved as a “safe” third country, we transfer data based on standard provisions adopted by the EU Commission or via approved certification schemes.
For more information about who LinkedIn shares your personal data with, and about LinkedIn's transfer of data to the United States and other third countries, please refer to LinkedIn's general privacy policy.
See LinkedIn's privacy policy via the following link:
k. YouTube
This privacy policy applies to LEGO Fonden's ('LEGO Foundation') processing of the personal data you leave and/or submit when you visit, comment on, or otherwise engage with the LEGO Foundation's YouTube channel ('the YouTube channel').
Who is the data controller
The LEGO Foundation is the data controller for the personal data you actively provide directly to the LEGO Foundation via the YouTube channel, e.g. by commenting on a video or contacting the LEGO Foundation. Google is the data controller for the personal data Google collects and processes as the operator of the YouTube platform, e.g. via cookies and the “YouTube Analytics” function.
What personal data does YouTube collect
Depending on your behaviour on the YouTube channel, the LEGO Foundation and Google may collect the following personal data about you:
Comments you leave under videos on the YouTube channel
The fact that you have visited, subscribed to, or watched videos on the YouTube channel
Personal data you submit directly to the LEGO Foundation (e.g. via a comment or message)
Google also uses cookies and similar technologies on the YouTube channel to collect statistical information for the LEGO Foundation via “YouTube Analytics”, including aggregated information about viewers' age range, gender, geographical location, and viewing behaviour. This aggregated data cannot be used by the LEGO Foundation to identify individual viewers.
To read more about Google's use of cookies, please refer to Google's cookie policy.
Go to Google's cookie policy via the following link: Google
What is the purpose
The LEGO Foundation processes your personal data to respond to comments and enquiries, to improve the YouTube channel and its content, to compile statistics, and to develop and protect the LEGO Foundation's services and activities. In this connection, the LEGO Foundation uses the aggregated statistics made available by Google via YouTube Analytics.
Google processes your personal data to operate, secure and improve YouTube and its services, including for advertising purposes, as further described in Google's privacy policy.
What is the legal basis for the processing
The LEGO Foundation processes your personal data based on the LEGO Foundation's legitimate interest in communicating with its audience, improving the LEGO Foundation's services and activities, and responding to enquiries and comments (Article 6(1)(f) of the GDPR).
Google processes your personal data based on Google's legitimate interests, the performance of its contract with you (e.g. the YouTube Terms of Service), compliance with legal obligations, and/or your consent, as further described in Google's privacy policy.
For more information about Google's legal basis for the processing of personal data, please refer to Google's privacy policy.
Go to Google's privacy policy via the following link: Google
Who receives my personal data
The LEGO Foundation does not disclose your personal data to other companies but uses data processors in the form of media agencies and IT providers and may in some cases transfer your personal data to third countries. If your personal data is transferred to countries outside the EU/EEA, such transfer will be made on the following legal basis: Binding company rules, the country has been approved as a so-called “safe” third country, or if the country has not been approved as a “safe” third country, we transfer data based on standard provisions adopted by the EU Commission or via approved certification schemes.
For more information about who Google shares your personal data with, and about Google's transfer of data to the United States and other third countries, please refer to Google's general privacy policy.
See Google's privacy policy via the following link: Google
3) Recipients
We may share your personal data with independent data controllers if we are legally required to do so, in relation to legal claims or if it is necessary to fulfil the purpose in question. These recipient categories are but not limited to:
Auditors
Banks
Public authorities
Advisors
LEGO Group entities
KIRKBI A/S
LEGO Foundation Investment A/S
Your personal data may also be disclosed to our data processors. Such disclosure is subject to data processing agreements, and the data processor may not use the data for other purposes than to perform the processing for us. These data processor categories are but not limited to:
IT suppliers
Consultants
Security providers
Other suppliers of services that LEGO Foundation use depending on the processing activity
4) Processing of personal data outside the EU/EEA
LEGO Foundation transfers, stores, and processes your information (including your personal data and content) both inside and outside of Denmark. We operate globally and may transfer your personal data to third parties in locations around the world for the purposes described in this Privacy Policy. Wherever your personal data is transferred, stored, or processed by us or by companies carrying out such services on our behalf, we will take reasonable steps to safeguard the privacy of your personal data.
In general, we store our data within the EU/EEA. However personal data may be transferred to or accessed from countries outside the EU/EEA.
If your personal data is transferred to countries outside the EU/EEA, such transfer will take place on the following legal basis:
a. Binding Corporate Rulesb. The country has been approved by the European Commission as having an adequate level of security or the recipient is certified under e.g., EU-U.S. Data Privacy Framework.c. If the country has not been approved by the European Commission as having an adequate level of security, we will ensure transfer as follows:
By using the European Commission's standard contractual clauses
By obtaining your consent to such transfer
5) Sources of personal data
We generally process personal data that is collected directly from you or from the device you are using. In some cases, we may also process data about you that we receive from other sources, such as Social media channels, publicly available data, recruitment agencies or from third-party vendors.
6) Retention of personal data
We will retain your personal data for the period necessary to fulfil the purposes as listed above.
Data may be processed and stored for a longer period in anonymized form or may be retained for a longer period if we are legally required to do so.
7) Your right to withdraw your consent
You may at any time withdraw any consent that we have obtained from you. You can withdraw your consent by contacting us using the contact information stated above in Section 1. If you withdraw your consent, such withdrawal does not take effect until the date of withdrawal. It does, therefore, not affect the legality of our data processing up to the time when you withdraw your consent. You can revoke your consent via email: info@LEGOFoundation.com
8) Your rights
According to the General Data Protection Regulation and the Danish Data Protection Act, you have certain rights.
You have the right to request access to and rectification or erasure of your personal data.
You also have the right to object to the processing of your personal data and have the processing of your personal data restricted.
You have an unconditional right to object to the processing of your personal data for direct marketing purposes.
You have the right to receive the personal data that is being processed in a structured, commonly used, and machine-readable format (data portability).
Please note that there may be conditions or limitations on these rights. It is therefore not certain that you e.g., have the right of data portability in the specific case - this depends on the specific circumstances of the processing activity.
You can exercise your rights by contacting us at info@LEGOfoundation.com. If you contact us we will have to verify your identity for security purposes.
9) Changes to this Privacy Policy
From time to time, we may change this Privacy Policy to accommodate new technologies, industry practices, regulatory requirements or for other purposes. The updated and current Privacy Policy can be viewed here: www.LEGOfoundation.com
10) Links to other websites etc.
Our website may contain links to other websites or to integrated sites. We are not responsible for the contents of the websites of other companies or for the practices of such companies regarding the collection of personal data. When you visit other websites, you should read the owners' policies on the protection of personal data and other relevant policies.
11) Questions and complaints
If you have any questions for this Privacy Policy, or if you wish to complain about our processing of your personal data, please contact us using the contact information provided in Clause 1.
You may also complain to:
The Danish Data Protection Agency
Carl Jacobsens Vej 35
DK-2500 Valby
Tel.: +45 33 19 32 00
Email: dt@datatilsynet.dk
Version
This policy has last been updated/revised in October 2026