Privacy policy
1. In general
1.1. JP/Politikens Hus A/S is a media group which includes Politiken, Jyllands-Posten, Ekstra Bladet, Finans, Børneavisen, Saxo and Politikens Forlag as well as a number of other publications and businesses such as Watch Medier, Bold, Holdet, Feltet, MarketWire and Monitormedier. When used below, "we", "our" and "us" have the meaning that follows from section 2 below on data controller(s).
1.2. This Privacy Policy applies to all information that you provide to us and/or we collect about you, whether in connection with a subscription/membership/customer/supplier or cooperative relationship or as a user of our services, including when you visit our website(s) or use our apps. In this Privacy Policy you can read more about the data we collect, how we handle your data and how long we retain data about you, etc.
2. Data controller(s)
2.1. JP/Politikens Hus A/S is the data controller for any processing carried out by our different brands, e.g. Politiken, Jyllands-Posten, Ekstra Bladet, Finans, Børneavisen, Saxo and Politikens Forlag. Our contact details are as follows: Rådhuspladsen 37, 1785 Copenhagen V, tel. +45 3311 8511, email: gdpr@jppol.dk.
2.2. Our subsidiaries and controlled companies are each independent data controllers when processing data about you, e.g. in connection with your subscription/membership/customer/supplier or cooperative relationship or your use of a service provided by the company in question or when you visit the company's website or app.
2.3. A list of our brands, subsidiaries and controlled companies is available here. The websites of the individual brands or companies concerned will indicate whether separate policies apply to their processing of personal data about you.
2.4. All questions concerning this Privacy Policy, the processing of your data and any suspected non-compliance should initially be sent to gdpr@jppol.dk.
3. Your rights
| Access | Rectification and erasure | Restriction of processing | Data portability | Right to object | Withdrawal of consent | Contact |
|---|---|---|---|---|---|---|
| You have the right to access the personal data we process about you. You may request access to the personal data we hold about you, including the purposes for which the data is collected. | You have the right to request rectification, supplementary processing, erasure or blocking of the personal data we process about you. | In certain circumstances, you have the right to restrict the processing of your personal data. | You have the right to receive your personal data (only data about you which you yourself have provided to us) in a structured, commonly used and machine-readable format (data portability). | Legitimate interests When we process your personal data based on our legitimate interests (see section 4 below), you have the right to object to this processing on grounds relating to your particular situation. In such cases, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of a legal claim. Processing of personal data for direct marketing purposes When we process your personal data for direct marketing purposes such as targeting across different channels and social media platforms, you have the right to object to this processing at any time. If you object to processing for direct marketing purposes, we will no longer process the personal data for this purpose. For more details, see section 6 below on segmentation and targeted marketing carried out by third parties. | If the legal basis for processing your personal data is your consent, you have the right to withdraw your consent at any time. | To exercise your rights, you may send an email to gdpr@jppol.dk. Please note that the exercise of the above rights may be subject to conditions or restrictions. By way of example, you may not always be entitled to data portability – it depends on the circumstances surrounding the processing activity in question. |
4. Personal data, purpose, legal basis for processing, recipients and data retention period
4.1. Depending on whether you are a subscriber, a newsletter recipient, a contact at one of our customers, suppliers or business partners, a freelancer or an author or whether you are a participant in our events or networking groups or simply a user of our website(s) or app(s), we process different categories of personal data. Below we have listed the personal data we collect from and about you, the purpose for which it is collected, the legal basis for processing and the data retention period:
| Websites, newsletters and apps | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Who | Categories of personal data | Purpose | Legal basis for processing | Recipients | Data retention period | ||||||
| Visitors to our website(s) | Depending on the scope of a cookie consent, we process: • IP address, including network and geographical location • Browser version • Language setting on your device • Technical data about your device such as screen resolution • Behavioural data, including which website or app you were referred from • Search terms, pages viewed, ads and website interaction/clicks and cookie ID • Information about your device, including operating system and browser information, etc. • Traffic data etc., location data, behavioural data and communication data collected from digital channels and SoMe • Completion of forms and login details | • Ensuring the functionality of our websites. This includes customisation of user interface for proper display, including the right screen resolution • Performing analytics and statistics, displaying personalised content and relevant ads and carrying out targeted marketing across channels and devices. For this purpose, we collaborate with service providers who use cookies to collect and process data about you | • Article 6(1)(a) of the GDPR on consent • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests are to make our websites available to you, ensure that the website is displayed correctly, make improvements and, in some cases, carry out targeted marketing across different channels and social media platforms | • Our data processors in the form of suppliers and business partners such as service and IT providers, analytics partners, technical support providers and similar parties • The other third parties mentioned in our Cookie Policy | • Up to 18 months after collection or – for personal data collected via cookies – according to the expiration of the individual cookies as described in our Cookie Policy | ||||||
| Users of our apps | Depending on the scope of a cookie consent, we process: • IP address, including network and geographical location • Browser version, language setting on your device, etc. • Technical data about your device such as screen resolution • Information about your device, device unique identifier (e.g. IMEI and MAC number), operating system, mobile network and IP address • App usage time and location, if permitted by the device • Search terms, pages viewed, ads and in-app interaction/clicks • Completion of forms and login details | • Ensuring the functionality of our apps. This includes customisation of user interface for proper display, including the right screen resolution • Performing analytics and statistics, displaying personalised content and relevant ads and carrying out targeted marketing across channels and devices. For this purpose, we collaborate with third parties who use cookies to collect and process data about you | • Article 6(1)(a) of the GDPR on consent • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests are to make our apps available to you, ensure that they are displayed correctly, make improvements and, in some cases, carry out targeted marketing across different channels and social media platforms | • Our data processors in the form of suppliers and business partners such as service and IT providers, analytics partners, technical support providers and similar parties • The other third parties mentioned in our Cookie Policy | • Up to 18 months after collection or – for personal data collected via cookies – according to the expiration of the individual cookies as described in our Cookie Policy | ||||||
| Visitors to our social media platforms, such as Facebook, Instagram and LinkedIn, etc. | • Information you have published on social media, your reactions to our posts and your sharing of our posts and any comments on our posts as well as your contact details etc. that you send to us via private messages and contact forms on social media | • Optimisation of social media marketing • Provision of relevant content • Responding to your enquiry via social media (e.g. private messages) • Compiling aggregated statistics about your activity on our social media platforms | • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in carrying out targeted marketing across different channels and social media platforms, communicating with you as well as compiling statistics and performing segmentation. | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • When the post is deleted or when you withdraw your reaction to our post (like, share, etc.), the information is deleted. See also the specific policies of the social media platform in question | ||||||
| Recipients of editorial newsletters and individuals signing up for commercial communications and newsletters as well as participants in competitions | • The information provided by you when entering the competition or subscribing to the newsletter • Name, email and purchase, if applicable • Behavioural data from pixels in our emails, email history, open rates, information about your device (operating system and mail client, etc.) and your interaction with our newsletters | • Sending out newsletters and organising competitions • Carrying out targeted marketing, including on social media platforms, and compiling statistics | • Article 6(1)(a) of the GDPR on consent • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in sending you editorial newsletters by email and sending you marketing communications (i) by letter or (ii) by email about similar products and services, and our legitimate interests in organising competitions, including sending out prizes | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to one year after unsubscribing from the newsletter/withdrawal of consent or participation in a competition, unless you have consented to us retaining the data for other purposes or the data is processed as part of our agreement with you • Accounting records are retained for up to five years after the end of the financial year to which they relate | ||||||
| Users of our services and subscription offerings as well as customers | |||||||||||
| Who | Categories of personal data | Purpose | Legal basis for processing | Recipients | Data retention period | ||||||
| Individuals who create a profile on our websites using a personal login | • Name, username, email, telephone number, date of birth and subscription products and services • Website purchases • Login details, page views across our domains, downloads, number of devices on which the login can be used | • Delivering services and features, and storing your preferred settings and choices across our platforms • (i) Ensuring correct login on our sites, (ii) performing segmentation and (iii) carrying out targeted marketing as well as sending service messages | • Article 6(1) of the GDPR on performance of the agreement with you, e.g. your subscription agreement and other purchases, such as access to content behind a paywall • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interest in (i) authenticating our users when they log in to our website, (ii) compiling statistics based on login details and (iii) sending you service messages etc. about your subscription agreement or purchased product/service | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to three years after the last login | ||||||
| Current or previous subscribers and customers as well as trial subscribers | • Name, address, email and telephone number, date of birth and subscription type, payment method, payment, discounts, card type, expiry date and the last four digits of the card number or the entire card number if you have given consent to storage in regard to further transactions • Billing and payment details • Information relating to trade union membership discount • Information relating to your subscription type, name, age, address and purchased products, as well as other information relating to the subscription agreement, including any discounts, as well as the subscriber/customer • Recording of telephone conversations and subsequent transcription and analysis • Civil registration (CPR) number when participating in games etc. | • Performance of the agreement, including setting up a payment agreement, and managing payments, discounts and reminders • Storage of credit card data for the purpose of facilitating further online transactions • Ensuring compliance with legal requirements for maintaining accounting records • Validation of your trade union membership • Validation of the subscription agreement with benefits • Customer service and marketing as well as statistical and analytical purposes • Quality assurance and improvement of our customer service • Age verification, verifying Danish residence and consulting the ROFUS register regarding self-exclusion | • Article 6(1)(a) and Article 9(2)(a) of the GDPR on consent • Article 6(1)(b) of the GDPR on performance of the agreement with you • Article 6(1)(c) of the GDPR, see section 12(1) of the Danish Bookkeeping Act (bogføringsloven) on the legal obligation to maintain accounting records, section 4, paragraph 1-2 of the Executive Order on Online Betting (Bekendtgørelse om online væddemål) in relation to keeping records of player data for games with stakes and Annex C.3 regarding registration in the ROFUS register in the same Executive Order • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in communicating with you, providing, improving and quality assuring our customer service, validating subscription agreements with benefits and carrying out targeted marketing across channels and social media platforms, as well as compiling statistics and analytics | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties • Where relevant, any business partners in connection with subscription agreements with benefits or the like | • Agreements and related personal data, including login details, are retained for up to six years after the end of the agreement • Your card details we store to facilitate your future transactions will be deleted within 18 months after your last transaction • Accounting records and data on players participating in games with stakes are retained for up to five years after the end of the financial year to which the records and/or data relate • Recordings of telephone conversations are deleted no later than after three months, and any transcriptions are deleted no later than after one year | ||||||
| Individuals we communicate with | |||||||||||
| Who | Categories of personal data | Purpose | Legal basis for processing | Recipients | Data retention period | ||||||
| Individuals we contact by telephone to set up a new or upgrade an existing subscription agreement | • Name, telephone number and address • Registration on the Robinson list and on our internal opt-out list, where relevant • We may collect information through data brokers or from publicly available databases | • Contacting you to set up a subscription agreement or upgrade your existing agreement • Ensuring that we do not contact individuals who have opted out of marketing communications (in Denmark via the Robinson list maintained by the Central Office of Civil Registration (CPR-kontoret)) | • Article 6(1)(c) of the GDPR on legal obligation. Our legal obligation not to contact individuals who have opted out of receiving direct marketing communications • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in entering into newspaper subscription agreements and recording telephone conversations for training purposes | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to one year after our last contact, unless we have an existing agreement with you • If you decline further contact, you will be registered on an opt-out list and we will keep your data for up to five years, after which the data will be deleted | ||||||
| Individuals communicating with us by telephone, email or chat forums who submit unsolicited contributions to articles, books, etc. | • The information provided by you, e.g. name, address, telephone number, email, content of communication, submitted material and time of submission | • Providing customer service, responding to and processing enquiries and requests and communicating in general | • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interest in responding to you when you contact us | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to one year after the last communication, unless you have consented to a longer retention period for the data for other purposes or we have an existing agreement with you | ||||||
| Individuals registering for or participating in events, conferences, networking groups, etc. | • Name, email, employer and job title and participation details • Billing and payment details | • Running the event, preparing course certificates and participant lists, sending out invitations, communicating with participants and evaluating the event • Ensuring compliance with the requirements of the Danish Bookkeeping Act for maintaining accounting records | • Article 6(1)(b) of the GDPR on performance of the agreement with you • Article 6(1)(c) of the GDPR, see section 12(1) of the Danish Bookkeeping Act on the legal obligation to keep accounting records • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests with regard to organising and evaluating the event | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to one year after the calendar year in which you participated in an activity organised by us, unless you have given consent for us to retain the data for other purposes or we have an existing agreement with you • Accounting records are retained for up to five years after the end of the financial year to which they relate | ||||||
| Survey and focus group participants | • Name, email, employer and job title, focus group interviews and survey results • Recording (audio and video) or transcription of interviews | • Collecting and analysing feedback to improve products and services, generating targeted statistics and customising our products • Gaining insights into the needs and preferences of our subscribers for segmentation and improved customer experience | • Article 6(1)(a) of the GDPR on consent • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in gaining insights and receiving feedback on our products and services to improve the customer experience | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to two years after the calendar year in which you participated • Recordings are deleted no later than 30 days after participation | ||||||
| Business partners | |||||||||||
| Who | Categories of personal data | Purpose | Legal basis for processing | Recipients | Data retention period | ||||||
| Contacts at business partners and service providers | • Name, email, telephone number, address, employer, job title, content of correspondence and information related to the agreement/offer • Billing and payment details | • Compliance with our obligations • Communication, public relations and ongoing management of the business relationship • Ensuring compliance with the requirements of the Danish Bookkeeping Act for maintaining accounting records | • Article 6(1)(b) of the GDPR on performance of the agreement • Article 6(1)(c) of the GDPR, see section 12(1) of the Danish Bookkeeping Act on the legal obligation to keep accounting records • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in the ongoing management of the business relationship, communication and handling of any disputes | • Our data processors in the form of suppliers and business partners such as service and IT providers, technical support providers and similar parties | • Up to six years after the end of the contractual relationship, unless a longer retention period is justified, e.g. due to ongoing relations or administrative needs or for the establishment, exercise or defence of a legal claim • Accounting records are retained for up to five years after the end of the financial year to which they relate | ||||||
| All of the above | |||||||||||
| Who | Categories of personal data | Purpose | Legal basis for processing | Recipients | Data retention period | ||||||
| All of the above | • All of the above data to the extent necessary, reasonable and legitimate to meet the purposes set out in the following column | • Enforcing our own rights and those of others • Legal compliance • Business development, internal administrative purposes, business intelligence, analytics and statistics, as well as providing the best possible service and in order to customise our content, products and services • Implementation of appropriate security measures • Managing data subject rights and handling data breaches | • Article 6(1)(c) of the GDPR on legal obligations, e.g. Article 5 of the GDPR on accountability, as well as relevant provisions in specific legislation, e.g. the Danish Bookkeeping Act (bogføringsloven), the Danish Copyright Act (ophavsretsloven), the Danish Marketing Practices Act (markedsføringsloven) and the Danish Consumer Contracts Act (forbrugeraftaleloven) • Article 6(1)(f) of the GDPR on legitimate interests. Our legitimate interests in (i) continuing our business development efforts internally within the group, including as regards existing services and products and future business areas, operating and developing the best possible media business and marketing our products and services across our group companies; (ii) implementing appropriate organisational and technical measures to protect the personal data we process; (iii) dealing with and notifying security breaches as well as responding to requests and other regulatory compliance measures relating to data subject rights; (iv) safeguarding our own and third parties' commercial and legal interests, including in case of suspected abuse of a personal login, subscription products and services and in case of possible infringement of third party rights; and (v) pursuing legal claims (vi) transmission of shares to a third party | We may disclose your personal data if necessary and subject to a valid statutory basis: • Reporting requirements to public authorities, including for investigative purposes • If we or the data recipient have a legitimate interest, e.g. intra-company disclosures for internal administrative purposes, business intelligence, analytics and statistics, to provide the best possible service to you and in order to tailor our content, products and services to you and provide you with the best possible offerings • Postal and parcel service providers • External companies in case of transmission of shares • External advisors, e.g. lawyers and accountants • External parties involved in our benefits programme(s) • The other third parties mentioned in our Cookie Policy, depending on your cookie consent | • Data relating to visitors to our website is retained for up to 18 months after collection or – for personal data collected via cookies – according to the expiration of the individual cookies as described in our Cookie Policy • Data relating to individuals who create a profile on our websites using a personal login is retained for up to three years • Information relating to a contractual relationship is retained for up to six years after its termination, unless a longer retention period is justified, e.g. due to ongoing relations or administrative needs or for the establishment, exercise or defence of a legal claim • Accounting records are retained for up to five years after the end of the financial year to which they relate | ||||||
5. Sharing your personal data
5.1. We may share your personal data with our service providers and business partners, including, for example, our IT operations, hosting and administration service providers and analytics partners, etc. This means that we may share your personal data with third parties such as our service providers, IT service providers, technical support providers and – depending on your cookie consent – with analytics, social media and advertising partners who process data on our behalf (our data processors).
6. Segmentation and targeted marketing
6.1. When you create a login, sign up for a newsletter, enter into a subscription agreement, make a purchase, participate in competitions, etc. via one of our websites or apps, we collect various data such as your email address and may disclose it to third parties, including advertising partners, our subsidiaries and to the following platforms:
- Meta (Facebook and Instagram)
- X
6.2. The purpose is targeted advertising to specific audience groups as well as segmentation and exclusion of individuals for marketing purposes. We are joint data controllers with the third parties concerned. For more details about the division of responsibilities and to see some of the relevant agreements, see section 7.1 below.
6.3. Our legal basis for processing is our legitimate interests (see Article 6(1)(f) of the GDPR) in carrying out targeted marketing on our own sites as well as across different sites, channels and social media platforms.
6.4. You have the right to object to our processing for direct marketing purposes at any time by contacting us at gdpr@jppol.dk.
7. Joint data controllers
7.1. Depending on your consent, cookies and pixels from providers of social media platforms such as Facebook, Google, YouTube, etc. and from our advertising partners are stored on our websites and when our other digital services are used. This means that these providers of social media platforms may receive technical data about your browser and IP address and the pages you visit. If, for example, you are logged in to Facebook or Google when visiting us, the provider may be able to combine this data with your profile. As regards the collection and processing of data that takes place in this connection, we are joint controllers with the respective provider(s) for the processing of your personal data. In accordance with Article 26 of the GDPR, we have entered into joint controller agreements with these providers, outlining the roles and responsibilities between us. See below for more details about the specific agreements with the various providers and their processing of your personal data.
| Meta (Facebook and Instagram) | In relation to third country transfers, Meta is responsible for compliance with Article 44 et seq. of the GDPR under the joint controller agreement. The joint controller agreement is available here. We use Facebook Business Tools such as Customer Audience and the like. Click here for more details on how Meta processes your personal data. |
| Google, including YouTube | In relation to third country transfers, Google is responsible for compliance with Article 44 et seq. of the GDPR under the joint controller agreement. The joint controller agreement is available here. Click here for more details about how Google processes your personal data. |
| X (Twitter) | In relation to third country transfers, X is responsible for compliance with Article 44 et seq. of the GDPR under the joint controller agreement. The joint controller agreement is available here. Click here for more details about how X processes your personal data. |
| In relation to third country transfers, LinkedIn is responsible for compliance with Article 44 et seq. of the GDPR under the joint controller agreement. The joint controller agreement is available here. Click here for more details about how LinkedIn processes your personal data. | |
| Danske Medier Research ApS | JP/Politikens Hus A/S and our Danish group companies are members of Dansk Online Index, which is operated by Danske Medier Research ApS and compiles traffic statistics for Danish websites. The measurements are carried out by Gemius SA on behalf of Danske Medier Research. When you visit our websites, cookies from the domain of *.gemius.pl are stored on your device for the purpose of collecting IP data, technical device data, browser version data, etc. for the purpose of compiling statistics, provided that you have consented to such cookies. JP/Politikens Hus A/S and/or our Danish group companies, on the one hand, and Danske Medier Research, on the other hand, are joint data controllers for the part of the measurement that consists of cookie storage and collection of data from the data subjects' devices. Therefore, a joint controller agreement has been entered into based on the standard agreement available from the Danish Data Protection Agency. For more details about joint data control, see the section entitled "Joint data control of the affiliated websites and DMR" (available in Danish only), and more details about the processing of your personal data can be found here. |
| Programmatic ad sales | When JP/Politikens Hus A/S and our Danish group companies enter into agreements with third parties (primarily SSPs) for advertising on our digital services, this is done in accordance with our Data Protection Guidelines, which outline the division of responsibilities between us and the third parties concerned. The Guidelines are available here. |
8. Sharing your personal data with non-EU/EEA recipients
8.1. Some service providers and partners are based outside the EU/EEA. We may therefore transfer your personal data to recipients in non-EU/EEA countries. However, in order for us to do so:
- the country or international organisation in question must have an adequate level of protection as determined by the EU Commission;
- standard data protection clauses adopted by the European Commission must have been agreed by us and the relevant recipient of your personal data, and the country or international organisation in question must be deemed to offer a level of protection that is essentially equivalent to the level of protection in the EU;
- the recipient must be certified in accordance with Article 42 of the GDPR; or
- the recipient must have adopted a set of approved Binding Corporate Rules.
8.2. Furthermore, in specific cases, we may request your consent to a data transfer to non-EU/EEA countries, and we may also transfer your data if the transfer is necessary as a result of an agreement with you or measures taken in connection with an agreement with you. These exceptions to the general restrictions on transfer are covered by Article 49 of the GDPR.
8.3. You may at any time request information about or, where relevant, a copy of the appropriate safeguards that form the basis for any data transfer to non-EU/EEA countries or – if exceptions as referred to in Article 49 of the GDPR are applied – the exceptions on which such transfer is based.
9. Possible consequences of not providing your personal data
9.1. If you are required to provide personal data to us, this requirement will be specified at the point of collection. If you do not wish to provide the required personal data, it may mean that we will be unable to provide the requested services to you.
10. Complaints to supervisory authority
10.1. Any complaints about our processing of your personal data may be submitted to the Danish Data Protection Agency at the address of Carl Jacobsensvej 35, 2500 Valby, Denmark, tel. +45 33 19 32 00, email: dt@datatilsynet.dk
11. Changes to this Privacy Policy
11.1. This Privacy Policy is reviewed on a regular basis to keep it up to date, and is subject to change at any time. Significant changes will be highlighted on our website and a link will be provided to the updated version of the Privacy Policy.
11.2. This Privacy Policy was last updated on March 27, 2026.