BonBon-Land

Denmark · owned by Parques Reunidos (Spain) · bonbonland.dk · 29 vendors

BonBon-Land is Denmark's largest and most popular amusement park, located in Holme-Olstrup, Denmark. Originally inspired by a candy factory founded by Michael Spangsberg, the park grew from a small candy workshop into a 130,000 m² family theme park featuring rides, attractions, and events for all ages, including the longest rafting ride in the Nordic countries. It is owned and operated as part of the Parques Reunidos group, a leading international leisure park operator.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-13 · revision 3

29 direct vendors, 289 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

BonBon-Land demonstrates medium migration readiness, leaning towards the lower end due to significant unknowns. A key strength is the existing use of Adobe Experience Manager (AEM) Cloud, indicating some familiarity and adoption of cloud environments, which is a positive for future migrations. However, the specific nature of the 'Online Ticketing & E-Commerce Platform' is not detailed, and it could represent a legacy system that would be complex to migrate. There is no information provided regarding the adoption of cloud-native architectures such as containerization or microservices. 'Data Residency Requirements' are not specified, which could introduce significant challenges if strict requirements exist. Financial data (revenue concentration, growth history) is missing, making it impossible to assess the company's financial capacity to fund a potentially costly migration. Most critically, 'Vendor Lock-in Risk' is unknown, which is a major impediment to assessing migration readiness, especially considering the presence of 26 services and diverse vendor locations. While GDPR compliance is a factor that would need careful consideration during data migration, the overall lack of critical information regarding vendor dependencies and financial capacity places BonBon-Land in a moderate, but uncertain, state of migration readiness.

Compliance

9 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

BonBon-Land is headquartered in Denmark (EU member state) and processes substantial personal data of EU/EEA residents including customer ticket/booking data, payment data, children's data, marketing profiles, and cookie/tracking data. A detailed privacy policy exists and references Datatilsynet (the Danish DPA) as the supervisory authority, which demonstrates awareness of GDPR obligations. However, the privacy policy was last updated in June 2021 and may not reflect the latest regulatory guidance. The company processes children's data (under 14/18 thresholds referenced in the policy) and conducts automated profiling/decision-making, both of which are high-risk activities under GDPR. Joint controllership with Parques Reunidos (Spain) adds complexity. No public DPO appointment or registration is confirmed. Fines can reach €20M or 4% of global annual turnover. Risk is Medium rather than High because a substantive privacy policy is published, lawful bases are articulated, and data subject rights are described.

Evidence: https://www.bonbonland.dk/privatlivspolitik, https://www.bonbonland.dk/juridiske-oplysninger, https://www.bonbonland.dk/cookies, https://www.datatilsynet.dk/english, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

ISO 27001 (source) — Assessment Required

ISO 27001 is a globally recognized information security standard applicable to any organization that processes sensitive data. BonBon-Land processes significant volumes of personal data (customer payment data, children's data, marketing profiles, booking data) and operates an online e-commerce platform. A security breach could result in GDPR enforcement action, reputational damage, and financial loss. The company's legal notice references SSL/VeriSign security for transactions, but this does not constitute ISO 27001 certification. As part of the Parques Reunidos group, there may be group-level security frameworks, but no ISO 27001 certification is publicly confirmed for BonBon-Land or Parques Reunidos. Risk is Medium because the company handles payment card data and children's personal data, making information security failures particularly consequential.

Evidence: https://www.bonbonland.dk/juridiske-oplysninger, https://www.parquesreunidos.com/en/sustainability/policies

Danish Amusement Park Safety Regulations — Assessment Required

As an amusement park operator in Denmark, BonBon-Land is subject to Danish safety regulations governing fairground and amusement park rides, including inspection, maintenance, and operational safety requirements administered by the Danish Working Environment Authority (Arbejdstilsynet) and the Danish Safety Technology Authority (Sikkerhedsstyrelsen). The company publishes a ride status page (driftstatus) indicating active safety monitoring. However, no public inspection reports or compliance certificates were found. Risk is Medium because ride safety incidents can result in regulatory enforcement, operational shutdowns, and significant reputational and legal consequences.

Evidence: https://www.bonbonland.dk/dit-besog/informationer/her-kan-du-se-lukkede-forlystelser, https://www.bonbonland.dk/planlaeg-dit-besog/oplevelser/forlystelser, https://www.sik.dk/

Financials

Three-year financials

Financial Resilience Score: 6/10

BonBon-Land A/S is a mature, single-site Danish amusement park subsidiary of Parques Reunidos, one of Europe's largest leisure-park operators. The company benefits from an established brand with near-monopoly positioning on southern Zealand for family theme parks, an asset-owning model with land and rides largely owned (providing collateral value and low rent burden), and access to group financing, procurement scale, and cross-marketing benefits via its parent group. Recurring revenue via season passes and pre-committed group bookings (schools, companies) helps smooth cash flow. Historically the company has been consistently profitable with revenue in the range of roughly DKK 60-90 million and equity in the low double-digit DKK millions. However, resilience is materially constrained by heavy weather-, seasonality-, and consumer-discretionary-spend exposure. All revenue is generated from a single open-air park operating roughly May-October plus a Halloween season, with fixed costs running year-round. The 2020 COVID-19 pandemic materially depressed the season, demonstrating vulnerability to public-health events. Additionally, parent leverage at Parques Reunidos / Piolin BidCo (controlled by EQT, Corporación Financiera Alba, and Groupe Bruxelles Lambert) has historically been significant, and subsidiary financing decisions can be influenced by group-level cash needs. Theme parks also require continual capex investment in new rides to defend attendance.

Key strengths: Ownership by Parques Reunidos providing group financing and know-how, Established brand since 1992 with near-monopoly positioning on southern Zealand, Season-pass model and pre-committed group bookings smoothing cash flow, Land and ride assets largely owned providing collateral value, Historically consistently profitable

Risk factors: Weather and single-site concentration risk, Heavy seasonality with May-October operating window and year-round fixed costs, Pandemic/public-health event exposure demonstrated by COVID-19 impact, Discretionary consumer spending sensitivity to Danish household purchasing power, Capex intensity requiring continual investment in new rides, Parent leverage at Parques Reunidos / Piolin BidCo, Safety/operational incidents affecting visitor NPS

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report