10 User Testing
17 Your rights
This site at www.aardman.com (including any related online or mobile site) (the “site”) is operated by Aardman Animations Limited (“Aardman”, “we”, “us” or “our”). We are a company registered in the UK with company number 02050843 and with our registered office at Gas Ferry Road, Bristol, BS1 6UN.
For the purposes of applicable data protection laws, including the UK GDPR (as defined by section 3(1) of the Data Protection Act 2018), and/or any equivalent data protection laws that apply in England and Wales, Aardman is a “controller”. That means that we retain control over, and are responsible for, all personal data collected on this site and must ensure that we use those personal data in compliance with data protection laws.
We don’t usually collect or use any information about you.
If we’ve asked for your personal details (such as when you enter a competition), we hope you have read and understood the explanation we gave you.
If you have any queries, please ask your parent or guardian. Or else you can email us with your query at email@example.com.
We do not generally seek to collect personal data from children under the age of majority (which is 18 in the UK), nor from children under the age at which a parent’s or guardian’s consent is required (which is 13 in the UK). We will only collect personal data from children for specific, limited purposes, such as competitions. If we do seek personal data from children, we will use separate, specific privacy notices for that collection, which will govern the use of those data. If there is no separate privacy notice in place and it becomes apparent to us that children have in fact sent personal data to us (contained in an email for example), the information will be deleted.
If you believe your child has provided us with personal details without your permission and you would like to have those details deleted, please contact us as described below.
3 Information we may collect from you
We may collect the following data from you during your visit to the site:
- personal data you provide by filling in forms on this site, including personal data provided at the time of registering for any of our newsletters and mailing lists (for example, first name, last name and email address);
- personal data you provide when reporting a problem with this site or requesting technical support;
- personal data you provide when submitting user-generated content for our AardBoiled service;
- personal data you provide when entering a competition, prize draw, promotion or survey;
- personal data you provide to us if you contact us for any other reason;
- details of your visits to this site, including traffic data, location data and other communications data and the resources that you access; and
- information about your browser version, operating system and screen resolution.
4 Information we may receive from other sources
Occasionally we may receive information about you (including personal data) from other sources. For example:
- if we host or co-host an event that you attend, or if we work on a project that you take part in (whether we are running the project alone or with our partners), then we may receive information about you from such venue, co-host or partner(s);
- if you visit our premises, then images of you may be captured by our CCTV surveillance systems (for which see our separate CCTV notice as displayed at those premises); and
- from websites that contain links to this site, including our branded websites (such as wallaceandgromit.com/, www.shaunthesheep.com/, www.amazingmorph.com/ and www.timmytime.tv/), the Aardstore at www.aardstore.com/ (which is run by a third party and not by us), and other third-party websites that link to www.aardman.com.
We may also receive personal data about potential candidates from third parties as part of our recruitment processes. If so, we will provide candidates with a separate privacy notice setting out how candidate personal data will be collected and processed. If you are a candidate or potential candidate and have any questions about how we are or will collect and process your personal data, you can contact us using the contact details provided at section 20 below. Further information about recruitment is available at https://www.aardman.com/jobs/.
Where we need to collect personal data by law, or under the terms of a contract that we have with you and you fail to provide that data when requested, we may not be able to perform the contract that we have or are trying to enter into with you. If so, we shall notify you if that is the case at the time.
5 Special categories of personal data
We do not seek to collect any special categories of personal data about you: those would include details of a person’s race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health information, genetic and biometric data and information about criminal convictions and offences. If, however, when using any interactive feature of the site (such as an online contact form or questionnaire), you in fact provide us with any such special data or information about criminal convictions and offences, then by submitting such data/information, we’ll assume that you are happy for us to use such data/information for (a) the purpose for which you have voluntarily provided such data/information and (b) any purpose that is reasonably compatible with such purpose. You may withdraw that permission at any time by contacting us.
A ‘cookie’ is a small text file of letters and numbers that we store on your browser or the hard drive of your computer when you access and use our site if you agree. Cookies contain information that is transferred to your device.
For detailed information on the cookies we use and the purposes for which we use them, please see our cookies policy at section 19 below.
7 Lawful processing of your personal data
However we use your personal data, we make sure that our use complies with lawful bases for using or processing your personal data. We may rely on one or more of these bases when we process your personal data. The bases include where:
- we need to process your personal data in order to perform our contractual obligations to you;
- we have obtained your consent – please note that, if we need your consent for a particular purpose of processing and you do not give us consent (or if you give it but then withdraw it), then we will not process (or continue to process) your personal data for that purpose;
- we need to process your personal data in order to discharge our legal and regulatory obligations;
- we need to process your personal data in order to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
- the use of your personal data as described is necessary for our legitimate interests, such as:
- allowing us to manage and administer the operation of our business effectively and efficiently;
- maintaining compliance with internal policies and procedures;
- monitoring the use of our copyrighted materials;
- enabling quick and easy access to information on our products, content and services;
- offering up-to-date security solutions for mobile devices and IT systems; and
- obtaining further knowledge of current threats to network security in order to update our security solutions and to provide those to the market.
If we are processing your personal data because this is necessary for our legitimate interests, then we may continue to do so unless you have a right to object to this (please see “Your rights” at section 17 below).
Please note that, if we need to process your personal data in order to operate the site and/or to provide our products, content and services, and you object or (if we require consent) you do not consent to our processing your personal data, then the site and/or those goods and services may not be available to you.
8 Uses made of your personal data
Your personal data may be stored and processed by us for the purposes listed below and in accordance with the lawful bases listed below.
Please note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful bases we are relying on to process your personal data where more than one ground has been set out below.
Lawful bases for processing
To provide the site and to ensure that content from the site is presented in an effective and user-friendly manner for you and for your device.
Necessary for our legitimate interests (for running our site, to keep our site updated and relevant, customer interaction and customer relations and the provision of administration and IT services).
To investigate and address any comments, queries or complaints, or to fix any problems, notified to us by you or other users of the site.
(a) Necessary for our legitimate interests (customer interaction and customer relations, provision of IT support, technical administration and maintenance).
(b) Consent (in respect of special categories of personal data only, and only if you have provided this to us, see section 5 above).
To encourage and allow you to participate in interactive features on our site, including competitions, prize draws, promotions or surveys (for which see section 9 below), when you choose to do so.
(a) Performance of a contract with you.
(b) Necessary for our legitimate interests (to study how people use our site and interactive features, to help us develop those and to address any issues people experience in using those, for the promotion and popularity of our site and brands, and to ensure compliance with applicable competition rules and regulations).
(c) Consent (in respect of special categories of personal data only, and only if you have provided this to us, see section 5 above).
To contact you in relation to user testing if you have consented to this (see section 10 below).
Consent (if given).
To contact you for marketing purposes if you have consented to this (see section 11 below).
Consent (if given).
For ongoing review and improvement of our site and its security, including technical analysis and statistical monitoring to detect and prevent any potential disruptions, system failures, cyber-attacks or malicious data from affecting our IT systems or any data held by us.
Necessary for our legitimate interests (for running our site, analysis of site and business performance, the provision of administration and IT services, network security and the protection of our site, systems and data).
To conduct research, statistical analysis and behavioural analysis on our site users and their behaviour (including anonymizing data for those purposes), and to create and share insights based on aggregated, anonymous data collected through such research and analysis (provided that individual users are not identifiable from such insights).
Necessary for our legitimate interests (to study how people use our site and interactive features and to create and share anonymised insights with business partners and third parties).
Consent to cookies (if given), for which see section 19 below.
For the management and administration of our business.
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of any business reorganisation or group restructuring exercise).
(b) Performance of a contract with you (for example if you are a company that we are doing business with).
(a) Performance of a contract with you.
(b) Necessary for our legitimate interests (for running our business, provision of services, detection and prevention of issues affecting our business, and to ensure compliance with applicable rules and regulations).
In order to comply with and/or assess compliance with applicable laws, rules and regulations, and our internal policies and procedures, which includes processing personal data as reasonably required in order to establish, exercise or defend legal claims or for the purpose of legal proceedings.
(a) Necessary to comply with our legal obligations.
(b) Necessary to establish, exercise or defend legal claims or for the purpose of legal proceedings.
(c) Necessary for our legitimate interests (to comply with our internal policies and procedures).
For the administration and maintenance of databases storing personal data.
(a) Performance of a contract with you (where the database relates to our clients and customers).
(b) Necessary to comply with our legal obligations.
(c) Necessary for our legitimate interests (for maintaining and accessing our databases and for related business purposes).
Change of purpose
We shall only use your personal data for the purposes for which we collected the data, unless we reasonably consider that we need to use such data for another reason and that reason is compatible with the original purpose. If you would like to get an explanation of how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we shall notify you and we will explain the legal basis on which we intend to rely.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, if and to the extent that this is required or permitted by law.
From time to time we may run competitions, prize draws, promotions or surveys (referred to here collectively as “competitions”).
We may well need to process your personal data for you to take part in competitions and, if you are a winner, to contact you about your prize (including sending prizes to you through a postal service or courier) and use your details in accordance with the following paragraph. We will not use your personal data for any other purpose, including sharing it with third parties (besides postal services or couriers), unless we have notified you of this separately in writing before doing so.
The winner’s first name may be posted on our websites and/or social media channels that relate to the competition. In addition, under applicable competition rules (including the CAP code), a winner’s first name, surname and county must be made available to individuals who request this information within a certain period after a competition has ended (usually around thirty (30) days). We will make this information available in accordance with the CAP code as it is in our legitimate interests to comply with applicable competition rules. Further information about the CAP code is available at https://www.asa.org.uk/about-asa-and-cap.html. If you have any questions about how we run competitions please email privacy@Aardman.com.
10 User Testing
From time to time we may run testing sessions where we invite people to come and test out apps, websites or other interactive products or services that we are working on (referred to here collectively as “user testing”).
If you have given permission, we may store your personal data and use this to contact you by email in relation to user testing, including inviting you to user testing sessions. We will continue store and use your personal data for these purposes unless and until you withdraw your permission (which you are free to do at any time by sending an email to firstname.lastname@example.org). If you attend a user testing session we may also need to process your personal data to enable you to take part in the session. We may share your personal data internally within Aardman in relation to user testing. We will not use your information for any other purpose, including sharing it with external third parties, unless we have notified you of this separately, in writing, before doing so.
If you have given permission, we may contact you by email about our content, releases, products, services, promotions and special offers (or those of selected third parties) that may be of interest to you. We will inform you (before collecting your data) and seek your permission if we intend to use your data for such purposes. If you prefer not to receive any direct marketing communications from us, you are free to decline, or if you give permission and change your mind later, you can opt out at any time (see further below).
If you have bought goods, content and/or services from us, we may also contact you by email with marketing information about similar goods, content and/or services that we think might interest you, unless you have asked us not to (and we will notify you of this and give you the opportunity to opt out when we collect your personal data). Again, if you change your mind, you can opt out at any time (see further below).
You have the right at any time to ask us to stop processing your information for direct marketing purposes. If you wish to exercise this right, you should contact us by sending an email to email@example.com, giving us enough information to identify you and to deal with your request. Alternatively, you can follow the unsubscribe instructions in emails you receive from us.
We will never share your personal data with third parties for marketing purposes unless you have specifically consented to us doing so in advance.
12 Disclosure of your information
We may share your personal data with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.
We may also share your personal data with third parties as further described below:
- If we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets (or their representatives and advisers) for due diligence purposes.
- If Aardman or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
- To the extent required by law (for example, if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation), or in order to enforce or apply the terms of any other agreements, or to protect the rights, property or safety of Aardman, our customers or others, including exchanging personal data with other companies and organisations for the purposes of fraud protection and credit risk reduction.
- If we are required to disclose information relating to competitions and competition winners in to ensure compliance with applicable competition rules and regulations in accordance with section 9
13 Where we transfer and store your personal data
The personal data that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (“UK”). It may also be processed by staff operating outside the UK who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the provision of support services to us (or you) in relation to our interactions with you.
- the country to which we send the data might be approved by the UK government as offering an adequate level of protection for personal data;
- the recipient might have signed up to a contract based on “standard data protection clauses” or an international data transfer agreement approved by theUK government , obliging them to protect your personal data in accordance with standards of protection that apply within the UK ; or
- in other circumstances the law may otherwise permit us to transfer your personal data outside the UK.
You can obtain more details of the protection given to your personal data when transferred outside the UK by contacting us using the contact details provided below.
14 How we safeguard your information
We have extensive controls in place to maintain the security of our information and information systems. Files are protected with safeguards according to the sensitivity of the relevant information, including hashing or data encryption where appropriate. Appropriate controls (such as restricted access) are placed on our computer systems. Physical access to areas where personal data are gathered, processed or stored is limited to authorised employees.
As a condition of employment, our employees are required to comply with all applicable laws and regulations, including in relation to data protection law. Unauthorised use or disclosure of confidential information (including personal data) by an employee of Aardman is prohibited and may result in disciplinary measures.
If you contact us about your information, you may be asked for some personal data for identification purposes. This type of safeguard is designed to ensure that only you, or someone authorised by you, has access to your information.
15 Internet risks
16 How long we keep your personal data
How long we will hold your personal data for will vary and will be determined by the following criteria:
- legal obligations – laws or regulations may set a minimum period for which we have to keep your personal data.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
17 Your rights
- the right to obtain information regarding the processing of your personal data (including whether or not we are holding and/or processing your personal data, the extent of the personal data we are holding and the purposes and extent of the processing) and access to the personal data that we hold about you, if any;
- where we are relying on consent for a particular purpose, the right at any time to withdraw your consent to the processing of your personal data for such purpose;
- in some circumstances, the right to receive some personal data in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible – which is sometimes known as the right to “data portability”, and please note that (a) this right only applies to personal data which you have provided directly to Aardman and which we are processing either on the basis of consent or because the processing is necessary in order for us to perform our contractual obligations to you and (b) if you request the right to data portability and it is not available to you, we will let you know;
- the right to request that we rectify your personal information if it is inaccurate or incomplete;
- the right to request that we erase your personal data in certain circumstances – please note that there may be circumstances where you ask us to erase your personal data but we are legally entitled to retain it, in which case we will let you know;
- the right to object to, or request that we restrict, our processing of your personal data in certain circumstances – again, there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally entitled to refuse that request and, if so, we will let you know;
- the right to object to decisions based solely on automated processing, including profiling, which produce legal effects or otherwise significantly affect you (for example, where a computer algorithm, rather than a person, makes decisions that affect your contractual or other rights) – please note that we do not currently carry out any such automated decision-making processes; and
- the right to lodge a complaint with the relevant data protection regulator if you think that any of your rights have been infringed by us, and please note that:
- the data protection regulator for the UK is the Information Commissioner’s Office (“ICO”);
- you can submit complaints through the ICO helpline by calling 0303 123 1113; and
- further information on reporting concerns is available at https://ico.org.uk/concerns/.
To find out more about your legal rights, please see the ICO’s website (www.ico.org.uk).
You can exercise your rights above at any time by contacting us at Aardman Animations Limited, Gas Ferry Road, Bristol, BS1 6UN or firstname.lastname@example.org, giving us enough information to identify you and to respond to your request.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). We may, however, charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in those circumstances.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we shall notify you and keep you updated.
18 Other websites
If you follow a link to another website (including any website operated by Aardman), different privacy policies may apply. You should read those policies before you submit any personal data to those websites, and please note that use of your personal data by those websites will be subject to those privacy policies.
19 Cookies policy
Cookies we use
We may use the following cookies and similar tracking technologies on our sites:
- ‘Local Storage’ – where our websites offer interactive features like games, we use Local Storage (which works in the same way as a cookie) to store game progress data on your machine;
- Google/YouTube – used to determine the optimal video quality based on the visitor’s device and network settings. Further information can be found here: https://policies.google.com/privacy
- Facebook pixel – a Facebook advertising tool which allows us to track website visitors and serve them relevant advertising through Facebook (see https://www.facebook.com/business/help/742478679120153?helpref=page_content for more information); this tool is subject to Facebook’s general Data Policy which is available at https://www.facebook.com/privacy/explanation;
- other social media buttons and tools – these are subject to the privacy policies of the applicable third party social media companies which are available on those companies’ websites.
Please note, we have no control over cookies that are placed by Google Analytics or third party social media companies. If you decide to enable these cookies, we recommend you check their privacy policies to ensure you are happy to accept these cookies (information on each provider is available by accessing your cookie preferences).
- Aardman Animations Limited, Gas Ferry Road, Bristol BS1 6UN; or
If you are not satisfied with the response you receive, you may escalate concerns to the applicable privacy regulator in your jurisdiction, which for the UK is the ICO (see section 17 above for their contact details).
Last modified: August 2022