Last updated August 2024.
This Privacy Policy is issued on behalf of Moonbug Entertainment Limited, company number 11197631 and data protection registration number ZA457059, with its registered office at 3rd Floor, Labs Upper Lock, 3-6 Water Lane, London, United Kingdom, NW1 8JZ (“Moonbug”, “us”, “we” or “our”). We are the data controller of any personal information we collect about you and we are responsible for the www.moonbug.com website operated by or on behalf of Moonbug (the “Website”).
We take your privacy seriously and are committed to protecting personal data. This Privacy Policy sets out how we process your personal data when you access our Website and sign up to our newsletters and fan clubs, take part in surveys, quizzes and competitions, check out our events and products offers, apply for open roles and connect with us for business purposes.
1. Introduction
This Privacy Policy explains who we are, why and how we process personal data collected through your use of the Website or otherwise through your interaction with us, what rights you have and how to get in touch with us. For ease of reference, we have divided this Privacy Policy into the following sections:
1. Introduction
2. Who do we collect personal information about?
3. Children
4. How is your personal information collected?
5. How do we obtain your consent?
6. What information do we collect?
7. How and why do we use your personal information?
8. Why do we share your personal information and who with?
9. Links to third party sites
10. How long do we keep your personal information for?
11. Security
12. International data transfers
13. Your rights
14. Contact details
Processing Activities Schedule – Details of how we use your personal data, and why.
It is important that you read this Privacy Policy together with any other notices that we may provide on our Website at or around the time that we collect or process personal data about you, including our Cookie Policy and our Website Terms of Use.
We will update this Privacy Policy from time to time to reflect changes to our business or changes in the law. When these changes involve our data collection practices, we will let you know by placing a notice on the Website. However, it is overall your responsibility to check this Privacy Policy regularly – for ease of reference, the top of this Privacy Policy indicates the date on which it was last updated.
2. Who do we collect personal information about?
Website visitors
If you browse our Website, we will collect and process your personal data in connection with your interaction with us and our Website.
People who contact us, for example with enquiries
If you contact us with an enquiry through our Website, submit a complaint through our Website or provide any feedback to us in our surveys and quizzes, we will collect and process your personal data in connection with your interaction with us and our Website.
Job applicants
If you apply for a job with us, whether through the Website or otherwise, we will collect and process your personal data in connection with your application.
3. Children
Our Website is designed for parents and guardians and is not intended for use by, or targeted at, minors under the age of 13). We anticipate only collecting data from parents and guardians. However, due to the nature of our organisation and the content we produce and provide, we may from time to time collect and process personal data relating to minors.
If we do collect the personal data of minors, we will comply with all applicable laws and regulations relating to the processing of the personal data of minors.
If you are under the age of 13, you may only use our Website and submit personal information if you have the consent of, and are supervised at all times by, a parent or guardian – you may not use our Website without your parent’s consent or without your parent’s or guardian’s supervision. If, as a parent or guardian, you believe we have collected personal data about your child, you may contact us to review the data and request that we cease processing data about your child.
4. How is your personal information collected?
Direct interactions with you
When you use and interact with our Website, you may provide us with certain personal data, such as when browsing the content on the Website, subscribing to newsletters or fan clubs, contacting us, taking part in online quizzes, entering competitions or reporting a problem with the Website. When you do these things we may collect, store and use the personal data that you disclose to us, in accordance with this Privacy Policy.
Automated technologies or interactions
We also collect certain Behavioural Data and Technical Data about you when you visit and interact with our Website through the use of technologies such as cookies, web beacons, pixels, SDKs, etc.
Information we collect from other sources
From time to time we may also obtain personal data from other sources, for example:
● Technical data from analytics providers and search information providers;
● Third parties that provide technical services to us so that we can provide our Website;
● Third party streaming services and platforms on which you can watch and stream our content.
● Third party retailers and platforms who fulfil your purchases of our merchandise and events.
5. How do we obtain your consent?
Where our use of your personal data requires consent, you can provide such consent at the time we collect your personal data following the instructions provided, or by informing us using the contact details set out in the “Contact details” section.
6. What information do we collect?
What is personal data?
Where this Privacy Policy refers to ‘personal data’, it is referring to data about you from which you could be identified. The types of personal data we collect from you may include:
● Identity Data, such as your first name and last name.
● Contact Data, such as your email address, telephone number, social media handle, address and job title.
● Recruitment Data, such as your Identity Data, Contact Data, work experience and professional profiles, details of your education, qualifications and employment history, any other personal data which appears in your curriculum vitae or application. For more information, please see our Privacy Notice for Recruitment
● Profile Data, including your interests and preferences; contact preferences; whether you have participated in any promotions or competitions; feedback and survey/quiz responses; the content of any messaging you send us through our contact details.
● Behavioural Data about your use of our Website. This includes your browsing actions and interactions with our Website, details about any merchandise or events you viewed or purchased through links on our Website, information about when your current or previous sessions started, information about links that you clicked and pages you viewed on our Website, page interaction information (such as details of your scrolling, clicks, and mouse-overs) and methods used to browse away from the page. We collect this information by using cookies and other similar technologies , and full details as to how we process and use cookies can be found in our Cookies Policy.
● Technical Data, such as your IP address, browser type and operating system, geolocation, and any other unique numbers assigned to a device.
● Marketing and Communications Data which includes your preferences in registering to our fan clubs and receiving newsletters and marketing communications from us and third parties.
We also collect, use and share Aggregated Data such as statistical or demographic data, solely for the purpose of improving our Website’ services and functionalities. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data is anonymised and will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific Website feature or functionality. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be processed in accordance with this Privacy Policy.
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions.
7. How and why do we use your personal information?
We use your personal data for the purposes set out in this section. If we wish to make any changes to these purposes, we will update this privacy notice.
We will only use your personal data when the law allows us to. Most commonly we will use personal data in the following circumstances:
● Where you have asked us to do so, or consented to us doing so;
● Where we need to do so in order to perform a contract we have entered into with you;
● Where it is necessary for our legitimate interests (or those of a third party) and your fundamental rights do not override those interests; and
● Where we need to comply with a legal or regulatory obligation.
We use your personal data for the following purposes:
● To provide you with our Website (including any interactive features) and personalise your experience when you do;
● To interact with any content you contribute to our Website;
● To interact with you on our social media pages;
● To give you access to our content (video and music) and to enable you to purchase our merchandise, or tickets to live performances;
● To operate our fan clubs;
● To run our quizzes or competitions;
● To answer any questions you may have about our Website or content, including responding to your feedback;
● To carry out insight and analysis;
● To carry out promotional and marketing practices on our Website and on other third party platforms; and
● To comply with our legal obligations or in connection with the administration of our business.
For more information about our processing activities, including the personal data that is processed in connection with those activities, please see our Processing Activities Schedule.
8. Why do we share your personal information and who with?
Depending on how and why you provide us with your personal data, we may share it in the following ways where appropriate:
● with any company within the Moonbug group of companies;
● with selected third parties who we subcontract to provide various services and/or aspects of our Website’s functionality;
● with analytics and search engine providers that assist us in the improvement and optimisation of our Website as described above;
● with third-party providers of products or services, whose websites you access by following links on our Website, such as video and music streaming platforms, or retailers of our merchandise and event ticketing (please see the “Service Providers” and “Links to third party sites” sections below);
● third party advertising partners and data matching services, to provide you with, and measure the effectiveness of, online personalised advertising and for other advertising-related activities both on and off our Website;
● auditors, lawyers, and other professional advisers, who advise and assist us in relation to the lawful and effective management of our organisation and Website, and in relation to any disputes we may become involved in;
● law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation;
● if we were to sell, transfer, buy or merge any parts of our business or assets, then personal data held by us about you may be one of the transferred assets and the new owners may use your personal data in the same way as set out in this Privacy Policy;
● if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or if we are asked to provide your details to a lawful authority in order to aid in a criminal or legal investigation; and
● in order to enforce or apply any of our Website’s Terms of Use; or to protect the rights, property, or safety of our business, our customers, our staff or others. This includes exchanging information with other companies and organisations for the purposes of online safety, fraud protection and the protection of our intellectual property where appropriate.
Service Providers
Our service providers provide us with a variety of administrative, statistical, and technical services. We will only provide our service providers with the minimum amount of personal data they need to fulfil the services we request, and we endeavour to ensure that they protect this data and do not use it for any other purpose. We take these relationships seriously and aim to ensure that all of our service providers who process personal data on our behalf act on our written instructions, setting out their commitment to comply with applicable data protection laws and to assist us with our duties in respect of your exercise of your applicable data subject rights.
9. Links to third party sites
This Privacy Policy only applies to personal data processed by us through your use of our Website and/or in connection with our business operations. However, from time to time, our Website may contain links to third-party websites and services, such as video or music streaming platforms, social media platforms, or retailers selling our merchandise and event tickets. We have no control over these websites and services and this Privacy Policy does not apply to your interaction with these third parties.
Where we provide links to third party websites, plug-ins and applications on the Website that are not affiliated with us (for example YouTube for viewing content and third parties for gaming), such third-party sites are out of our control and are not covered by this Privacy Policy, even if you do not leave our Website.
If you access a third-party site using the links provided, the operators of these sites may collect personal data from you that could be used by them, in accordance with their own privacy policies. Please check these policies before you submit any personal data to those sites.
10. Security
Moonbug takes the protection of personal data seriously. We have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed, including use of secure servers.
In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data in accordance with our instructions and they are subject to a duty of confidentiality.
Despite these precautions, and although we will do our best to protect your personal data, Moonbug cannot guarantee the security of information transmitted over the internet or that unauthorised persons will not obtain access to personal data. In the event of an actual or suspected data breach, we have put in place procedures to deal with this and will notify you and any applicable regulator of a breach where required to do so.
11. International data transfers
Please note that as your personal data is shared within the Moonbug group of companies, this will involve transferring it outside of the United Kingdom (UK) or European Economic Area (EEA) including exchanging data between the UK, EEA and the USA. Some of our external service providers may be also based outside of the UK or EEA. These service providers may work for us or for one of our suppliers and may be engaged in, among other things, the fulfilment of your request for information and the provision of services.
Where we transfer your data to a service provider that is outside of the UK or EEA (as relevant) we seek to ensure that appropriate safeguards are in place to make sure that your personal data is held securely and that your rights as a data subject are upheld. Transfers of personal data are made:
● to a country recognised by the appropriate body as providing an adequate level of protection; or
● if to a country which does not offer adequate protection: these transfers have been governed by approved standard data protection clauses or by implementing other appropriate safeguards to provide adequate protection.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.
12. How long do we keep your personal information for?
We will hold your personal information on our systems only for as long as required to fulfil the purposes we collected it for, including to provide you with the services you have requested and for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. In some circumstances you can ask us to delete your personal data: see ‘Your rights’ below for further information. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you for research, demographic, analytical or statistical purposes, in which case we may use this information indefinitely without further notice to you.
13. Your rights
As a data subject, you have a number of rights in relation to your personal data. Below, we have described the various rights that you have, as well as how you can exercise them. These rights can be exercised at any time by contacting us – see the “Contact Details” section below.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee:
(i) if your request is clearly unfounded, repetitive or excessive; or
(ii) if your request requires us to deliver any data under a ‘non-standard’ format for which we may charge any third-party costs we incur as a result of fulfilling your request. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Your right to request access
If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). You may have heard of this right being described as a “subject access request”. If you require additional copies, we may charge a reasonable fee for producing those additional copies.
Please note that this right entitles you to receive a copy of the personal data that we hold about you. It is not a right to request personal data about other people, or a right to request specific documents from us that do not relate to your personal data.
Your right to rectification and erasure
You may, at any time, request that we correct personal data that we hold about you which you believe is incorrect or inaccurate. You may also ask us to erase personal data if you do not believe that we need to continue retaining it (you may have heard of this right described as the “right to be forgotten”).
Please note that we may ask you to verify any new data that you provide to us and may take our own steps to check that the new data you have supplied us with is right. Further, we are not always obliged to erase personal data when asked to do so; if for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to erase we will tell you what that reason is at the time we respond to the request.
Your right to restrict processing
Where we process your personal data on the basis of a legitimate interest, you are entitled to ask us to stop processing it if you feel that our continuing to do so impacts on your fundamental rights and freedoms or if you feel that those legitimate interests are not valid.
You may also ask us to stop processing your personal data: (a) if you dispute the accuracy of that personal data and want us to verify that data’s accuracy; (b) where it has been established that our use of the data is unlawful but you do not want us to erase it; (c) where we no longer need to process your personal data (and would otherwise dispose of it) but you wish for us to continue storing it in order to enable you to establish, exercise or defend legal claims.
Please note that if for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to stop processing, we will explain that reason, either at the time we first respond to the request or after we have had the opportunity to consider and investigate it.
Your right to portability
Under certain circumstances, where you wish to transfer certain personal data that we hold about you, which is processed by automated means, to a third party, you may write to us and ask us to provide it to you in a commonly used machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Your right to object to processing
You may object to processing of your personal data where we rely on legitimate interest (or those of a third party) for processing that personal data and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. We will comply with your request unless we have a compelling overriding legitimate interest for processing or we need to continue processing your personal data to establish, exercise or defend a legal claim.
Your right to withdraw consent
Where our processing of your data is on the basis of your consent, you can withdraw this consent at any time. This would not affect the lawfulness of the processing based on consent prior to the withdrawal. If you withdraw your consent, we may not be able to provide certain content or services to you. We will advise you if this is the case at the time you withdraw your consent.
Your rights in relation to automated decision-making and profiling
You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for the entering into, or the performance of, a contract between you and us
Your right to lodge a complaint to the supervisory authority
If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, please contact us using the contact details provided in the “Contact details” section below. You can also report any issues or concerns to a regulatory or supervisory authority in the state of your residence or the place of the alleged infringement.
As we are incorporated in the United Kingdom, our regulatory authority is the Information Commissioner’s Office (“ICO”). Contact details for the ICO can be found on its website at https://ico.org.uk.
You can find a list of contact details for all EU supervisory authorities at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
Right to Opt Out of Sale of Personal Data (California users)
A consumer (as defined in the California Consumer Privacy Act 2018 (or “CCPA”)) has the right to request disclosure of personal data about them sold by the party that sold it and the right to opt out of the sale of that consumer’s personal data by contacting the party that sold or intended to sell it.
Shine the Light (California users)
California law provides that you have the right to submit a request to us at our designated email address set out in the “Contact Us” section below and receive the following information: (i) the categories of information disclosed to third parties for the third parties’ direct marketing purposes during the immediately preceding calendar year; and (ii) the names and addresses of third parties that received such information or, if the nature of their business cannot reasonably be determined from the name, then examples of the products or services marketed. Please put “Shine the Light Request” in the subject line of your email.
Exercising your rights
When you write to us making a request to exercise your rights, we may ask for copies of relevant ID documents to help us to verify your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
It will help us to process your request if you clearly state which right you wish to exercise, what personal data it is that is of particular concern to you and, where relevant, why it is that you are exercising it. The clearer and more specific the request, the faster and more efficiently we can deal with that request. If insufficient information is provided, then there may be a delay in actioning the request until additional information is provided (and we will tell you where this is the case).
Please note that all the rights mentioned in this section are not absolute and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply. For example, we may refuse to comply with a request if it is manifestly unfounded or excessive.
14. Contact Us
We have appointed a Data Protection Officer who is responsible for overseeing questions in relation to this Privacy Policy. If you have any queries regarding this Privacy Policy and/or if you wish to exercise any of your rights as set out above, please contact us by emailing privacy@moonbug.com and marking it for the attention of our Data Protection Officer. Our postal address is 3rd Floor, Labs Upper Lock, 3-6 Water Lane, London, United Kingdom, NW1 8JZ if you wish to mail your query to us.
Whilst we would prefer that you direct any complaints or queries you have to us first, you may also lodge a complaint to the supervisory authority applicable in your country about the way we process your personal data. In the UK, this is the Information Commissioner’s Office (ICO). The ICO is our designated data controller.
Processing Activities Schedule:
Details of how we use your personal data, and why
1. Using the Moonbug Website
If you browse our Website
What personal data we collect
Behavioural Data and Technical Data.
How and why do we use the personal data?
We do this to help us understand how you are using and navigating our Website, so that we can better understand which parts of our Website are more or less popular, and improve the structure and navigation of our Website.
Our lawful basis
It is in our legitimate interest to use personal data in such a way to ensure that we provide access to our Website in a secure and effective way and so that we can make improvements to our Website.
To personalise your experience on our Website
What personal data we collect
Behavioural Data, Technical Data, and certain Profile Data, including responses you give when completing quizzes that we offer on our Website.
How and why do we use the personal data?
We want to ensure that your Website experience is as tailored as possible so that you only see content that interests you. In order to do this we will use your data to work out what is likely to be of most interest to you and, personalise your Website experience accordingly.