Want to read our Cookie Policy?
Jellycat Data Privacy Notice
Our promise to you
Effective date: 14 May 2024
We always aim to provide the best possible service at all times to you, our customer, and in doing so, we need to collect certain categories of personal data to provide our services. We take data protection very seriously. Our privacy policy, set out below in detail, explains exactly how we handle and process personal data.
1. Who is responsible for your data
This policy governs any kind of processing of personally identifiable information about natural persons (“personal data”) in connection with the provision of Jellycat products or services, by Jellycat Inc. and all entities within the corporate group headed by its ultimate parent undertaking (the “Jellycat Group”). This policy applies to our processing of personal data collected through any means, actively as well as passively, online (including through your use of our websites (collectively “Platforms”), as well as offline, such as at our events. For the purpose of the UK/EU data protection legislation, the data controllers responsible for processing your personal information are Jellycat Limited and Jellycat Inc.
This Privacy Policy provides you with information on how Jellycat Limited collects and processes your personal data through your use of any of our and the products and services we offer (“Products and Services”).
Jellycat Limited is registered on the ICO Data Protection Register; Registration Number ZA003379.
Additional disclosures apply if you live in the following regions (please see the corresponding region-specific section below):
• California
• Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia
• Nevada
2. How to contact us
If you have any questions about this Privacy Policy, you may contact our Data Protection Officer by email at [email protected] or in writing to:
Data Protection Officer
Jellycat Limited
Westworks Building, 195 Wood Lane
London, W12 7FQ
United Kingdom
3. Updates to our Privacy Policy
We may need to update our Privacy Policy from time to time. If we do, we will notify you of any significant changes or proposed changes to our use of your personal data, or to comply with changes in applicable law or regulation requirements. We may notify you by email of any significant changes to this Privacy Policy, but we encourage you to review this Privacy Policy periodically to keep up to date on how we use your personal data.
We hope this Privacy Policy has been helpful in setting out the way we handle your personal data and your rights to control it.
4. What data do we collect about you?
We may collect and process the following personal data about you:
• Identity and Account Data, Characteristics, or Demographics, including first name, last name, username, password or similar identifier, title and gender, job title and organisation you represent.
• Contact Identifiers, including billing address, delivery address, email address and telephone numbers.
• Financial, Payment, and Transaction Data, including bank account and payment card details as well as details about payments to and from you and other details of services you have purchased from us.
• Behavioural Data, including data relating to your behaviours, interests and preferences, including data collected as a result of your browsing activity and/or interaction with our Platforms, Products and Services and/or our emails which is obtained through the use of cookies, pixel tags and other similar technologies; information about when your current or previous sessions started.
• Technical and Usage Data, including (i) internet protocol (IP) address; (ii) browser type and version; browser plugins; (iii) device name (e.g. “Apple iPhone” or “Samsung Galaxy” or any other name that you have given your device); (iv) operating system and version; (v) system language; (vi) general device data, such as voice and regional settings (including non-precise location data); and (vii) date and time of use.
• Profile Data, including information about your interests and preferences from your use of our services (including events you have attended), demographic data information you have provided to us within your account (e.g. any personal description and/or photographs you may provide or take), enquiries about our services or other feedback and survey responses or other information you may provide, as well as interferences we may make about your interests and preferences based on other Behavioural Data or Marketing Communications Data provided.
• Marketing and Communications Data, including your preferences in receiving marketing from us and our third parties and your communication preferences.
• Professional, Employment, or Education-Related Data, including date of birth; gender; country of residence; nationality; details of your eligibility to work (including documents and information that we may collect to verify this); your work preferences (including areas and dates where you are available for work); skills, qualifications, training and work history; photographs of you; any personal data which appears in your curriculum vitae or application; and any personal data that you volunteer during an interview or your interactions with us.
• Information We Infer. We infer new information from other information we collect, including to generate information about your likely preferences or other characteristics.
5. How we collect your data:
We use different methods to collect data from and about you including through:
• Direct interactions. You may give us your personal data directly, for example, when you purchase products on our Platforms, contact us with enquiries, complete forms on our websites, interact with us via social media, subscribe to receive our marketing communications, attend our events, or provide feedback to us.
• Automated technologies or interactions. As you interact with our Platforms, we may automatically collect Behavioural Data or Technical and Usage Data. We collect typically collect this personal data by using cookies and other similar technologies. Please see our Cookie Policy below for further details.
• Third party sources. We may receive personal data about you from third parties. Such third parties may include analytics providers, our third-party resellers, social media platforms, business partners, Data Brokers, third party directories and third parties that provide technical services to us so that we can provide our Platforms, Products and Services.
• Publicly available sources. From time to time, we may collect personal data about you (Identity Data, Contact Data or Profile Data) that is contained in publicly available sources (including open source data sets or media reports) or that you or a third party may otherwise make publicly available (for example through speeches at events or publishing articles or other news stories or posts on social media platforms).
6. Who we collect personal data about
We collect and process personal data from the following people:
| Platform visitors | If you use our Platforms or register an account on our Platforms, we will collect and process your personal data in connection with your interaction with us and our Platforms. |
| Consumers | If you buy our Products and Services or participate in our promotions or competitions, we may collect and process your personal data in connection with the supply of goods or services to you. |
| People who contact us with enquiries | If you contact us with an enquiry through our Platforms, submit a complaint through our Platforms or provide any feedback to us in our surveys and feedback forms, we will collect and process your personal data in connection with your interaction with us and our Platforms. |
| People who work for our consumers and suppliers | If you work for one of our consumers or suppliers and have responsibility for placing orders with us, administering your organisation’s account with us or handling our orders or our account with your organisation, we will process your personal data in connection with your organisation’s relationship with us. |
| Visitors to our physical locations | If you attend one of our physical stores, offices or other locations, we may process personal data that you volunteer in connection with your visit and any enquiries you make. For example, you may volunteer personal data when asking us to assist you in finding accommodation or transportation suitable for your needs, or when signing in as a guest. CCTV footage may also be collected for security purposes. |
| Event attendees | If you attend one of our events, we may process personal data about you in connection with your attendance at the event. For example, we may ask you to complete a registration or feedback form, or other document relating to the event. |
| Job applicants | If you apply for a job with us, whether through the Platforms or otherwise, we will collect and process your personal data in connection with your application. Data collected is also subject to the Data & Privacy Policy specific to applications and you can read this at https://careers.jellycat.com/data-privacy |
| Social media influencers | If you receive Jellycat products from us and display such products on your social media platform or just display our products with no prompt from us, we may process your personal data in connection with your interactions with us and such products. |
7. How we use your personal data
We will only use your personal data when the law allows us to. We use your personal data for the purposes set out in this section. If we wish to make any changes to these purposes, or if we wish to use your personal data for any purpose that is not listed in this section, we will notify you using the contact details we hold for you.
The main ways we use your data are:
• to provide you with our Platforms, Products and Services;
• to deal with customer services and enquiries, carry out surveys and obtain feedback;
• to carry out insight and analysis, such as analytics and improvement;
• to personalize your shopping experience using automated decisionmaking;
• to carry out our promotional, marketing, and advertising practices; and
• for business administration (including recruitment), security and enforcement, and legal compliance purposes.
In specific situations, we collect and process your data with your consent, for example, when you tick a box or register your email to receive email newsletters. You can withdraw this consent at any time, for example, by clicking on the unsubscribe link. In certain circumstances, we need your personal data to comply with our contractual obligations, for example, if you order an item for home delivery, we will collect your address details to deliver your purchase and pass them to our courier. In exceptional circumstances, if the law requires us to, we may need to pass data for law enforcement, for example, details of people involved in online fraud.
To conduct our advertising and marketing, we work with agencies, ad networks, technology providers, and other third parties to place ads about our products and services on other websites and services. For example, we may place ads through Google that you may view on their platforms as well as on other websites and services. As part of this process, we incorporate tracking technologies into our website as well as into our ads displayed on other websites and services. Some of these tracking technologies may track your activities over time and across non-affiliated services and obtain or infer information about you for purposes of showing you relevant advertising based on your preferences and interests (“targeted advertising”). We may also use audience matching services (which is a type of targeted advertising) to reach people (or people similar to people) who have visited our website or are identified in one or more of our databases (“matched ads”). This is done by us providing a list of hashed email addresses to a third party or incorporating a pixel from a third party into our website, and the third party matching common factors between our data and their data.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
Please see “Details of Processing” section below for more details on the ways we use your data and the legal bases on which we rely.
8. Disclosure of your personal data
When processing your personal data, we may need to disclose it with third parties (including other entities within our group of companies), as set out in the table below. This list is non-exhaustive and there may be circumstances where we need to disclose personal data with other third parties.
| Third-party suppliers | We disclose personal data with third parties who support us in providing our website and help provide, run and manage our internal IT systems. We disclose personal data with specialist suppliers who assist us in managing our marketing database and sending out our post and email marketing communications and account-related communications (including customer surveys and feedback requests). We also disclose your personal data with third-party service providers to assist us with insight analytics. These providers are described in our Cookie Policy. |
| Payment providers and banks |
We disclose personal data with third parties who assist us with the processing of payments and refunds. |
| Delivery and courier companies |
We disclose personal data with suppliers who assist us in the delivery of our Products and Services to our consumers. |
| Advertising partners | We disclose personal data with third party advertising partners, including those set out in our Cookie Policy when you use our Platforms to facilitate and measure any online advertising we may carry out. |
| Third-party suppliers who assist us in administering our promotions | We disclose personal data with specialist suppliers who assist us in administering our prize draws, prize competitions and other promotions. |
| Event partners and suppliers |
When we run events, we will disclose your personal data with third-party service providers that are assisting us with the operation and administration of that event. If we are running an event in partnership with other organisations, we will disclose your personal data with such organisations for use in relation to the event. |
| Recruitment agencies and related organisations |
We disclose personal data with external recruiters, third-party providers that undertake background checks on our behalf, third parties who assist us with the recruitment process (including Team Tailor) and other entities within our group of companies. |
| Auditors, lawyers, accountants and other professional advisers |
We disclose personal data with professional services firms who advise and assist us in relation to the lawful and effective management of our organisation and in relation to any disputes we may become involved in. |
| Law enforcement or other government and regulatory agencies and bodies |
We disclose personal data with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation. |
| Group companies |
When relevant, your personal data may be disclosed among the business units and entities inside the Jellycat Group. |
| Other third parties | Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, or to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation. |
9. Personal Data of Minors
Our website is not intended for use by, or targeted at, minors (individuals under the age of 18) and we do not knowingly collect personal data of minors. However, due to the nature of our organisation and the Products and Services we provide, we may from time to time collect and process personal data relating to minors. If we do collect personal data of minors, we will comply with all applicable laws and regulations relating to the processing of personal data of minors.
If you are under the age of 18, you must not use our Platforms or purchase Products and Services from us and you must not provide us with any personal information. If we discover that we are holding the personal data of a minor, we will delete that information as soon as possible. If you are a parent or guardian, please supervise your child’s use of our Platforms. Please contact us if you have reason to believe that a minor may have submitted personal data to us (see the “How to contact us” section above).
10. Security of your personal data
We are committed to taking appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage to personal data. For example, our handling of your personal data is controlled by documented policies and procedures, including strict physical and logical access control, security back-up, failover, anti-malware protection, monitoring and vulnerability detection mechanisms. Furthermore, Jellycat is a PCI DSS compliant organisation. This means that we adhere to high security standards in order to protect your payment card details when you are sending us this information.
11. Your legal rights as a data subject
For users in all areas, we provide a variety of ways for you to exercise choice, as described below.
Communications.
You can opt-out of receiving certain communications from us as follows:
• Emails. To stop receiving newsletters and marketing emails, change your communication preferences through your account settings, follow the unsubscribe instructions near the bottom of such emails. Please note that you cannot opt out of transactional messages.
• SMS. To stop receiving SMS messages, text “STOP” in response to any text message you receive from us.
Browser and Device Controls.
• Preference signals. Your browser or extension may allow you to automatically transmit Do Not Track and other preference signals. Except as required by law, we do not respond to preference signals.
• Third party opt-out tools. Some third parties we work with offer their own opt-out tools related to information collected through cookies and pixels. To opt out of your information being used by Google Analytics, please visit https://tools.google.com/dlpage/gaoptout. We are not responsible for the effectiveness of any third party opt-out tools.
• Industry opt-out tools for targeted advertising. Some of the third parties we work with participate in programs that allow you to opt-out of receiving targeted advertising from participants. To opt-out of receiving targeted advertising from participants of the Digital Advertising Alliance (“DAA”) on your browser, visit https://www.aboutads.info/choices. To opt-out of receiving targeted advertising from participants of the Network Advertising Initiative (“NAI”) on your browser, visit https://www.networkadvertising.org/choices/. If you choose to opt-out of targeted advertising through these links, you should no longer see targeted advertising from the selected participants on the browser or device from which you opted-out, but the opt-out does not mean that the participants will not process your information for targeted advertising purposes or that you will not receive any advertising. We are not responsible for the effectiveness of any third party opt-out tools.
To the extent our processing of your personal data is caught by the requirements of the GDPR/UK GDPR, users in the EU or UK have certain rights in relation to the personal data we hold about you. If you would like to exercise any of these rights, please contact us using the details set out in the “How to Contact Us” section above.
Users in the EU or UK have the right to:
(i) Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
(ii) Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
(iii) Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request for example we need to maintain your transactional data for our legal obligations to the local tax and revenue authorities.
(iv) Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.
(v) Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
i. If you want us to establish the data's accuracy.
ii. Where our use of the data is unlawful but you do not want us to erase it.
iii. Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
iv. You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
(vi) Be excluded from automated decision making. Jellycat have a number of different customer and consumer types who we personalise experiences for. These include self-purchasers, gift buyers, professional collectors, stockist owners and more. Our personalisation of your experience is achieved through automating profiling based on purchase behaviours and information shared. You can select your preference at our contact preference centre, but opting out of this, you will not be able to receive any personalised inspiration or communications.
(vii) Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
(viii) Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
(ix) To complain. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office by telephone on 0303 123 1113 or online at www.ico.org.uk/concerns. To the extent you are located in another jurisdiction, you also have the right to lodge a complaint with the relevant data protection authority in that jurisdiction.
If you are in California, Colorado, Connecticut, Montana, Oregon, Texas, Utah, Virginia, or Nevada, please see the corresponding region-specific section below for information about your rights regarding your personal data.
12. Retention of personal data
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. At the end of the retention period, your data will either be deleted completely, or anonymised, so that it can be used in a non-identifiable way.
In particular, when you place an order with us, we will ordinarily keep the personal data you give us for 5 years so we can comply with our legal and contractual obligations relating to the sale of goods. For nursery products we will hold the data for 10 years, and if your order included a warranty, the associated personal data will be kept until the end of the warranty period.
13. Region-specific provisions
United Kingdom/European Economic Area (EEA)
Data transfers outside the United Kingdom/EEA
Where necessary in order to provide our Platforms and our Products and Services, your personal data may be accessed by and processed outside the UK and/or EEA - including by staff operating outside the UK/EEA who work for us or for one of our suppliers or agents (this includes staff engaged in, among other things, the fulfilment of your booking, ground handlers, and the provision of support services).
Non-EEA countries do not have the same data protection laws as the UK and the EEA. In particular, non-UK/EEA countries may not provide the same degree of protection for your personal data, may not give you the same rights in relation to your personal data and may not have a data protection supervisory authority to help you if you have any concerns about the processing of your personal data. For that reason, if we transfer your personal data outside the UK and/or EEA, we will take reasonable steps to ensure the security of your personal data in accordance with applicable data protection laws. In particular, where required by applicable law, we will implement at least one of the safeguards set out below. Please contact us if you would like further information on the specific mechanisms used by us when transferring your personal data outside the UK or the EEA.
| Adequacy decisions | We may transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or the UK Government (as applicable). |
| Standard contractual clauses | Where we use certain service providers, we may use specific standard contractual clauses approved by the European Commission and/or the UK Government which give personal data the same protection it has in Europe and/or the UK. |
California
This section applies solely to California “consumers” and addresses personal information we collect online and offline. This section of the privacy Policy does not apply to Jellycat personnel.
This section uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations (the “CCPA”).
Notice at Collection
The categories of personal information we have collected in the past 12 months and the categories sources from which the personal information is collected are set out in the ‘What data do we collect about you?’ section above.
Purpose
The specific business and commercial purposes for collecting and using personal information are set out in the “How we use your personal data” section above.
Sources of Personal Information
We may obtain (and may have obtained during the 12-month period prior to the date of this privacy Policy), personal information about you from the categories of sources set out in the “How we collect your data” section above.
Disclosure of Personal Information
The categories of persons to whom personal information is disclosed, including service providers for business purposes, is set out in the “Disclosure of your personal data” section above. We disclose the categories of personal information listed in the “What data do we collect about ?” section above to service providers for business purposes
Sharing of Personal Information
Some of our disclosures of personal information may be considered a “sale” or “share” as those terms are defined under California law. A “sale” is broadly defined to include a disclosure for something of value, and a “share” is broadly defined to include a disclosure for cross-context behavioral advertising. We collect, sell, or share the following categories of personal information for commercial purposes: contact identifiers, characteristics or demographics, commercial or transactions information, content, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties to whom we sell or share your personal information include, where applicable, vendors and other parties involved in cross-context behavioral advertising. We do not knowingly sell or share the personal information of minors under 16 years old who are California residents.
Sensitive Data
Some of the personal information we collect may be considered sensitive personal information under California law. We collect, use, and disclose sensitive personal information only for the permissible business purposes for sensitive personal information under the CPRA or without the purpose of inferring characteristics about consumers. We do not sell or share sensitive personal information.
Retention
The criteria used to determine the period of time we retain your personal information is set out in the “Retention of personal data” section above.
California Consumer Privacy Rights
You have rights to exercise choice over your personal information as follows:
• Verifiable Requests: You have the right to:
o Know what personal information we have collected about you, specifically have the right to know the categories of sources from which personal information was collected, the business or commercial purposes for collecting, selling, or sharing personal information, the categories of personal information that we sold, shared, or disclosed for a business purpose, the categories of third parties to whom we disclosed personal information, and the specific pieces of personal information we have collected about you;
o Correct inaccurate personal information we maintain about you; and
o Delete personal information that we have collected from you.
To exercise any of these rights, please email us at [email protected]. We will confirm receipt of and respond to your request consistent with applicable law. To verify your identity, we may require you to confirm receipt of an email sent to an email address that matches our records, provide us with details relating to your history with us, or provide additional information. If we are unable to verify your identity, we may deny your request in accordance with applicable law.
• Sales and Shares: You have the right to opt-out of us selling or sharing your personal information to third parties. To exercise this right, click here to manage your technology preferences via the link “Do not sell or share my information” in the website footer. Please note that when you opt-out through either of the above methods we do not know who you are within our systems, and your opt-out will apply only to information collected through tracking technologies on the specific browser from which you opt-out. If you delete or reset your cookies, or use a different browser or device, you will need to reconfigure your settings.
• Shine the Light: If you are a customer, you may request (i) a list of the categories of personal information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To make a request, please write us at the email or postal address set out in the “Contact Us” section and specify that you are making a “California Shine the Light Request.”
Your rights to exercise choice over your personal information are subject to exceptions and our retention practices. You have the right not to be discriminated against for exercising any of your rights. To the extent permitted by law, rights requests must be exercised through the applicable designated method listed above. You may make a rights request using an authorized agent. Except for rights requests made by opt-out preference signal, we will require written and signed proof of the agent’s permission to do so and we may verify your identity directly with you.
Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia
Data Practices
For residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia, our practices regarding the collection, use, disclosure, and retention of your personal data are set out in the main Privacy Policy above.
Some of our disclosures of personal data may be considered a “sale” under applicable law, which may include a disclosure for something of value. We do not process personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.
Some of the personal data we collect may be considered sensitive personal data under applicable. We collect sensitive personal data with your consent.
Requests
You have rights to exercise choice over your personal data as follows:
• Verifiable Requests: You have the right to:
o Confirm whether or not we are processing your personal data;
o Access your personal data;
o Correct inaccuracies in your personal data;
o Delete your personal data; and
o Obtain a copy of your personal data that you previously provided to us in a portable and readily usable format
If you are an Oregon resident, you also have the right to:
o Confirm the categories of personal data we have processed
o Receive a list of the specific third parties to which we have disclosed personal data
To exercise any of these rights, please email us at [email protected]. We will confirm receipt of and respond to your request consistent with applicable law. To verify your identity, we may require you to confirm receipt of an email sent to an email address that matches our records, provide us with details relating to your history with us, or provide additional information. If we are unable to verify your identity, we may deny your request in accordance with applicable law.
• Sales and Targeted Advertising: You have the right to opt-out of us selling your personal data or processing your personal data for purposes of targeted advertising. To exercise this right, click here to manage your technology preferences via the link “Do not sell or share my information” in the website footer. Please note that when you opt-out through the above method we do not know who you are within our systems, and your opt-out will apply only to information collected through tracking technologies on the specific browser from which you opt-out. If you delete or reset your cookies, or use a different browser or device, you will need to reconfigure your settings.
Your rights to exercise choice over your personal data are subject to exceptions and our retention practices. You have the right not to be discriminated against for exercising any of your rights. To the extent permitted by law, rights requests must be exercised through the applicable designated method listed above. You may make a rights request using an authorized agent. Except for rights requests made by opt-out preference signal, we will require written and signed proof of the agent’s permission to do so and we may verify your identity directly with you.
You have the right to appeal our decision in response to your request. To appeal, please write us at the email or postal address set out in the “Contact Us” section and specify what you wish to appeal. We will review and respond to your appeal in accordance with applicable law. If we deny your appeal, you may submit a complaint to your Attorney General as follows:
• For Colorado residents: https://coag.gov/file-complaint/
• For Connecticut residents: https://www.dir.ct.gov/ag/complaint/
• For Montana residents: https://dojmt.gov/consumer/
• For Oregon residents: https://justice.oregon.gov/consumercomplaints/
• For Texas residents: https://oag.my.salesforce-sites.com/CPDOnlineForm
• For Utah residents: https://attorneygeneral.utah.gov/contact/complaint-form/
• For Virginia residents: https://www.oag.state.va.us/consumercomplaintform
Nevada
Nevada residents have the right to opt-out of the sale of their information. To make a request, please write us at the email or postal address set out in the “Contact Us” section and specify that you are making a “Nevada Opt Out of Sale Request.”
14. Details of our Data Processing
• To provide you with our Platforms, Products and Services
| Activity | What Data | Why? | Lawful Basis |
| Platform browsing |
Behavioural Data |
To help us understand how you are using and navigating our Platforms. We do this so that we can better understand which parts of our Platforms are more or less popular and to improve the structure and navigation of our Platforms. | Necessary for our legitimate interest to enable us to provide our Platforms in secure and effective way and make improvements to the Platforms. |
| Platform support, maintenance and security |
Identity Data |
To administer and protect our business and the Platform (including troubleshooting, dealing with in app error messages data analysis, testing, system maintenance, support, reporting and hosting of data).
|
Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise).
|
| Set up and manage user accounts |
Identity Data |
To set up and manage user accounts and keep them in working order. |
Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise).
|
| Fulfilment of our Products and Services |
Identity Data |
To enable us to register you as a new customer (as an individual or corporate customer).
|
Necessary to perform our obligations in accordance with any contract that we may have with you.
|
| Social media interaction |
Behavioural Data |
To gain insight into your interaction with our social media pages such as on Facebook or Instagram (including interacting with any ‘like’ or similar embedded features on our Platforms or social media accounts). | Legitimate interest to ensure that we provide the Platforms in an effective way and to promote our Platforms and Services via social media. |
| Manage our relationship with you |
Identity Data |
To manage our relationship with you, for example in order to: a) notify you about changes to our terms or privacy Policy; b) notify you about changes to event dates, locations or related services; and c) communicate with our clients and potential clients on administrative matters. |
Performance of a contract with you.
|
• To deal with customer services and enquiries, carry out surveys and obtain feedback
| Activity | What Data | Why? | Lawful Basis |
| Product and Services return |
Identity Data |
To assist with your return or cancellation. |
Necessary to perform our obligations in accordance with any contract that we may have with you for the Products and Services.
|
| Customer services and enquiries |
Identity Data |
To manage and respond to your enquiry. | Necessary for our legitimate interest so that we can help you with your enquiry, provide a good standard of service and improve our customer services. |
| Survey and feedback |
Identity Data |
To help us to monitor and improve our Platforms, Products and Services.
|
Necessary for our legitimate interest: a) so that we can improve our products and services and provide them in an effective way; and b) to study how consumers use our products/services, to develop them and grow our business. |
• To carry out insight and analysis
| Activity | What Data | Why? | Lawful Basis |
| Insight & analysis (including through cookies and other similar tracking technologies) |
Behaviourial Data |
To analyse how you use or interact with, and the effectiveness of, our Platform and our Products and Services and other communications which helps us to improve our Platforms, our Products and Services and the effectiveness of our communications, as well as to remember your preferences.
|
Where your data is collected through the use of non- essential cookies, we rely on consent to collect your personal data and for the onward processing purpose.
|
| Use of third party Data Brokers |
Identity Data |
To enrich your existing profile that we have about you.
|
Necessary for our legitimate interests in order to develop our Products and Services and grow our business. |
• To carry out our promotional and marketing practices
| Activity | What Data | Why? | Lawful Basis |
| Marketing |
Identity Data |
To send you marketing communications via email, post or SMS about products and services where we have a lawful basis to do so.
|
Consent
|
| Online personalised advertising |
Behaviourial Data |
To provide you with, and analyse the effectiveness of, personalised ads when you visit other websites and/or use other services.
|
Consent
|
| Social media advertising | Contact Data | We may share your data with third party providers of social media platforms, such as Instagram, TikTok and other similar platforms (“Social Media Platforms”) to “match” your data with the data of their registered users on their Social Media Platforms in order to serve relevant advertising on you. | Necessary for our legitimate interest in order to promote our events and brand. Please note you can opt out of this sharing at any time using our contact details provided in “How to Contact Us” section, or clicking the “Do not sell or share my information” link in our website footer. You may also opt out of receiving relevant advertising by amending your preferences on the relevant Social Media Platform. |
| Prize draws, prize competitions and other promotions |
Identity Data |
To administer prize draws, prize competitions and other promotions on our Platforms and/or on our social media accounts. |
Necessary to perform our obligations in accordance with any contract that we may have with you (e.g. the promotion terms and conditions).
|
| Social media influencer promotions |
Identity Data |
To communicate and send you Jellycat stock where you agree to display Jellycat products on your social media platform or to communicate with you if you decide to display our stock on your social platform more generally. | Consent
|
| Re-sharing your social media content | Identity Data | To reshare any social media content created by you that you have made publicly available on your channels or otherwise via our respective social media channels. | Consent
|
| Hosting and managing events | Identity Data Contact Data Profile Data |
To communicate with you about events where you have specifically requested information about such events.
|
Necessary to perform our obligations in accordance with any contract that we may have with you where you have signed up to attend an event.
|
• For business administration (including recruitment) and legal compliance purposes
| Activity | What Data | Why? | Lawful Basis |
| Business administration and legal compliance | All data mentioned in “What data do we collect” section above |
To comply with our legal obligations.
|
Necessary for our legitimate interests (in order to operate our business in an effective manner).
|
| Receipt of products and services from our suppliers | Identity Data Contact Data Financial and Transaction Data |
To manage our relationship with suppliers.
|
Performance of a contract with you.
|
| Recruitment |
Identity Data |
To assess your suitability for any of our positions that you apply for.
|
Performance (or entering into) of a contract with you.
|
COOKIE POLICY
Last Updated: 14 May 2024
WHAT IS THIS POLICY ABOUT?
This Cookie Policy explains how we use cookies and other similar technologies on Jellycat’s website at https://www.us.jellycat.com/ (“Site”), or in our marketing emails (“Service”). It is designed to assist you in making informed decisions when using our Service. Please take a moment to read and understand this Cookie Policy. This Cookie Policy should also be read in conjunction with our Privacy Policy and our Terms of Use.
1. WHAT ARE COOKIES OR SIMILAR TECHNOLOGIES?
Cookies are text files containing small amounts of information which are downloaded to your browser and accessed by the website operator or third parties when you visit the Site or another website that recognises the cookie.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences, and generally improving the user experience. When you visit a website, the website will request to store cookies on your device in order to remember information about you, such as your language preference or login information. Other information gathered through cookies may include the date and time of visits and how you are using the Service.
We also use similar technologies to cookies known as web beacons, pixels or tags. These technologies do a similar job to cookies, allowing website operators to count page views and understand how visitors interact with and respond to certain content on our Service.
For the purposes of the remaining sections of this Cookie Policy, we refer to all cookies and similar technologies using the above features as “cookies”.
Some cookies are set by us to collection information about you – these are called first party cookies. We also use third party cookies, which are set by third parties and information about you collected by those cookies will be shared with the relevant third party. Please refer to the relevant third party’s privacy notice for more details about the information they collect and how they use it.
Please note that our Service may link to third party websites which are not operated by us. Where you follow links from our Service to the website of a third party, that website may place different cookies on your device. You should check the relevant privacy notice and/or cookie notice for more information about how that third party uses cookies.
You should be aware that applications you use to access our Service such as your website browser, may also place cookies on your device when visiting our Service, or other websites. An example of this would be where you sign into Google Chrome using a Google Account. We do not have control over these third party cookies, so you will need to manage these cookies in the settings of the relevant applications.
For more information on cookies and similar technologies, please visit All About Cookies.
2. HOW LONG DO COOKIES LAST?
All cookies have expiration dates that determine how long they stay in your browser:
Session Cookies – these are temporary cookies that are placed on your device during your browsing session and then expire (and are automatically erased) whenever you close your browser.
Persistent Cookies – these are designed to last for a pre-defined period of time, which varies depending on the nature of the cookie. Persistent cookies stay in your browser until they reach their individual expiry date, or until you manually delete them (see Section 5 below).
3. IS CONSENT NEEDED TO USE COOKIES?
Essential Cookies – We do not need your consent to store and access cookies that are necessary for the provision of our Service to you (otherwise known as “essential cookies”) on your device, although you can still block or delete them (see Section 5 below). Examples of essential cookies include login cookies and shopping cart cookies.
Non-essential Cookies – We may only store and access non-essential cookies on your device with your permission. You are not obliged to give consent to our use of non-essential cookies. If you do give your consent and then change your mind, you can block or delete them (see Section 5 below).
4. WHICH COOKIES DO WE USE ON OUR SITE?
The table below sets out more information about the individual cookies we may use on our Service, the purposes for which they are used and the length of use.
| NAME | 1ST PARTY OR 3RD PARTY COOKIE |
COOKIE TYPE | PURPOSE | DURATION |
| JellyCat | 1st party | Functional | These cookies are set by Jellycat and used for the effective running of our Site. | How long a cookie set by Jellycat remains on your computer or device depends on what it is and what it is used for. Some cookies expire at the end of your browser session, whilst others can remain for up to two years. |
| CookieLaw | This is used to store your preferences for cookies and if you have chosen to accept the popup box or not. | |||
| Country IP Jellycat2 | This is used to store your GEO IP location - based on IP, so that you will be directed to the correct site mode (UK, EU and US site modes). | |||
| CurrentCustomerJellycat2 | This cookie is used to store your customerID - this is unique to each customer, and we use this to authenticate and check if you are logged in or not. | |||
| Securesession | This is used to store your current user session data. | |||
| session_src | This is used to track the source of an order, if for example you come from an email campaign or other marketing link. | |||
| SiteModeJellycat2 | This cookie is used to determine if there is a change in current site mode to another site mode - if the site mode is changed, we know what process to display for example. | |||
| lastProductViewed | This cookie stores the product code of the last viewed item. | |||
| RecentlyViewedDEFAULT | This cookie captures a list of recently viewed product codes so a list of recently viewed items can be shown to you. | |||
| Vat | This is used to store your preference of viewing prices on the web site (including or excluding VAT). | |||
| backOfficeRecentlyViewed | 1st Party | Security | This cookie captures a list of recently viewed entities used in EM backoffice for functioning of the website. | |
| __RequestVerificationToken and __FRequestVerificationTokenAjax |
This is used for Cross-Site Request Forgery (CSRF) token verification, a security feature on the Site. |
|||
| Google Analytics
_ga _gat _gid |
3rd Party | Analytics |
These cookies enable us to store information such as the time you visit our Site, whether you have visited before, and the website that you visited prior to visiting our Site. |
How long a Google Analytics cookie remains on your computer or device depends on what it is and what it is used for. Some Google Analytics cookies expire at the end of your browser session, whilst others can remain for up to two years. You can delete Google Analytics cookies and other cookies at any time by clearing your cache. |
| Klaviyo
|
3rd Party | Analytics | This cookie tracks and identifies site visitors through an auto-generated ID when you interact with our email communications and browse our Site. Learn more about Klaviyo and its privacy policy here: https://www.klaviyo.com/legal/privacy/privacy-notice |
Depending on which web browser you use this cookie may expire after 7 days if you use Safari or remain for up to 2 years otherwise. |
| Facebook
|
3rd Party | Marketing |
This cookie is placed by Facebook and allows Jellycat to track your activity on our website and to measure the effectiveness of our ads and analyse the effectiveness of our website’s conversion channels (e.g. does a visit result in a sale). Facebook will also use the data collected via the cookie for its own purposes and may compile it with existing data they may have on you.
|
90 Days |
| TikTok
|
3rd Party | Marketing |
This cookie allows Jellycat to measure and improve the performance of its advertising campaigns and to personalise your experience (including ads) on TikTok. Learn more about TikTok and its privacy policy here: https://www.tiktok.com/legal/privacy-policy |
13 Months from the last date it was used. |
| YouTube
|
3rd Party | Marketing |
On areas of our Site with embedded YouTube videos these cookies help track the number of views for a particular video track, YouTube user preferences, and serve up related content or adverts within an embedded YouTube video.
|
How long a YouTube cookie remains on your computer or device depends on what it is and what it is used for. Some YouTube cookies expire at the end of your browser session, whilst others can remain for up to two years. You can delete YouTube cookies and other cookies at any time by clearing your cache. |
| Bing Ads
_uetvid MUID |
3rd Party | Marketing |
Bing sets these cookies to engage with a user that has previously used our Site.
|
How long a Bing cookie remains on your computer or device depends on what it is and what it is used for. Some Bing cookies expire after 1 day whilst others can remain for up to 1 year and 24 days. |
| Nuqlium
nqproducts |
3rd Party | Marketing |
These cookies are used by Nuqlium, an online merchandising platform owned by Paraspar, to store product data and personalise your experience on our Site.
|
1 month |
5. HOW DO I REFUSE, BLOCK OR DELETE COOKIES?
There are various ways that you can manage your cookie preferences, but please be aware that in order to use some parts of our Site you will need to allow certain essential or functional cookies. If you block or subsequently delete those cookies, some aspects of our Site may not work properly, and you may not be able to access all or part of our Site.
Your options for managing your cookie preferences are set out below:
Using your browser settings or other tools
You can block the use of cookies generally (not just in respect of our Site) by activating the relevant settings in your browser. For more information on cookie management and blocking or deleting cookies for a wide variety of browsers, visit All About Cookies.
Further, if you do not want to be tracked by Google Analytics, you can install the Google Analytics opt-out browser add-on (but this will only work on certain browsers). For further information on Google Analytics and its use of cookies, please consult the Google Analytics cookie policy.
Depending on your region, you may have the right to opt-out of the use of marketing cookies. To exercise this right, click here to manage your technology preferences via the link “Do not sell or share my information”. Please note that when you opt-out through either of the above methods we do not know who you are within our systems, and your opt-out will apply only to information collected through tracking technologies on the specific browser from which you opt-out. If you delete or reset your cookies, or use a different browser or device, you will need to reconfigure your settings.
6. WHAT ABOUT GOOGLE CHROME OR OTHER BROWSER COOKIES?
Separately to our use of Google Analytics cookies, when you access the Site via Google applications such as Google Chrome, Google may collect user information for the purpose of Google serving personalised advertising across your devices. Google is able to place these advertising cookies on the devices used by visitors to the Site because we use Google services to run the Site. However, these cookies are dropped for Google’s own purposes and as such we do not have any control over how or when they are dropped. You will need to opt out of receiving these cookies via your Google settings. For further information about these cookies please see: How Google uses cookies. Please note that other browsers may use similar tools.
7. WHAT TECHNOLOGIES ARE USED IN EMAILS?
Please note that any emails you receive from us may contain cookies to help us to see if recipients have opened an email and understand how recipients have interacted with it. Once you click on an email that contains a cookie, your contact information may subsequently be cross-referenced to the source email and/or the relevant cookie. If you have enabled images, cookies may be set on your computer or mobile device. Cookies will also be set if you click on any link within the email.
If you do not wish to accept cookies from any one of our emails, simply close the email before downloading any images or clicking on any links. You can also set your browser to restrict cookies or to reject them entirely. These settings will apply to all cookies whether included on websites or in emails.
In some instances, depending on your email or browser settings, cookies in an email may be automatically accepted (for example, when you have added an email address to your address book or safe senders list). Please refer to your email browser or device instructions for more information on this.
8. DOES THIS POLICY CHANGE?
We may update our Cookie Policy from time to time. This might be for a number of reasons, such as to reflect a change in the law or to accommodate a change in our business practices and the way we use cookies. We recommend that you check here periodically for any changes to our Cookie Policy.
9. HAVE ANY FEEDBACK FOR US?
If you have any questions or feedback on our Cookie Policy, please contact us by email at [email protected].
