Poileasaidh Dìomhaireachd

1. Data Controller

Depending on your location, regional subsidiaries may also process data: IMH Group, Inc. (Americas) and Heritage Media Labs Co., Ltd. (Rest of World). aberle-media GmbH is the lead entity for cross-border processing. Where UK GDPR applies to you, aberle-media GmbH remains the controller for processing carried out through this website.

2. Data Protection Officer & Contact

For privacy matters, including exercising your rights, contact our Data Protection Officer:

legal@aberle-media.com
aberle-media GmbH · Bäckerstr. 17, 67657 Kaiserslautern, Germany

We will respond to requests within one month, as required by UK GDPR. Complex requests may be extended by a further two months; we will inform you if an extension applies.

3. Categories of Personal Data

3.1 Data you provide directly

• Contact form: Name, email, company, subject, message, address.
• Film rental orders: Name, email, organisation, organisation type, event venue, date, guest count, film cart, technical requirements (DCP, MP4, live music, subtitles), billing address, VAT ID (optional, B2B).
• Licensing inquiries: Name, email, company, phone, country, business type, territories, rights, message.

3.2 Automatically collected data

• Server logs: IP address (anonymised after 7 days), browser, operating system, referrer, pages viewed, timestamps.
• Device information: screen resolution, device type, browser language.
• On your first visit to / without a saved language preference, we read the HTTP Accept-Language header to redirect you to a matching locale (no cookie, no persistent storage).
• Analytics (consent only): page views via Google Analytics 4 and, when enabled, aberle-media custom analytics.
• External video trailers (consent only): Luchd-tarraing bhidio taobh a-muigh (dreach RA - ann am poileasaidh prìobhaideachd Beurla a-mhàin aig /en/privacy).

3.3 Cookies & local storage

See Section 9 (Cookie Policy) for full detail on UK PECR compliance. Summary:

4. Purpose, Lawful Basis & Retention

We process personal data only where a lawful basis under UK GDPR Article 6 applies:

When retention periods expire, data is deleted or anonymised unless longer storage is required by law (e.g. tax or commercial law).

5. Processors & Third Parties

We use, among others: EU/UK-capable web hosting, CDN (Cloudflare / Bunny.net / jsDelivr), Google Analytics 4 (consent only), aberle-media custom analytics (consent only, when enabled), embedded video trailers via YouTube and Vimeo (consent only), bot protection (Cloudflare Turnstile / reCAPTCHA), and Google Fonts. Data processing agreements under UK GDPR Article 28 are in place with processors where required.

We do not sell personal data and do not share it for third-party marketing. Processors act only on our instructions.

6. International Transfers (Post-Brexit)

aberle-media GmbH is established in Germany (EU). Personal data may therefore be transferred outside the United Kingdom, including to Germany and other countries where our processors operate.

Since the UK left the European Union, transfers from the UK to countries without UK adequacy regulations rely on appropriate safeguards under UK GDPR Chapter V, including:

• UK adequacy regulations — transfers to countries covered by UK regulations (including the EU and EEA, and the United States under the UK Extension to the EU-US Data Privacy Framework, where applicable to certified recipients).
• International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses — for transfers not covered by adequacy.
• Binding corporate rules or other mechanisms approved under UK GDPR, where applicable.

Transfers from the EU/EEA to the UK are generally permitted under the EU Commission adequacy decision for the UK. We assess transfer risks and implement supplementary measures where necessary.

You may request information about safeguards for a specific transfer by contacting legal@aberle-media.com.

7. Your Rights (UK GDPR)

If UK GDPR applies to our processing of your personal data, you have the following rights:

• Right of access — to obtain confirmation of processing and a copy of your data (Art. 15).
• Right to rectification — to correct inaccurate data (Art. 16).
• Right to erasure — “right to be forgotten” in certain circumstances (Art. 17).
• Right to restriction of processing — in defined situations (Art. 18).
• Right to data portability — to receive data you provided in a structured, commonly used format (Art. 20).
• Right to object — to processing based on legitimate interests or for direct marketing (Art. 21).
• Rights related to automated decision-making — including profiling, where applicable (Art. 22).
• Right to withdraw consent — at any time, without affecting lawfulness of processing before withdrawal, where processing is based on consent (Art. 7(3)).

To exercise any right, contact legal@aberle-media.com. We may need to verify your identity before responding.

Right to lodge a complaint: You have the right to lodge a complaint with the UK supervisory authority:

We encourage you to contact us first so we can address your concern.

8. Technical & Organisational Measures

TLS/HTTPS encryption in transit, encryption at rest where applicable, role-based administrative access, CSRF protection, honeypot and rate limiting, server-side validation, hosting with appropriate security standards, and data minimisation. We review security measures regularly and restrict access to personal data to authorised personnel.

9. Cookie Policy (UK PECR & UK GDPR)

Under PECR, storing or accessing information on your device (other than strictly necessary cookies) requires your consent. UK GDPR applies to any personal data collected via cookies.

9.1 Strictly necessary cookies

These are essential for the website to function and do not require consent under PECR:

• symfony_session — maintains your session and protects forms (CSRF).
• am_cookie_consent — records your cookie choices so we do not ask repeatedly.
• am_lang — stores your language choice when you select it in the language menu (not set from automatic detection).

9.2 Cookies requiring consent

We only set the following after you opt in via our cookie banner or cookie settings:

• Analytics (_ga, _ga_*) — Google Analytics 4 helps us understand site usage. Legal basis: consent (UK GDPR Art. 6(1)(a)). You can withdraw consent at any time via cookie settings.
• External media (YouTube, Vimeo) — embedded trailers may set third-party cookies and transfer data outside the UK. Legal basis: consent (UK GDPR Art. 6(1)(a)). Providers act as separate controllers for their processing.

9.3 Managing cookies

You can accept essential cookies only, or customise analytics and external media in the cookie banner. You may also clear cookies via your browser settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

For guidance on cookies and your rights, the ICO publishes guidance at ico.org.uk — cookies and similar technologies.

10. Changes

We update this policy when legal or operational requirements change. Material changes will be announced on this page. The version date appears at the top of the policy.