Privacy policy

Last updated: 12 November 2026

Who we are

Big Cookie Digital Ltd, trading as Big Cookie, is responsible for deciding how personal information is used for the website enquiry and booking activities described in this notice. For those activities, we are the data controller.

This notice concerns people visiting our website, making enquiries or arranging an introductory call. It does not replace separate privacy information for fan communities or campaigns we operate for clients, where our responsibilities may differ.

Information we collect and where it comes from

Enquiries

When you use our contact form, we ask for your name, email address, artist or company name and role. You may also choose the services you are interested in and provide website or social links and a message.

The form also attaches visit information: campaign tags in the address you arrived through, your referring page where available, your first landing page, the page from which you submitted the form, and the submission time. A random identifier is created after a successful submission to prevent duplicate conversion events. We process this information to respond to and understand your enquiry.

Please avoid including sensitive personal information or unnecessary details about other people. If you provide information about an artist, colleague or other person, make sure you are entitled to do so and let them know about this notice.

Calls booked through Calendly

After a successful enquiry, the website loads Calendly and passes your name and email address to prefill the booking form. This happens when the calendar loads, before you complete a booking. Available campaign tags are also passed to the calendar. Calendly processes the details you enter and your selected appointment, and may collect browser, device and cookie information under its own terms. The calendar has separate cookie controls.

Website and technical information

Our website and hosting services process technical information needed to deliver requests, such as IP addresses and request information. The enquiry form uses an IP-based rate limit and a hidden anti-spam field. Hosting and application logs may record request paths, times, status information and errors.

Where you permit Analytics or Marketing, Google services may process identifiers, browsing and measurement information. Our application’s enquiry and booking events are designed not to include your name, email or message. Cookie identifiers and technical data may still be personal information; excluding contact details does not make all measurement anonymous.

Most information comes directly from you or your browser. Information can also come from Calendly when you arrange a call, or from a representative enquiring on your behalf.

Why we use information

Under UK data protection law, we need a lawful basis for each purpose.

• Enquiries and introductory calls: legitimate interests in responding to business enquiries and arranging relevant discussions. Where you personally ask us to take steps towards a contract with you, those steps may instead be necessary for that contract. Contract is not automatically the correct basis when you act for another organisation.
• Optional analytics and marketing technologies: consent to measure website use and campaign performance.
• Optional newsletters: consent where you separately opt in. Making an ordinary contact enquiry is not a newsletter opt-in.
• Security, spam prevention and diagnosing failures: legitimate interests in operating a reliable and secure service.
• Legal duties and disputes: legal obligation where a specific duty applies; legitimate interests where necessary to establish, exercise or defend legal claims.

You do not have to submit an enquiry or book a call. The contact form requires its marked fields so that we can identify the request and reply. Without them, the form cannot be submitted. Optional fields can be left blank. This is a functional requirement, not a statement that you are legally obliged to provide the information.

Who receives information

We use the following services for our website and business enquiries:

• Google Workspace / Gmail: receives and stores enquiry emails, including the form fields and visit attribution. Email delivery uses a managed Replit Gmail connector.
• Replit: provides application hosting and the managed connector used to send enquiries, and may process request and diagnostic information.
• Calendly: provides booking and scheduling. Depending on the activity, Calendly acts on customers’ instructions for scheduling data and as a controller for its own described purposes. Its services may involve providers such as Cloudflare, Google reCAPTCHA, Stripe and Datadog; their appearance is not evidence that you have purchased anything or that our calls are charged.
• Monday.com: is used by Big Cookie to manage enquiry and business-contact information. The website currently delivers contact-form enquiries through Gmail; this notice does not imply an automatic transfer from the form to Monday.com.
• Google Analytics and Google Ads: provide consent-controlled measurement and advertising technologies.

People authorised to handle enquiries and bookings may access relevant information through these services. Information may also need to be disclosed where law requires it or to professional advisers handling a specific legal matter, subject to an appropriate basis.

International transfers

Our service providers may process information outside the United Kingdom, including in the United States. Exact countries and access locations depend on the accounts, service settings and providers’ subprocessors.

Where a restricted international transfer occurs, an appropriate UK transfer mechanism and any required assessment must be in place. Depending on the recipient and circumstances, this could involve UK adequacy regulations, an eligible certified recipient under an applicable UK data bridge, or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum.

You can contact info@bigcookie.co to ask about the arrangements relevant to your information and how to obtain details of applicable safeguards.

How long we keep information

We keep enquiry emails, booking records and newsletter consent records for six months and delete them after that time.

Browser storage and provider-side technical records have separate lifetimes. Consent choices are treated as valid for 180 days; the local-storage record may remain until overwritten or cleared. Visit attribution and conversion-deduplication records use session storage for the tab, which browser session restoration may preserve. Observed cookie lifetimes are listed in our cookie information and are not the same as provider-side retention periods.

Contact us if you need details about technical records, provider backups or how deletion applies to your information.

Cookies and similar storage

The website offers Accept all, Reject all and Manage preferences, with separate Analytics and Marketing choices. You can reopen preferences through Cookie settings in the footer. Our Google tags are blocked until a relevant choice is granted. Rejecting non-essential Google cookies does not prevent an enquiry.

The website also stores first-touch visit attribution in session storage before a cookie choice is made. This is separate from the Google tags. Rejecting Google cookies does not mean that no browser storage or third-party processing takes place.

Calendly loads after a successful enquiry and has its own cookie controls; Big Cookie’s banner does not control cookies on Calendly’s domain. See our cookie information for more about cookies and browser storage.

Security

The enquiry form validates inputs, applies rate limiting and discards detected anti-spam submissions without emailing them. Email delivery uses a server-side managed connector rather than credentials exposed in the browser. No online service can be guaranteed completely secure.

Your rights and choices

Depending on the circumstances and applicable exceptions, you may have rights to access your personal information, correct inaccurate information, request erasure, restrict processing, receive certain information in a portable form, and object to processing based on legitimate interests. These rights are not absolute and do not all apply to every purpose.

You can object to use of your information for direct marketing at any time. Where processing relies on consent, you may withdraw it; this does not affect the lawfulness of processing before withdrawal. Website cookie choices can be changed using Cookie settings. You can contact us to withdraw consent to newsletter communications.

Contact info@bigcookie.co to make a request or ask about this notice. We may need proportionate information to verify your identity or clarify a request. Applicable law sets response deadlines, generally one month, with extensions or adjustments only where permitted. Rights requests are normally free, subject to lawful exceptions.

No automated decision-making producing legal or similarly significant effects was identified in the website code reviewed for this notice. This does not rule out profiling or account-side features in third-party tools.

Complaints and changes

Please raise privacy concerns with us using the contact details above so that we can investigate. You also have the right to complain to the UK Information Commissioner’s Office, whether or not you contact us first: ico.org.uk/make-a-complaint/.

We review this notice when processing changes, update the date when a revised notice is approved, and give any further notice required before using information for a new purpose.