Privacy Policy

Last updated: 12 October 2026

1. Who is responsible for your information

Big Enough Productions Ltd is the controller of personal information used for the operation of bigenough.co.uk and the business enquiries and approved partner accounts described here. Company number: 09987308. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Contact us about privacy at info@bigenough.co.uk.

This notice covers this corporate website and its partner workspace. Separate notices or contractual terms may apply to purchases, label services, software products, employment, production participation or other websites linked from here.

2. Information we receive

When you contact us, we receive the name, email address, optional company name, enquiry category, subject and message you provide. Business correspondence may also include a job title, telephone number, professional background and information about an intended collaboration. Please send only the details needed for the enquiry and avoid sensitive personal information or information about other people unless authorised and necessary.

Approved partner accounts contain individual identity and contact details, a company association, role, language preference, account status and administrator-assigned permissions. The workspace stores meeting requests and messages. It may contain agreements and other material supplied under a separate arrangement. We do not display confidential development projects on the public website.

Technical information may include an IP address, browser and device details, page requests and security events recorded by our hosting and anti-spam services. The website uses a pseudonymous, time-limited rate-limit record to deter abusive form submissions. A privacy acknowledgement may be required to submit an enquiry; it is not a subscription to marketing.

3. Why we use it and the basis we rely on

We use ordinary business contact details and correspondence to respond to enquiries, route requests to the relevant team and maintain professional relationships. This serves our legitimate interests in communicating with people who approach our business and handling relevant commercial enquiries. Where you personally request steps towards a contract with us, or we perform a contract with you, we may instead rely on that contractual basis for the relevant information.

Account administration, approval checks, permission management, meeting coordination, partner messages and protection of confidential materials support our legitimate interests in operating an accountable professional workspace. Processing necessary to fulfil a contract with an individual may also rely on that contract. We use security information to protect the website, prevent abuse and investigate incidents. Records required by a binding legal obligation are handled on that basis.

Where consent is needed for an optional technology or a particular communication, we request it separately. You can refuse or withdraw that consent without turning an enquiry into a marketing permission. We balance legitimate interests against your reasonable expectations and rights; you can object where that basis is used.

4. Who may receive information

Relevant Big Enough personnel and authorised professional advisers may access information for their work. Hosting and email delivery use Hostinger services. Enquiry routing may send music requests to the Krackerz Music business inbox. Cloudflare Turnstile processes verification data to distinguish legitimate visitors from abusive automated traffic; please see Cloudflare's Turnstile Privacy Addendum.

Optional embedded media connects to YouTube or Vimeo only when you permit the relevant player. Those services process information under their own notices. Following a link to another website is also subject to that website's practices. We may share relevant information with counterparties when necessary for an authorised discussion, or with authorities where required by law. A partner account does not give other accounts automatic access to your messages or every company project.

5. Processing locations and international transfers

Big Enough Productions Ltd is established in the United Kingdom. The website and partner-account database are hosted by Hostinger on a primary server located in Frankfurt, Germany. Hosting backups are stored in France. Authorised Big Enough personnel access relevant information to administer enquiries, partner accounts and business relationships. Business email is provided through Hostinger’s email services; its processing and storage arrangements are separate from the website’s hosting and backup locations. Cloudflare Turnstile processes technical verification information through Cloudflare’s international infrastructure, which may involve processing outside the United Kingdom and European Economic Area, including in the United States. Optional YouTube and Vimeo players may also involve international processing when the visitor enables them.

Hostinger and Cloudflare publish Data Processing Addenda governing their processing of customer personal data. These include provisions for international transfers, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable. Cloudflare’s addendum also addresses transfers covered by the applicable Data Privacy Framework. The mechanism relevant to a particular transfer depends on the service, destination and applicable data protection law. You may contact info@bigenough.co.uk to request information about the safeguards applicable to your personal information and how to obtain a copy, subject to lawful confidentiality restrictions.

You may ask us for information about the safeguards relevant to a transfer of your personal information, subject to lawful confidentiality restrictions.

6. How long information is kept

We keep enquiry and account information while it is needed for an active enquiry, an approved business relationship, the administration of permissions or a documented legal or accounting obligation. We then review whether it should be deleted or anonymised. Where a dispute, claim or contractual obligation requires longer retention, only relevant information is retained for that purpose. Backup copies are retained for the applicable backup cycle and are not used for new purposes.

Deleting a partner's access permission prevents future authorised downloads; it does not retrieve a copy already downloaded. Correspondence in business inboxes, hosting logs and provider systems follows the applicable retention and backup arrangements. Contact us if you need more detail about a particular record.

7. Security and your choices

Partner accounts use individual credentials. An account and its company must be approved, and project and document permissions are assigned separately. Higher-level access is never granted merely because a user knows an address or has signed in. Private document delivery checks the current permissions for each request. Access may be suspended when an affiliation changes or a security concern arises.

Keep your password private, use a password you do not reuse elsewhere and tell us if your account may have been compromised. No internet service can guarantee absolute security. We investigate incidents and take steps appropriate to the circumstances.

8. Your rights and complaints

Depending on the circumstances and applicable law, you may request access to your personal information, correction, erasure or restriction, object to certain processing or request portability. These rights are subject to their legal conditions. Where processing relies on consent, you can withdraw it; this does not undo lawful earlier processing.

Send requests to info@bigenough.co.uk. We may need proportionate information to verify identity before disclosing or changing records. You can complain to the UK Information Commissioner's Office. Where EU data protection law applies, you may also contact the competent supervisory authority in your jurisdiction. Please contact us if you would like to raise a concern first.

9. Providing data and automated decisions

Providing enquiry data is voluntary, but the required contact fields are needed to process your request. Approved partner access requires sufficient identity and company information to verify and administer access. Access decisions are made by an administrator. Anti-spam checks can reject a submission or limit attempts, but they do not make a commercial rights or partnership decision about you.

10. Updates and related notices

We update this notice when our practices change. The date above identifies this version. Please also read our Cookies Policy and Email & Enquiry Privacy Notice.

Partner self-registration and access review

Partner account applicants provide their name, business email, company or professional name, professional role, country, optional company website and areas of interest. We send a password setup link to verify control of the email address. New accounts remain pending; only an authorised administrator can approve accounts and assign access to specific projects and documents. We process this information to administer the requested professional relationship, authenticate individuals and protect confidential materials, relying on the lawful bases described above. Email verification or registration does not grant a licence, sign an NDA or authorise access to any confidential project. Account and approval emails are service communications, not a marketing subscription.