Privacy policy

1. Who is responsible

Big Fish Academy Limited (trading as Big Fish Careers), a company registered in England and Wales, company number 16347236, registered office 70 Whitehall Road, Grays, England, RM17 5NX, is the controller of personal data collected through this website (bigfish.careers), for requests and the newsletter, and for the career platform, consultations and coaching and the international camps (Austria, Greece, Portugal).

We are registered with the UK Information Commissioner's Office (ICO), registration number ZB977976. Our representative in the European Union (GDPR article 27) is Arcadie Cotruta, Barcelona, Spain, reachable at info@bigfish.careers.

Camps in Ukraine are contracted and run under Ukrainian law by Big Fish Group and the individual entrepreneurs (FOP) Arcadie Cotruta and Irina Zaretcaia Cotruta. They are the controllers of the data needed to book and run a camp in Ukraine. If you ask about a camp in Ukraine through this website, we pass your request to them.

The career test (careertest.bigfish.careers) has its own privacy policy, which applies when you use the test (link below).

For anything about your data, write to info@bigfish.careers.

2. What we collect on this website

• Call-back and contact forms: your name, phone number, email address (optional in the call-back form), the topic and message you write, whether you ticked “Send me Big Fish news”, the page you sent the form from, the site language, and the campaign that brought you to the site, if any (for example “utm” tags or an ad click identifier). Date and time of the request.
• Newsletter: your email address, the site language and the date you subscribed and confirmed.
• Messages you send us by email, Telegram or WhatsApp, and notes from calls about your request.
• Spam protection: when you use a form, Cloudflare Turnstile checks technical signals from your browser to tell people from bots.
• Analytics, only if you allow it: pages visited, approximate location (country or city, from a shortened IP address), device and browser type, how you arrived, and actions such as opening the career test or sending a form (Google Analytics).
• Advertising, only if you allow it: Google Ads and Meta (Facebook, Instagram) record that a visit or request came from one of our ads, and may show our ads to people who visited the site.
• Technical logs: our hosting providers keep short-lived logs (IP address, browser, pages requested) for security and to keep the site running.

Please don't send health or other sensitive details through the forms. If a camp needs them (for example allergies), we collect them separately during the booking.

3. Children

The website is for parents, teenagers and educators. The forms and the newsletter are meant for adults. If you are under 16, please ask a parent or guardian to contact us.

Details about a camp participant are collected from the parent or guardian during the booking. The career test has its own rules for young people, described in its privacy policy.

4. Why we use it, and on what legal basis

• To answer your request, call you back and prepare an offer: steps you asked for before a contract, and our legitimate interest in replying to people who contact us (UK GDPR and GDPR article 6(1)(b) and (f)).
• To provide a service or camp you book: our contract with you.
• To send news and offers by email: only with your consent (the newsletter form or the “Send me Big Fish news” tick). Every email has an unsubscribe link.
• To protect the forms from spam and keep the site secure: our legitimate interest.
• To learn which pages and campaigns bring requests (the campaign saved with a request): our legitimate interest in knowing which of our ads work. You can object at any time by writing to us.
• Analytics and advertising cookies: only with your consent in the cookie banner, which you can change at any time with “Cookie settings” at the bottom of every page.
• To keep accounting and tax records when you buy: our legal obligation.

We do not sell personal data.

5. Who receives the data

We use these providers. They process data on our instructions and under data processing terms:

• Lovable and Cloudflare: hosting and delivery of the website; Cloudflare also provides the Turnstile spam check.
• Supabase: the database where form requests and newsletter subscriptions are stored (European Union).
• SendPulse: our customer database (requests become contacts and deals for our team) and the newsletter.
• Telegram: a private notification to our team's group when a request arrives (name, phone, email, message, page and campaign).
• Google: Google Analytics and Google Ads (only with your consent), and Google Workspace for our email.
• Meta Platforms Ireland: the Meta Pixel (only with your consent).
• Calendly: if you book a call with Arcadie through Calendly, Calendly processes the booking details.
• Our team and consultants who handle your request, and, for camps in Ukraine, Big Fish Group and the FOPs named in section 1.

Some providers (for example Google, Meta, Calendly, Cloudflare and Telegram) may process data outside the UK and the European Economic Area, including in the United States. These transfers are protected by adequacy decisions (such as the EU–US Data Privacy Framework, where the provider is certified), the European Commission's Standard Contractual Clauses or the UK's equivalent safeguards. A request about a camp in Ukraine is passed to our colleagues in Ukraine because it is needed to answer it.

6. How long we keep data

• Requests that don't lead to a booking: up to 24 months after our last contact, then deleted or anonymised.
• Customers: for as long as the service or camp lasts, then up to 6 years for accounting and legal claims.
• Newsletter: until you unsubscribe. After that we keep only your email address on a “do not email” list, so you aren't added again by mistake.
• Team notifications in Telegram: only as long as needed to handle the request.
• Analytics data in Google Analytics: 14 months. Cookies: as listed on the cookies page.

7. Your rights

You can ask us for a copy of your data, to correct it, delete it, limit how we use it, or send it to you in a portable format, and you can object to a use based on our legitimate interest. You can always object to marketing and withdraw a consent at any time; this does not affect what was done before.

Write to info@bigfish.careers; we answer within one month. You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or the authority where you live, for example the AEPD in Spain or the ANSPDCP in Romania. For camps in Ukraine, you can also contact the Ukrainian Parliament Commissioner for Human Rights.

8. Security

Data is encrypted in transit. Requests are saved only by our server after the spam check, and only our team can read them.

9. Changes

We may update this policy when our services or providers change. The date at the top shows the latest version. If a change matters for you, we will tell you.