Big Fish Studios

Legal

Privacy Policy

Last updated: April 2026

1. Who We Are

Big Fish Studios is a professional recording and production studio based in Chilworth, Surrey. We are the data controller for the personal data described in this policy. You can contact us at info@thebigfishstudios.co.uk.

2. What Data We Collect

We collect the following personal data:

Account dataName, email address, phone number. Passwords are managed securely by AWS Cognito — we do not store or have access to plaintext passwords.
Booking dataSession dates, times, types, durations, payment amounts
Payment dataTransaction records, payment method type (card details handled by Stripe)
Subscription dataMembership tier, billing period, included hours usage
Contact messagesName, email, and message content submitted via the contact form

3. How We Use Your Data

We use your personal data to:

  • Create and manage your studio account
  • Process and manage session bookings
  • Process payments and issue refunds
  • Manage membership subscriptions and included hours
  • Send booking confirmations, approvals, rejections, and cancellation notices
  • Send payment receipts and membership renewal notifications
  • Respond to enquiries submitted through the contact form
  • Send security notifications (password changes, account deletion)

We do not use your data for marketing purposes unless you have explicitly opted in. We do not sell or share your personal data with third parties for their marketing purposes.

4. Legal Basis for Processing

Under the UK GDPR, we process your data on the following bases:

  • Contract: Processing necessary to fulfil your booking or membership
  • Legitimate interest: Account security, fraud prevention, service improvement
  • Legal obligation: Financial record-keeping, tax compliance
  • Consent: Where applicable, for optional communications

5. Third-Party Services

We use the following third-party services to operate our platform:

StripePayment processing — handles card details securely. We never see or store your card number.
Amazon Web ServicesCloud hosting, database, email delivery, user authentication. Data stored in the UK (eu-west-2).

These providers have their own privacy policies and are compliant with applicable data protection regulations.

6. Data Retention

We retain your data as follows:

  • Account data: Retained while your account is active. Anonymised on deletion.
  • Booking & payment records: Retained for 7 years for financial and tax compliance, even after account deletion. Personal identifiers are anonymised.
  • Session files: Audio recordings, stems, and project files uploaded by the studio are retained indefinitely as part of the studio’s service delivery records, even after account deletion.
  • Contact messages: Delivered to the studio via email. Not stored in the application database. Retention depends on the studio’s email management practices.

7. Your Rights

Under the UK GDPR, you have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Update or correct inaccurate data (via your profile page)
  • Erasure: Delete your account and anonymise your personal data (via your profile page)
  • Portability: Request your data in a machine-readable format
  • Objection: Object to processing based on legitimate interest
  • Restriction: Request that we limit processing of your data

To exercise any of these rights, contact us at info@thebigfishstudios.co.uk. We will respond within 30 days.

8. Account Deletion

You can permanently delete your account from your profile page at any time. When you delete your account:

  • Your login credentials are permanently removed
  • Your name and email are replaced with anonymous identifiers in our records
  • Business data (booking dates, amounts, session types) is retained in anonymised form for financial reporting
  • Session files (audio recordings, stems, project files) are retained by the studio as part of its service delivery records. These files are no longer accessible to you after account deletion.
  • You can create a new account with the same email address — it will not be linked to the old data

9. Cookies & Local Storage

Our website uses minimal browser storage:

  • Authentication tokens: Stored in localStorage to keep you signed in
  • Theme preferences: Cached in localStorage for faster page loads

We do not use tracking cookies, analytics cookies, or advertising cookies. No data is shared with advertising networks.

10. Data Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), encrypted password storage, access controls, and regular security reviews. Payment processing is handled entirely by Stripe, which is PCI DSS compliant.

11. Children

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via email or a notice on the website. The “last updated” date at the top of this page reflects the most recent version.

13. Contact & Complaints

For privacy-related questions or to exercise your rights, contact us at info@thebigfishstudios.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.