Privacy Policy.

Big Tosh Inc. ("Big Tosh," "we," "us," or "our") operates the Big Tosh platform, website, and related services (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website or use our Services.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to our collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not access or use the Services.

This policy applies to all users of the Big Tosh platform, including school administrators, student leaders, and institutional decision-makers who interact with our demo request system, onboarding tools, and related products.

We collect information you provide directly to us, information we collect automatically, and information from third parties.

We use the information we collect for the following purposes, each grounded in a legitimate legal basis under applicable data protection law:

• Providing our Services: processing demo requests, confirming bookings, sending confirmation emails, and delivering the Big Tosh platform to your institution.
• Communicating with you: sending transactional emails, booking confirmations, product updates, and responding to your inquiries.
• Personalising your experience: tailoring content, recommendations, and onboarding materials to your institution type, size, and goals.
• Analytics and improvement: understanding how our Services are used so we can improve functionality, fix issues, and develop new features.
• Marketing communications: sending campaign emails about Big Tosh products and updates only where you have provided consent or we have a legitimate interest.
• Legal compliance: meeting our obligations under applicable laws, regulations, and court orders.
• Fraud prevention and security: detecting and preventing fraudulent activity, unauthorised access, and other misuse of our Services.

• Service providers: trusted third parties who assist in operating our platform — email delivery, cloud hosting, payment processing, and analytics — each bound by data processing agreements.
• Business transfers: in the event of a merger, acquisition, or asset sale, user information may be transferred as part of that transaction.
• Legal requirements: when disclosure is required by law, subpoena, or court order, or to protect the rights, property, or safety of Big Tosh, our users, or the public.
• Consent: with your explicit consent, such as when you choose to integrate third-party applications with your Big Tosh account.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.

For demo request data, we retain active lead records while you have an active relationship with Big Tosh. Where a relationship has concluded, we retain records for 36 months after last interaction before anonymising or deleting them. Booking records are retained for 7 years for legal compliance. Email campaign logs are retained for 24 months.

• Right of access: request a copy of the personal information we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal information in certain circumstances.
• Right to restrict processing: request that we limit how we use your data while you contest its accuracy.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.

• Essential cookies: required for the platform to function — session management, authentication, and security tokens.
• Analytics cookies: help us understand how visitors interact with our Services so we can improve them.
• Preference cookies: remember your settings and choices across sessions.
• Marketing cookies: used only with your consent to personalise messaging and measure campaign effectiveness.

You can manage your cookie preferences at any time through your browser settings or our cookie consent tool. Disabling certain cookies may affect the functionality of the Services.

• TLS/SSL encryption for all data in transit between your browser and our servers.
• Encryption at rest for sensitive data stored in our databases.
• Role-based access controls limiting staff access to personal data on a need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning.
• Incident response procedures to detect, report, and investigate data breaches.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

The Big Tosh platform is designed for school administrators, student leaders, and institutional decision-makers who are at least 18 years of age. Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we may have collected such information, contact us immediately at [email protected].

Big Tosh operates globally. Your information may be transferred to and processed in countries other than the country in which you reside. When we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to other countries, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or equivalent mechanisms.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy with a new "Last Updated" date, send an email notification to registered users at least 14 days before changes take effect, and display a prominent notice on our platform. Your continued use of our Services after any changes constitutes your acceptance of the revised policy.