You may experience brief interruptions

Privacy Policy

Last updated: October 9, 2026

1. Introduction and Scope

Big Bongo Bang Inc. ("BigBongo", "we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have in relation to it.

This Policy applies to:

  • Visitors to our website at bigbongo.ai ("Website");
  • Individuals who register for or use the BigBongo platform and related services (the "Platform"), whether as a B2B customer, an authorized user of a business customer, or a B2C individual subscriber; and
  • Individuals whose personal data is processed through the Platform in the context of AI-conducted employee interviews ("Interview Participants").

An important distinction: BigBongo acts as a “data controller” in relation to personal data processed for our own purposes (e.g. account management, marketing, Website analytics). BigBongo acts as a “data processor” in relation to Employee Interview Data and other Customer Data processed on behalf of our business customers. This Policy covers our role as data controller. Our obligations as data processor are governed by the Data Processing Addendum ("DPA") incorporated into the BigBongo Framework Agreement.

Payment processing for the Platform is handled by Stripe, our payment processor. When you make a purchase, Stripe collects and processes your payment data under Stripe's own privacy policy, available at stripe.com/privacy.

2. Who We Are

Data Controller:
Big Bongo Bang Inc.
Delaware, United States

Privacy contact / Data Protection queries:
Email: [[email protected]]

EU Representative (Article 27 GDPR):
Golyamoto Bongo EOOD, 13B Sheynovo Str., Sofia, Bulgaria 1504
Email: [[email protected]]

UK Representative:
Golyamoto Bongo EOOD, 13B Sheynovo Str., Sofia, Bulgaria 1504

3. The Personal Data We Collect and Why

BigBongo processes the following categories of personal data in its capacity as data controller. For each category we identify the data types, the purpose of processing, and the legal basis (elaborated in Section 4).

3.1 Website Visitors

Data collected:

  • Device and browser information (type, OS, browser version)
  • IP address
  • Referring URLs and exit pages
  • Pages viewed, session duration, click patterns
  • Cookie identifiers and similar trackers (see Section 11)

Purpose: Operating and securing the Website; understanding how visitors use the Website; improving content and performance.

Legal basis: Legitimate interests (Website operation and security); consent (analytics and marketing cookies where required).

3.2 Prospective Customers — Demo Requests and Lead Generation

Data collected:

  • Name and job title
  • Business email address
  • Company name, size, and industry
  • Country / region
  • Information volunteered in contact forms, demo request forms, or live chat interactions

Purpose: Responding to enquiries; scheduling and conducting product demonstrations; maintaining a record of pre-sales interactions; sending relevant product information.

Legal basis: Pre-contractual steps / legitimate interests (responding to enquiries and pursuing business relationships); consent (where required for direct marketing communications).

3.3 Account Holders — B2B Customer Administrators and B2C Individual Subscribers

Data collected:

  • Name
  • Business or personal email address
  • Password (never stored in plain text)
  • Company name and role (B2B)
  • Billing address
  • Subscription tier and transaction records (from Stripe)
  • Account preferences and settings
  • Support correspondence

Purpose: Creating and managing user accounts; authenticating access to the Platform; processing and managing subscriptions and payments; providing customer support; sending service-related communications (account alerts, security notices, invoices); enforcing the Terms of Service.

Legal basis: Contract performance; legal obligation (invoicing and tax records); legitimate interests (account security; fraud prevention).

3.4 Authorized Users of B2B Customers

Data collected:

  • Name
  • Business email address
  • Job title and department
  • Login activity logs (timestamps, IP addresses)
  • In-Platform interaction data (features used, reports accessed)

Purpose: Enabling authorized access to the Platform; security and access control; audit trails; usage analytics to improve the Platform.

Legal basis: Contract performance (BigBongo's obligations to the B2B customer); legitimate interests (Platform security and improvement).

3.5 Interview Participants — Employees of BigBongo's B2B Customers

This is the most sensitive category of personal data BigBongo processes as “data controller” in its own right — distinct from its role as data processor for the customer's Employee Interview Data.
Data collected (as data controller):

  • Name and contact details (used for scheduling and sending interview invitations)
  • Interview invitation delivery and opening status
  • Technical metadata

Important: The substantive content of AI-conducted interviews — recordings, transcripts, responses, process maps, scores, and all derived Organizational Intelligence — is processed by BigBongo exclusively as “data processor” on behalf of the Customer (who is the data controller for that data). That processing is governed by the DPA, not this Policy.

Purpose (as data controller): Sending interview invitations; managing interview scheduling logistics; monitoring interview completion rates for Platform quality purposes.

Legal basis: Legitimate interests of BigBongo and the B2B customer (facilitating Platform operation); the B2B customer's instructions as data controller.

3.6 Marketing Communications Recipients

Data collected:

  • Name and email address
  • Company name
  • Marketing communication engagement data

Purpose: Sending newsletters, product updates, event invitations, and other marketing communications to individuals who have opted in or where BigBongo has a legitimate interest in contacting them (e.g. existing customers regarding related services).

Legal basis: Consent (for individuals in the EEA, UK, and other opt-in jurisdictions); legitimate interests (for existing customers, subject to opt-out right).

3.7 Job Applicants

Data collected:

  • CV / resume (name, contact details, employment history, education, skills)
  • Cover letter contents
  • Information provided during interview processes
  • References

Purpose: Evaluating applications; conducting recruitment processes; communicating with applicants; compliance with employment law obligations.

Legal basis: Pre-contractual steps; legal obligation; legitimate interests.
Sensitive data included in applications (e.g. health information volunteered by applicants) is processed only where necessary and with appropriate safeguards.

4. Legal Bases for Processing

Where the GDPR (or UK GDPR) applies, we rely on the following legal bases:

  • Contract performance - Processing necessary to provide the Platform and Services pursuant to the Framework Agreement
  • Legitimate interests - Website analytics; security monitoring; B2B marketing to existing customers; improving the Platform; product development
  • Consent - Marketing emails where opt-in is required; non-essential cookies and tracking
  • Legal obligation - Tax, invoicing, and accounting obligations; responding to lawful regulatory requests

Where we rely on legitimate interests, we have conducted a balancing test and concluded that our interests are not overridden by your rights and freedoms. You may request the details of that assessment by contacting us at [[email protected]].

5. How We Share Personal Data

We do not sell your personal data. We share personal data only in the circumstances described below.

5.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf and under our instructions, subject to data processing agreements. These include:

Cloud hosting and infrastructure: AWS, Google Cloud, Azure, Contabo GmbH
Payment processing and invoicing: Stripe (Subscription billing, payments and invoicing)

5.2 B2B Customer Organizations

Where you are an Authorized User or an Interview Participant of a B2B customer, that customer organization is the data controller of the substantive data arising from your use of the Platform. BigBongo shares access to that data with the relevant customer's designated administrators as part of providing the Service.

5.3 Professional Advisors

We may share personal data with our legal, financial, and accounting advisors where necessary for the conduct of our business, subject to confidentiality obligations.

5.4 Business Transfers

In the event of a merger, acquisition, financing, restructuring, or sale of all or substantially all of BigBongo's assets, personal data held by BigBongo may be transferred to the relevant acquirer or successor entity. We will provide notice of any such transfer and any choices available to you where required by applicable law.

5.5 Legal Requirements and Protection of Rights

We may disclose personal data required by applicable law, regulation, court order, or lawful governmental request, and to the extent necessary to protect the rights, property, or safety of BigBongo, our customers, or others.

6. International Data Transfers

BigBongo is headquartered in the United States. Personal data collected from individuals in the EEA, UK, or Switzerland may be transferred to and processed in the United States or other countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data from the EEA or UK to third countries, we ensure an adequate level of protection through one or more of the following mechanisms:

  • European Commission Adequacy Decision (where applicable)
  • EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914)
  • UK International Data Transfer Agreement or UK Addendum to EU SCCs

7. Data Retention

We retain personal data for no longer than necessary for the purposes for which it was collected, subject to legal retention obligations. Our principal retention periods are:

  • Account data (active accounts) - for the duration of the Subscription Term, plus 90 days post-deletion request
  • Account data (inactive/terminated accounts) - 3 years from termination (for dispute resolution and legal claims)
  • Invoicing records - 7 years (tax and accounting law obligations)
  • Support correspondence - 3 years from closure of the ticket
  • Marketing contact data - until opt-out, or 3 years from last engagement if no opt-out
  • Security and access logs - 12 months
  • Job applicant data (unsuccessful) - 6 months from notification of rejection, unless consent to retain is given
  • Technical documentation (AI Act) - 10 years from last placement on market

Where processing is based on consent, we retain data until consent is withdrawn.

8. Security Measures

BigBongo implements appropriate technical and organizational measures to protect personal data, including:

  • Encryption of data in transit
  • Role-based access controls and principle of least privilege
  • Multi-factor authentication for administrative access
  • Regular penetration testing and vulnerability assessments
  • Security incident response procedures
  • Employee data protection and security training
  • Data minimization and pseudonymization practices

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and the relevant supervisory authority of any data breach as required by applicable law.

9. Your Privacy Rights

Depending on your location, you have the following rights in relation to your personal data. To exercise any of these rights, please contact [[email protected]]. We will respond within the timeframe required by applicable law.

9.1 Rights of EEA and UK Individuals (GDPR / UK GDPR)

  • Right of access - Obtain confirmation of whether we process your data and receive a copy
  • Right to rectification - Correct inaccurate or incomplete data
  • Right to erasure - Request deletion ("right to be forgotten") where processing is no longer necessary or lawful
  • Right to restriction - Request that processing be restricted in certain circumstances
  • Right to data portability - Receive your data in a structured, machine-readable format
  • Right to object - Object to processing based on legitimate interests or for direct marketing
  • Right to withdraw consent - Withdraw consent at any time where processing is consent-based
  • Right not to be subject to automated decisions - Not to be subject to solely automated decisions with significant legal or similar effects

9.2 All Users

All users may at any time: unsubscribe from marketing communications using the unsubscribe link in any marketing email; update or correct account information through the Platform settings; and request deletion of their account by contacting [[email protected]].

9.3 Complaints

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local data protection supervisory authority. In the EU, the relevant authority is the supervisory authority in your Member State of habitual residence. In the UK, the relevant authority is the Information Commissioner's Office (ICO) at ico.org.uk. We would, however, appreciate the opportunity to address your concerns before you contact a supervisory authority — please reach out to [[email protected]] in the first instance.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our Website and Platform.

11. Third-Party Links and Services

Our Website and Platform may contain links to third-party websites or integrations with third-party services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of any external website or service. We encourage you to read the privacy policies of any third-party services you use in connection with BigBongo.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will notify you of material changes by:

  • Posting the updated Policy on our Website with an updated "Last Updated" date;
  • Sending an email notification to your registered email address for significant changes; and
  • Displaying a prominent notice on the Platform where appropriate.

Your continued use of the Website or Platform after the effective date of any material change constitutes your acknowledgment of the updated Policy. Where required by law, we will obtain your fresh consent before processing your data in any materially new way.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices:

Email: [[email protected]]
Website: [bigbongo.ai/privacy]
Post: 16192 Coastal Highway, Delaware, USA

For payment-related privacy queries: contact [email protected] or use the billing portal. Stripe's own processing of payment data is described at stripe.com/privacy.

14. Definitions

"Customer Data" has the meaning given in the BigBongo Framework Agreement.
"EEA" means the European Economic Area.
"Employee Interview Data" means recordings, transcripts, structured responses, and other data generated through AI-conducted interviews performed via the Platform.
"GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).
"Organizational Intelligence" has the meaning given in the BigBongo Framework Agreement.
"Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection law.
"Platform" means BigBongo's AI-powered organizational assessment and process intelligence software-as-a-service platform.
"UK GDPR" means the GDPR as retained in UK law pursuant to the European Union (Withdrawal) Act 2018.