Privacy Policy

Big School is a Go-to-Market platform for organisations that sell into the K-12 education sector, operated by DEPI (Digital Education Products & Intelligence). In this policy, "we", "us", and "our" refer to DEPI as the data controller for the Big School platform.

This policy explains what personal data we process, why, and the rights available to you under the UK GDPR and EU GDPR.

Account data: the names, work email addresses, and organisation details of the users who hold a Big School seat.

Contact database: business contact information for staff at educational institutions — such as name, job title, role category, institution, and verified work email — processed on a legitimate interest basis for business-to-business outreach.

Usage data: information about how the platform is used, collected to operate, secure, and improve the service.

We process business contact data under the legitimate interests lawful basis, for the purpose of relevant business-to-business communication with educational institutions. We balance this against the rights and expectations of the individuals concerned, and we honour objection and erasure requests.

Where you send outreach through the platform, you act as the controller for that communication and are responsible for compliance with applicable marketing and electronic communication laws in your target markets.

We retain account data for the duration of your subscription and for a limited period afterwards to meet legal and accounting obligations. Contact database records are reviewed and re-verified on an ongoing basis, and records are suppressed or removed on request or when they are no longer accurate.

You have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and the right to data portability. To exercise any of these rights, contact us using the details below. Individuals in the contact database can request suppression or removal at any time.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and regular security review. Outbound email is sent from your own connected mailbox via authenticated OAuth — we do not route your sending through a shared server.