Privacy Policy

This website is made available to you for information purposes. The following information describes the terms and conditions for its use, as well as our privacy policy. You agree that your further use of this website constitutes your acceptance of these terms and policies.

This Privacy Policy explains how Big Duck Studio, Inc. (“Big Duck,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information obtained through our website located at www.bigduck.com (the “website”), our email communications, our client engagements, and any related services we provide. Big Duck is a small, service-based agency located in the United States. We do not sell personal information, we do not operate consumer-facing applications, and we do not engage in behavioral advertising or large-scale profiling. Our data practices are limited in scope and oriented around ordinary business operations, client service, and communications with current and prospective clients and subscribers.

How we collect your information

Information you provide

Through your use of our website, www.bigduck.com, and other communications with us, Big Duck may collect and store personally identifiable information about you. Generally, personally identifiable information means information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. This information may include your name, email address, telephone number, employment details, information regarding your computer system, and other information you choose to provide to us through contact forms, email, telephone conversations, proposals, engagement documents, invoices, or similar communications.

We only collect personal information that you voluntarily provide to us, or that is generated as a necessary byproduct of your interactions with our website and services. We do not require you to provide more personal information than is reasonably necessary for the purpose for which it is collected.

Cookies

Our web server may automatically attempt to identify a user to the website through a cookie placed within the user’s web browser. A “cookie” is a piece of data stored on your computer or mobile device tied to information about you. It serves as a message given to a web browser by a web server. The browser stores the message in a text file; the message is then sent back to the server each time the browser requests a page from the server. From time to time we may also track information on pages and features that users access or view. The activity is collected and may be stored in our constituent relationship management system and/or our email service provider. You may choose to set your web browser to refuse cookies, or to alert you when cookies are being sent, but doing so may cause you to lose functionality with some parts of our website.

We use a limited set of cookies and similar technologies. These generally fall into the following categories: (i) strictly necessary cookies that enable core site functionality; (ii) preference cookies that remember choices you make on the site; and (iii) analytics cookies that help us understand, in aggregate, how visitors use the website so we can improve it. We do not use cookies for cross-site behavioral advertising, and we do not permit third parties to use cookies on our site for their own independent advertising purposes.

We may also log Internet Protocol (IP) addresses, the approximate location of your computer, your browser name, type of computer, operating system, technical information about your means of connection to our website, and other similar information. We may use this information in an aggregate fashion to track access to the website, provide summary statistics about our visitors’ interests and preferences, services sold, traffic patterns, and related site information, in order to enhance the design of our website and to inform our service offerings. Aggregate information of this kind does not identify you individually.

Our email newsletters utilize tracking technology that allows us to see how many newsletter emails are opened and the email address of users who have clicked on a given feature. We use this information for internal purposes, to measure the aggregate number of people who view our content and to understand which content is of interest to our audience.

Registration data

In order to access some of the services on our website, such as joining our email list, you may be required to procure a separate account and/or complete an online registration form, which requests certain information and data (“Registration Data”), and to maintain and update your Registration Data. By registering for our email list or other services that may be offered through our website, you agree that all information provided in the Registration Data is true and accurate. You also grant us the right to disclose to third parties certain Registration Data about you as described in this Privacy Policy. The information we obtain through your use of the website, including your Registration Data, is subject to this Privacy Policy.

Information collected automatically

When you visit our website, certain information is collected automatically through standard web server logs and analytics technologies. This may include your IP address, device and browser characteristics, the referring URL, the pages you view, the dates and times of your visits, and the approximate geographic region associated with your IP address. We use this information to operate, secure, and improve the website, to diagnose technical issues, to prevent abuse, and to compile aggregate statistics about site usage.

Information from client engagements

In the course of providing professional services to our clients, we may receive personal information about client personnel, client contacts, and, in limited circumstances, individuals who are the subjects of our clients’ communications. We process this information solely for the purpose of delivering the services requested by our client, in accordance with our contractual obligations to the client and applicable law. Where we act as a service provider or processor to a client, the client is the controller of that information and our use of it is governed by the terms of our engagement with that client.

Third-party vendors, service providers, and content

Some of our products and services are provided through contractual arrangements with affiliates, service providers, and other third parties. We and our service partners may use your personal information to operate our sites and to deliver their services. These third-party vendors may use cookies, web beacons, or similar technologies to provide services to us. In doing so, these vendors may collect information such as your browser type, your operating system, web pages visited, time of visits, content viewed, ads viewed, and other clickstream data. You may have additional rights regarding opt-out of services offered by our third-party vendors if you reside in a jurisdiction such as the European Economic Area which provides for enhanced user rights.

We are not responsible for the use of any personal information provided by you to other sites accessible through our site, as such use is not subject to our control. Any use of your personal information by such third parties is governed by those individuals or entities and their own privacy policies and terms of service, if any.

The contents of our website may from time to time contain documents, images, information, media, and other materials not proprietary to Big Duck, such as photographs, artwork, articles, clips, other text or audiovisual elements, and the names, trade names, trademarks, logos, trade styles, or designations of third parties which have been published in newspapers, magazines, or other media or venues, and may include the name, trade name, or trademark of the medium or venue in which such materials were published or displayed. Any use thereof whatsoever is strictly prohibited, unless the prior written permission of the appropriate third party has been secured. Big Duck has no editorial control of such third-party content and does not guarantee the accuracy, completeness, or usefulness of any such content nor its merchantability or fitness for any particular purpose.

Social media

When linking to, or accessing our website or information, on or through Facebook, Twitter, LinkedIn, Instagram, or Google profiles, or from or through any other social media page, and when posting information to or otherwise communicating via that page or your own social media page, your activities online are subject to the Terms of Service, User’s Agreement, and other terms and conditions imposed by that social media provider, which may contain terms and conditions different from our terms and policies contained herein. As examples only, please see the following pages for further details:

• http://www.facebook.com/legal/terms (Facebook’s Statement of Rights and Responsibilities);
• http://www.linkedin.com/legal/user-agreement (LinkedIn’s User’s Agreement);
• https://twitter.com/tos (Twitter’s Terms of Service);
• https://help.instagram.com/581066165581870 (Instagram’s Terms of Service); and
• http://www.google.com/intl/en/policies/terms (Google’s Terms of Service).

All social media references or links to Big Duck and/or www.BigDuck.com shall be deemed to include both our website and any and all policies, terms, and conditions contained herein.

Categories of personal information we collect

For purposes of transparency, and in particular for the benefit of residents of California and other jurisdictions that require categorical disclosures, we identify below the categories of personal information we may collect. The specific categories collected about any given individual will depend on that individual’s interactions with us.

• Identifiers, such as name, postal address, email address, telephone number, IP address, and similar identifiers provided by you or generated through your use of the website.
• Customer records information, such as business contact details, job title, employer, and correspondence you send to us in connection with inquiries or engagements.
• Commercial information, such as records of services you have inquired about, engaged us to perform, or purchased, and related billing information.
• Internet or other electronic network activity information, such as browsing history on our website, interactions with our emails and newsletters, referring URLs, and aggregated usage data.
• Geolocation information, limited to approximate (city or region level) location derived from IP address; we do not collect precise geolocation data from mobile devices.
• Professional or employment-related information, where you voluntarily share it with us in the course of inquiries, proposals, or engagements.
• Inferences drawn from the above, but only to the limited extent necessary to understand aggregate audience interests and to improve our content and services. We do not build behavioral advertising profiles.

We do not knowingly collect sensitive personal information (as that term is defined under applicable U.S. state privacy laws) for purposes that would require the provision of a “limit use” right, and we do not use any sensitive personal information for the purpose of inferring characteristics about you.

How we process your personal information

The following sets forth the ways we process your personal information. For residents of the European Economic Area, the United Kingdom, and Switzerland, this disclosure is required by Articles 13 and 14 of the General Data Protection Regulation (“GDPR”) and its equivalents. GDPR also requires us to inform you of the legal basis for processing. The lawful bases on which we rely are set forth in the subsection titled “Lawful bases for processing (EEA, UK, and Switzerland)” below, and apply, as relevant, to each of the processing activities described in this section.

(a) We may process information about your use of our communications (“usage data”). The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views, and website navigation paths, as well as information about the timing, frequency, and pattern of your use. We use this usage data for the purposes of analyzing your use of Big Duck’s content, improving the performance and design of our website, diagnosing technical issues, and preventing fraudulent or abusive activity.

(b) We may process information contained in any inquiry you submit to us (“inquiry data”). We use this inquiry data for the purposes of responding to your inquiry, offering, marketing, and selling relevant services to you, and for customizing the content we develop and send to you.

(c) We may process information that you provide to us for the purpose of subscribing to our email notifications and/or newsletters and downloading Big Duck or third-party white papers (“notification data”). We use this notification data for the purposes of sending you relevant notifications, newsletters, and/or white papers, and for administering our subscriber lists.

(d) We may process information contained in or relating to any communication that you send to us (“correspondence data”). The correspondence data may include the communication content and metadata associated with the communication. Our website will generate the metadata associated with communications made using the website contact forms. We use this correspondence data for the purposes of communicating with you, providing requested services, and record-keeping.

(e) We may process personal information in connection with the administration and performance of our client engagements, including account management, invoicing, collection of payments, service delivery, and related operational activities (“engagement data”).

(f) We may process any of your personal information where necessary for the establishment, exercise, or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure, and where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice.

(g) In addition to the specific purposes for which we may process your personal information set forth in this Privacy Policy, we may also process any of your personal information where such processing is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

Lawful bases for processing (EEA, UK, and Switzerland)

Where GDPR or equivalent law applies to our processing of your personal information, we rely on one or more of the following lawful bases set forth in Article 6(1) of the GDPR:

• Consent (Art. 6(1)(a)) — where you have given clear consent for us to process your personal information for a specific purpose, such as subscribing to our newsletter. You may withdraw consent at any time by contacting us as described in this Policy or by using the unsubscribe mechanism provided in our emails.
• Contract (Art. 6(1)(b)) — where processing is necessary for the performance of a contract to which you are a party (for example, a service engagement) or to take steps at your request prior to entering into such a contract.
• Legal obligation (Art. 6(1)(c)) — where processing is necessary for compliance with a legal obligation to which we are subject.
• Vital interests (Art. 6(1)(d)) — where processing is necessary to protect the vital interests of you or another natural person.
• Legitimate interests (Art. 6(1)(f)) — where processing is necessary for the purposes of the legitimate interests pursued by Big Duck or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include operating and improving our website, communicating with current and prospective clients, administering our business, protecting our website and services from fraud or abuse, and pursuing or defending legal claims.

We do not rely on Article 9 (special category data) bases because we do not, in the ordinary course, process special categories of personal data. If we ever need to do so, we will identify an appropriate lawful basis and inform you accordingly.

Data retention

We retain personal information only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, tax, or reporting requirements, to enforce our agreements, and to establish, exercise, or defend legal claims. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process the information; whether we can achieve those purposes through other means; and applicable legal, regulatory, tax, accounting, or other requirements.

As general guidance, and without limiting the preceding paragraph:

• Newsletter and marketing subscriber data is retained for as long as you remain subscribed and for a reasonable period thereafter to document your preferences and our compliance obligations. If you unsubscribe, we will retain only the minimum information necessary to honor your opt-out (for example, a suppression record).
• Inquiry and correspondence data is retained for the period reasonably necessary to respond to your inquiry and for a reasonable period thereafter for record-keeping, legal, and audit purposes.
• Engagement data associated with client services is retained for the duration of the engagement and for such additional period as is required by applicable law, professional standards, our insurance carriers, or our internal record retention practices.
• Website usage and analytics data is retained for a period sufficient to support analysis of site performance and security, after which it is aggregated, anonymized, or deleted.
• Legal, tax, and financial records are retained for the period required by applicable law and sound business practice.

When personal information is no longer needed, we take reasonable steps to securely delete or anonymize it. Where deletion is not feasible (for example, because the information is stored in backup archives), we will securely isolate the information and protect it from any further processing until deletion is possible.

Providing your personal information to others

The following sets forth the ways we may disclose your personal information to others.

(a) We may disclose personal information to our suppliers or subcontractors insofar as reasonably necessary to maintain our communications and operate our business. We may use service providers in connection with operating and improving the website to assist with certain functions, such as email transmission, data hosting, and some aspects of our technical and customer support. Among them are:

• Google — We use Google Analytics to track site statistics and user demographics, interests, and behavior on the website. Google’s Privacy and Terms explain how it uses information from the website.
• Act-On Software — We use Act-On Software to manage our email subscriber lists and send emails to our subscribers. Act-On’s Privacy Policy explains how it uses information.

We take measures to ensure that these service providers access, process, and store information about you only for the purposes we authorize, subject to confidentiality obligations and, where required by law, appropriate written agreements (including GDPR Article 28 data processing terms and equivalent obligations under other privacy laws).

(b) We may disclose your personal information to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise, or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

(c) We may transfer part or all of your information in the case of a merger, acquisition, bankruptcy, or other sale of all or a portion of Big Duck’s assets or stock. In addition, we may disclose your personal information where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another person. We may also disclose your personal information where such disclosure is necessary for the establishment, exercise, or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

(d) SMS and mobile information. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Our use of SMS is limited and primarily operational in nature (for example, to coordinate on active engagements). SMS opt-in data and consent records are handled separately from, and are not subject to, the general information-sharing practices described elsewhere in this Policy.

Categories of recipients

The categories of third parties to whom we may disclose personal information include: (i) service providers and processors that support our website, email, analytics, hosting, and related operations; (ii) professional advisers such as lawyers, accountants, auditors, and insurers; (iii) governmental authorities, courts, and law enforcement agencies where required or permitted by law; (iv) parties to a corporate transaction as described above; and (v) any other third parties with your consent or at your direction.

No sale or sharing of personal information

Big Duck does not sell personal information, and has not sold personal information within the preceding twelve (12) months, as the term “sell” is defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPA/CPRA”), or under similar laws in other U.S. states. We also do not “share” personal information for purposes of cross-context behavioral advertising, as that term is defined under the CCPA/CPRA. We do not knowingly sell or share the personal information of consumers under the age of sixteen (16).

Other disclosures of your information

We may store personal information in locations outside the direct control of Big Duck (for instance, on servers or databases co-located with hosting providers).

As we develop our business, we may buy or sell assets or business offerings. Customer, email, and visitor information is generally one of the transferred business assets in these types of transactions. We may also transfer or assign such information in the course of corporate divestitures, mergers, or dissolution. In such cases, we cannot control acquiring parties’ use of your information, but we will take reasonable steps, consistent with applicable law, to require that the acquiring party honor the commitments made in this Privacy Policy.

We may disclose your information if required to do so by law, court order, or subpoena, or if we believe that it is reasonably necessary to comply with a law, regulation, or legal request; to protect the safety of any person; to address fraud, security, or technical issues; or to protect Big Duck’s rights or property. We will also disclose your personal information to cooperate with a law enforcement investigation. We fully cooperate with law enforcement agencies in identifying those who use our services for illegal activities. We reserve the right to report to law enforcement agencies any activities that we believe to be unlawful.

International data transfers

Big Duck is headquartered in the United States, and our website and supporting systems are generally hosted in the United States. If you access our website or provide us with personal information from outside the United States, please be aware that your personal information will be transferred to, stored in, and processed in the United States.

For transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to the United States or another jurisdiction that has not received an adequacy decision under Article 45 of the GDPR (or its equivalents), we rely on appropriate safeguards and derogations permitted under Articles 44 through 49 of the GDPR, which may include, as applicable:

• Standard Contractual Clauses approved by the European Commission (or the UK International Data Transfer Agreement / Addendum and Swiss equivalents, as applicable) entered into with service providers and other recipients of the transferred information, together with any supplementary measures reasonably required to address the particular circumstances of the transfer;
• Derogations for specific situations set forth in Article 49 of the GDPR, such as transfers necessary for the performance of a contract between you and Big Duck, transfers necessary for the establishment, exercise, or defense of legal claims, or transfers made with your explicit consent after being informed of the possible risks; and
• Other valid transfer mechanisms recognized under applicable law at the time of the transfer.

You may request additional information about the safeguards we have in place for international transfers by contacting us at [email protected]. Big Duck endeavors to protect the privacy and security of your personal information and to use it only consistent with your relationship with Big Duck and the practices described in this Privacy Policy.

Links to other websites

Big Duck may contain links to other websites or services that may be subject to less stringent privacy standards. Big Duck does not assume and expressly disclaims any responsibility for the content, performance, privacy practices, policies, or actions of the third parties that operate these websites or services, including but not limited to their external websites, apps, software, or any links found in such external website. We are not responsible for how such third parties collect, use, or disclose your personal information. You should review their privacy policies before providing them with personal information. URLs pointing to documents or sites outside of our website are provided to you only as a matter of convenience. The inclusion in the site of any URL or link does not imply an endorsement of a specific vendor, information provider, individual, entity, group, or organization by Big Duck. Linking to our website without authorization is prohibited. You may request authorization by sending an email complete with the URLs of the site wishing to establish a link to [email protected].

Your right to opt out of marketing communications

We offer commercial email recipients the opportunity to opt out of further commercial communications in every commercial email we send, in accordance with the CAN-SPAM Act of 2003 and its implementing regulations. Each commercial email we send will include: (i) a clear and conspicuous notice of the opportunity to decline to receive further commercial emails from us; (ii) a functioning return email address or another Internet-based mechanism that a recipient may use to submit such a request; and (iii) a valid physical postal address for Big Duck.

If you want to stop receiving commercial emails, promotional materials, or other marketing materials, you can do so at any time by using the unsubscribe link included in each email or by contacting Big Duck at [email protected]. We will honor opt-out requests within the time frame required by applicable law (and in any event, within ten (10) business days of receipt with respect to commercial email under CAN-SPAM), and we will not transfer the email address of any person who has opted out to any other sender for purposes of sending commercial email.

Please note that even if you opt out of marketing communications, we may continue to send you transactional or relationship communications, such as messages relating to our ongoing business relationship, service delivery, invoicing, or changes to our terms or policies.

SMS opt-out

Where you have consented to receive SMS messages from us, you may opt out at any time by replying “STOP” to any SMS message we send, or by contacting us at [email protected]. Upon receipt of a STOP request, we will cease sending SMS messages to the applicable number, other than a confirmation of the opt-out. As noted above, no mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text messaging originator opt-in data and consent will not be shared with any third parties.

Non-U.S. users

Big Duck is headquartered in the United States. If you are located in Canada, the European Union, the United Kingdom, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to the United States and processed there, as further described in the “International data transfers” section above. By using our website, participating in any of our services, and/or providing us with your information, you consent to this transfer to the extent consent is the applicable legal basis, and otherwise acknowledge that such transfer is carried out pursuant to another lawful basis or safeguard as described in this Policy.

California privacy rights

This section supplements the information in this Privacy Policy and applies solely to California residents. It is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the “CCPA/CPRA”), and the California “Shine The Light” law.

Categories of personal information collected, disclosed, sold, or shared

The categories of personal information we have collected about California residents in the preceding twelve (12) months are described in the “Categories of personal information we collect” section above. The sources of that personal information include: (i) you directly, when you submit a form, send us an email, subscribe to our communications, or interact with us as a client; (ii) your devices and browsers, through cookies and similar technologies; and (iii) service providers and other third parties that assist us in operating our website and services.

We disclose each of the categories of personal information identified above to the categories of recipients described in the “Categories of recipients” section above, in each case for the business and commercial purposes described in this Policy.

We do not sell personal information, and we have not sold personal information in the preceding twelve (12) months, as the term “sell” is defined under the CCPA/CPRA. We do not share personal information for purposes of cross-context behavioral advertising, as that term is defined under the CCPA/CPRA, and we have not done so in the preceding twelve (12) months. We do not knowingly sell or share the personal information of consumers under the age of sixteen (16).

Your California privacy rights

Subject to certain limitations and exceptions set forth in the CCPA/CPRA, California residents have the following rights with respect to their personal information:

• Right to know. You have the right to request that we disclose to you the categories of personal information we have collected about you, the categories of sources from which the personal information was collected, the business or commercial purpose for collecting the personal information, the categories of third parties to whom we have disclosed the personal information, and the specific pieces of personal information we have collected about you.
• Right to access. You have the right to request a copy of the specific pieces of personal information we have collected about you in a portable and, to the extent technically feasible, readily usable format.
• Right to delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, where retention is necessary to complete a transaction, comply with a legal obligation, or exercise or defend legal claims).
• Right to correct. You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the personal information and the purposes of processing.
• Right to opt out of sale or sharing. Because we do not sell or share personal information as those terms are defined under the CCPA/CPRA, there is no sale or sharing activity to opt out of. If this changes, we will update this Policy and provide an appropriate opt-out mechanism.
• Right to limit the use of sensitive personal information. Because we do not use sensitive personal information for the purpose of inferring characteristics about you or for any other purpose that would trigger a right to limit, no such right is currently applicable to our processing.
• Right to non-discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights. This means we will not deny you services, charge you a different price, provide a different level or quality of services, or suggest that you will receive a different price or level of quality for exercising your rights, except as permitted by law.

How to exercise your California rights

To submit a request to exercise any of the rights described above, please contact us by email at [email protected] with the subject line “California Privacy Request,” or by postal mail at the address listed in the “Contacting Big Duck” section below. Your request should describe the right you wish to exercise and provide sufficient detail to allow us to properly understand and respond to the request.

Identity verification. In order to protect your personal information, we must verify your identity before fulfilling a request to know, access, delete, or correct. We will ask you to provide information that matches information we already maintain about you. The specific information we request will depend on the nature of your request and the sensitivity of the information involved, and will be limited to what is reasonably necessary to verify your identity. We will not use the information provided for verification for any purpose other than verification.

Authorized agents. You may use an authorized agent to submit a request on your behalf. If you do so, we will require (i) written permission signed by you authorizing the agent to act on your behalf, and (ii) verification of your own identity directly with us, except in the case of requests made pursuant to a valid power of attorney. We may deny a request from an agent who does not submit proof that they have been authorized by you to act on your behalf.

Response timing. We will confirm receipt of your request within ten (10) business days and respond substantively within forty-five (45) calendar days, unless we require additional time, in which case we will inform you of the reason and extension period in writing. There is no charge for submitting a verifiable request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, as permitted by law.

California “Shine The Light” law

Under the California “Shine The Light” law (Cal. Civ. Code § 1798.83), California residents may opt out of the disclosure of personal information to third parties for the third parties’ direct marketing purposes. California residents also have the right under certain circumstances to receive, once a year, information about third parties with whom we have shared information about you or your family for their direct marketing purposes during the previous calendar year, and a description of the categories of personal information shared. To make such a request, please send an email to [email protected] and include the phrase “California Privacy Request” in the subject line, the domain name of the website you are inquiring about, along with your name, address, and email address. We will respond to you within thirty (30) days of receiving such a request. Note that we do not share personal information with third parties for their own direct marketing purposes, so our response will typically reflect that.

Canadian users

Canadian residents also have certain rights to know how their information may be shared with third parties for direct marketing purposes, and additional rights under applicable Canadian federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation. As detailed in this Policy, you may contact us for such information or to opt out of the sharing of your personal information with third parties for marketing purposes at any time by sending an email stating this preference and including your full name and email address to [email protected]. Please note that this opt-out does not prohibit disclosure for non-marketing purposes. Canadian residents also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

European Economic Area, United Kingdom, and Swiss users — your rights under GDPR

The General Data Protection Regulation (“GDPR”), the United Kingdom GDPR, and the Swiss Federal Act on Data Protection (collectively, “European Privacy Laws”) provide certain information rights to residents of the European Union, the European Economic Area, the United Kingdom, and Switzerland. This section is provided to comply with those laws.

Controller

For personal information collected through the website and direct communications with us, Big Duck Studio, Inc. acts as the controller. Our contact details are set forth in the “Contacting Big Duck” section below. Big Duck has its headquarters in the United States. Information we collect from you will be processed in the United States. The United States has not received a general finding of “adequacy” from the European Commission under Article 45 of the GDPR. Big Duck relies on appropriate safeguards and the derogations for specific situations as set forth in Articles 44 through 49 of the GDPR, as described in the “International data transfers” section above. Big Duck endeavors to protect the privacy and security of your personal information and to use it only consistent with your relationship with Big Duck and the practices described in this Privacy Policy.

How to exercise your rights

If you reside in the European Economic Area, the United Kingdom, or Switzerland, you have certain rights with respect to the personal information that we have collected about you. To exercise your rights, please contact us at [email protected]. We will respond to reasonable requests without undue delay, and in any event within one (1) month of receipt of the request. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons for the delay within one (1) month of receipt of the request.

Identity verification. We may ask you for information reasonably necessary to confirm your identity before acting on your request. Where we have reasonable doubts concerning the identity of the person making the request, we may request the provision of additional information necessary to confirm your identity, as contemplated by Article 12(6) of the GDPR. We will limit our identity verification to what is reasonably necessary.

You have the following rights:

(a) Right of access to your personal information (Art. 15). You have the right to ask us for confirmation on whether we are processing your personal information, and access to the personal information and related information on that processing (for example, the purposes of the processing, the categories of personal information involved, the recipients or categories of recipients, the retention period or the criteria used to determine it, and the existence of your other rights).

(b) Right to rectification (Art. 16). You have the right to have your personal information corrected if it is inaccurate, and to have incomplete personal information completed.

(c) Right to erasure (Art. 17). You have the right to ask us to delete your personal information. This right may be exercised, among other times: when your personal information is no longer necessary for the purposes for which it was collected or otherwise processed; when you withdraw consent on which processing is based and where there is no other legal ground for processing; when you object to processing and there are no overriding legitimate grounds for the processing; or when your personal information has been unlawfully processed. This right is subject to the exceptions set forth in Article 17(3) of the GDPR.

(d) Right to restriction of processing (Art. 18). You have the right to request the limiting of our processing under limited circumstances, including: when the accuracy of your personal information is contested; when the processing is unlawful and you oppose the erasure of your personal information and request the restriction of the use of your personal information instead; when we no longer need the personal information for the purposes of the processing, but it is required by you for the establishment, exercise, or defense of legal claims; or when you have objected to processing pending the verification whether the legitimate grounds of Big Duck override your grounds.

(e) Right to data portability (Art. 20). You have the right to receive the personal information that you have provided to us, in a structured, commonly used, and machine-readable format, and you have the right to transmit that information to another controller, including to have it transmitted directly, where technically feasible. This right applies only to personal information processed by automated means on the basis of your consent or a contract with you.

(f) Right to object (Art. 21). You have the right to object to our processing of your personal information, as permitted by law. This right is limited to processing based on GDPR Article 6(1)(e) or (f), and includes profiling based on those provisions, and processing for direct marketing purposes. Where you object to direct marketing, we will no longer process your personal information for that purpose. For other objections, we will no longer process your personal information unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.

(g) Rights related to automated decision-making and profiling (Art. 22). You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Big Duck does not engage in such automated decision-making in the ordinary course of its business.

(h) Right to withdraw consent. Where we process your personal information on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

(i) Right to lodge a complaint. We encourage you to contact us directly and allow us to work with you to address your concerns. Nevertheless, you have the right to lodge a complaint with a competent data protection supervisory authority if you consider that the processing of personal information relating to you infringes applicable data protection laws. In the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO); in the European Economic Area, it is the supervisory authority of the member state of your habitual residence, place of work, or the place of the alleged infringement; and in Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC).

Security

The security of Big Duck’s website and your information is of great importance to us. Big Duck has security measures in place to protect the loss, misuse, and alteration of your information under Big Duck’s control. These measures include administrative, technical, and physical safeguards appropriate to the nature of the information we process and the size of our operations. Such measures may include access controls, use of reputable hosting and software providers, transmission of website traffic over encrypted channels (HTTPS) where applicable, requiring confidentiality obligations from our service providers and personnel, and internal policies governing the handling of personal information.

Notwithstanding these measures, we make no assurances about our ability to prevent any such loss, misuse, or alteration, and we shall have no liability to you or any third party for any loss, misuse, or alteration arising from circumstances beyond our reasonable control. We do not warrant that your access to our website is completely secure. No method of transmission over the Internet or method of electronic storage is one hundred percent (100%) secure, and you transmit information to us at your own risk.

Big Duck shall notify any user whose information is suspected of being accessed, disclosed, altered, or deleted by an unauthorized person so that the user can take appropriate measures to minimize the adverse effect of such a data security breach (a “Breach Notification”). Big Duck will make such Breach Notification without undue delay after it learns of a breach, consistent with the requirements of applicable law, unless it determines, in consultation with law enforcement or based on the reasonable judgment of Big Duck, that such notification might hinder and prevent ongoing efforts to detect the source of the breach. For the avoidance of doubt, a Breach Notification does NOT constitute an admission by Big Duck that the breach occurred as a result of any conduct by Big Duck or its personnel, including but not limited to malpractice, failure, bad faith, or negligence, or that the breach occurred in Big Duck’s systems.

Violation of security rules may result in criminal or civil liability and prosecution. Big Duck will refer to the proper authorities any occurrence that may constitute any such violation, and cooperates fully with law enforcement agencies in ensuring the prosecution of violators. This list of security violations is by way of example only and is by no means intended to be exhaustive: gaining access to data without proper authorization; logging onto a server, account, or area of the site without proper authorization; scanning, probing, or testing for vulnerability of the site’s system or attempting to do so, and attempting to breach the security of the site, without proper authorization; attempting to interfere with the functionality or features of the site or its systems by introducing viruses, overloading, flooding, mail-bombing, or crashing; and sending unsolicited promotional email messages.

Children’s privacy

Big Duck does not knowingly collect or solicit personal information from anyone under the age of thirteen (13) or knowingly allow such persons to use our website and other communications. Our website and services are not directed to children under thirteen (13). If we become aware that we have collected personal information from a child under age thirteen (13) without verification of parental consent, we will take steps to remove that information from our records. If you believe that a child under thirteen (13) may have provided personal information to us, please contact us at [email protected].

Consistent with the CCPA/CPRA, we do not knowingly sell or share the personal information of California consumers under the age of sixteen (16).

Governing law and jurisdiction

This Privacy Policy shall be governed by the laws of the State of New York, without regard to its conflict of laws provisions. Any dispute arising under or in relation to this Policy shall be resolved exclusively in the State of New York in accordance with the terms and procedures set forth herein. Nothing in this section shall be deemed to deprive you of any mandatory rights you may have under the laws of your jurisdiction of residence, including any right to lodge a complaint with a competent supervisory authority.

Disclaimers

Your use of and browsing on the website is done at your own risk. The information contained in the website is provided “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, FREEDOM FROM COMPUTER VIRUS AND WARRANTIES ARISING FROM A COURSE OF DEALING OR COURSE OF PERFORMANCE. Nor is any representation or warranty made, express or implied, as to the accuracy, reliability, timeliness, or completeness of any such information, or that the website will be uninterrupted or secure.

The website is to be used for informational and lawful purposes only, and may not be relied upon for any other purpose. Under no circumstances shall Big Duck or its officers, agents, employees, affiliates, successors, assigns, or counsel be liable to any person or entity under any circumstances for: (a) any loss or damage, in whole or in part, directly or indirectly caused by, resulting from, or relating to your use of the website; (b) any error or omission (through neglect or otherwise) contained on the website, or any circumstances involving the procurement, collection, compilation, interpretation, storage, analysis, editing, transportation, transmittal, communication, or delivery of any information contained in this website; or (c) any direct, indirect, special, consequential, or incidental damages whatsoever, even if Big Duck, or its officers, agents, directors, employees, affiliates, successors, assigns, or counsel are advised in advance of the possibility of such damages resulting from the use of, or inability to use, any information contained in the site, or with respect to the performance of the site and/or information obtained by the user from any hyperlinks to documents located within and without the site. The site does not purport to be comprehensive or definitive, and you expressly acknowledge that the information contained on the site could include technical inaccuracies and/or typographical errors. You are solely responsible for decisions based on any information contained on the site and any of its sub-directories. You hereby waive any and all claims against Big Duck and its affiliates, officers, employees, agents, assigns, successors, and counsel arising out of your use of the site and the information and/or services available thereon.

In sending electronic communications to Big Duck, you are requesting that we either contact you or provide you with information or other business matters. Big Duck will make every reasonable effort to accommodate reasonable requests for information in a timely manner, but it is unable to make any guarantee concerning the timeliness of such responses. You agree that Big Duck is not responsible for delay, non-delivery, or non-receipt of any information exchanged between you and Big Duck, whether due to Internet connectivity problems, incorrect email addresses, incomplete or incorrect contact information supplied by you, due to force majeure, or for any other reason.

Big Duck reserves the right at any time to terminate all or any portion of the site without notice to you.

Copyright © 2020 by Big Duck Studio, Inc.

The copyright to the contents of this website (including but not limited to all content, script, HTML codes, and any and all related content, features, and functionality that comprise the site) and the trademarks, logos, characters, and service marks displayed thereon (collectively the “Intellectual Property”) are owned by Big Duck or other third parties who have licensed or authorized use thereof to Big Duck. The Intellectual Property is protected by United States and international copyright, trademark, patent, trade secret, and other intellectual property or proprietary rights laws. Copying or reproducing the pages contained on the site to any other server or location for further reproduction or distribution is prohibited, unless specific rights are expressly granted in writing by an officer of Big Duck. Any rights not expressly granted are hereby reserved. Big Duck will pursue any violation of this policy in order to protect its valuable intellectual property rights.

Changes to our privacy policy

If we change our privacy policies and procedures, we will post those changes on this page to keep you aware of what information we collect, how we use it, and under what circumstances we may disclose it. Changes to this Privacy Policy are effective when they are posted on this page, unless a later effective date is specified. If we make material changes, we will take additional steps to notify you, such as by email (where we have your email address on file) or by a notice on the website homepage, as required by applicable law. Please check this page on a consistent basis.

Contacting Big Duck

Please contact Big Duck if you have any questions about this Privacy Policy, the practices of Big Duck, or your dealings with the website. You can contact us by email at [email protected] or by postal mail at Big Duck, 123 7th Ave, PMB 223, Brooklyn, NY 11215. We will make reasonable efforts to respond to inquiries promptly.

Last Updated: April 2026