Big Plum Digital
ESENDA
Request a diagnosis

Data protection

Clear privacy. No noise.

This policy explains what information we may process, for what purpose, on what legal basis, for how long, and what your rights are. It applies to the Big Plum Digital website and services and, where relevant, to Big Plum Connect, our integration tool for the WhatsApp Business Platform.

Controller
Big Plum Digital · CVR 45246000
Last updated
9 October 2026

In short

  • We do not sell personal data.
  • Google’s and Meta’s analytics and advertising tools will only work if you accept them. They are not active yet.
  • The current version of Big Plum Connect does not store message content or recipient phone numbers.
  • Our servers are located in Germany, within the European Union.
  • You can ask to access or delete your data at any time: hola@bigplumdigital.com.
Contents
  1. 01Data controller
  2. 02Data we may process
  3. 03Purposes and legal bases
  4. 04Recipients and providers
  5. 05Retention
  6. 06Your rights
  7. 07Big Plum Connect and the WhatsApp Business Platform
  8. 08Deleting Big Plum Connect data
  9. 09Children
  10. 10Cookies and similar technologies
  11. 11Changes to this policy
  12. 12Contact

01Data controller

Controller
Big Plum Digital
CVR
45246000
Address
Lodsholmvej 36, 9270 Klarup, Denmark

We have not appointed a Data Protection Officer because, given the type and scale of the processing activities described, it is not mandatory. If this changes, we will update this policy.

When Big Plum Digital determines the purposes and means of processing, it acts as the data controller.

For certain services, particularly when a client company uses Big Plum Connect and Big Plum Digital processes data on its instructions, Big Plum Digital acts as a data processor, in accordance with the applicable contractual terms.

02Data we may process

Depending on how you interact with us and which services you use, we may process the following categories of information.

Identification and contact data

  • name;
  • company or project;
  • email address;
  • country;
  • phone number, when you provide it;
  • communications with Big Plum Digital.

Data submitted through forms

When you use contact, diagnosis or similar forms, we may receive:

  • your current website;
  • information about your company or project;
  • areas or needs you are concerned about;
  • any additional information you choose to write;
  • contact preferences;
  • your consent to receive certain communications, where applicable.

Technical and security data

Data needed to operate, protect and troubleshoot our services:

  • IP address;
  • browser, device and operating system;
  • pages visited, date and time of access;
  • server logs and technical events;
  • logs related to security, operation and abuse prevention.

Analytics and marketing data

Only with your consent in the cookie manager. We will use Google Analytics, Google Ads and the Meta pixel; they are not active yet. Once they are, depending on what you accept, they may collect:

  • cookie and browser identifiers;
  • the pages you visit, the date, the time and where you came from;
  • what you do on the website, such as clicks or form submissions;
  • the ad or campaign that brought you;
  • data about your device and your approximate location, derived from your IP address.

Form data we share with Meta

If you have accepted marketing and send us a form, we may tell Meta from our server that an enquiry has arrived (Conversions API), with your email address and phone number irreversibly encrypted (hashed) and the Meta cookie identifiers, to know which ad led to it. We never send the content of your message. It is not active yet.

Data from Facebook and Instagram forms

If you fill in one of our forms on Facebook or Instagram, we receive the data you enter in it: usually your name, email address, phone number, company and answers.

Data from connected platforms

When you use services that integrate with external platforms, such as Big Plum Connect, we may receive information provided by those platforms and authorised by the user or company making the connection. For Meta and the WhatsApp Business Platform, this may include:

  • WhatsApp Business account identifiers;
  • business phone number identifiers;
  • app identifiers;
  • names and technical data of WhatsApp Business assets;
  • message template information: name, language, category and status;
  • technical message identifiers;
  • sending, delivery or processing statuses;
  • technical events received via webhooks;
  • recipient phone numbers, when needed to perform a requested function;
  • values entered in template variables;
  • other data strictly necessary to perform the authorised WhatsApp Business Platform functions.

Big Plum Connect follows a data minimisation principle and only processes the information needed to provide the requested functions.

03Purposes and legal bases

Responding to requests and preparing proposals

  • answering enquiries and reviewing requests;
  • preparing diagnoses and proposals;
  • providing information about our services;
  • communicating before a possible contract.

Legal basis: steps taken at the request of the data subject prior to entering into a contract, the performance of a contract, or our legitimate interest in responding properly to the requests we receive.

Providing our services

  • managing clients and delivering projects;
  • providing contracted services and support;
  • handling incidents and following up on projects;
  • managing invoicing and administrative obligations.

Legal basis: mainly the performance of the contract and compliance with applicable legal obligations.

Security and technical operation

  • keeping our systems secure and preventing abuse;
  • detecting anomalous behaviour and diagnosing errors;
  • maintaining service continuity;
  • keeping reasonable technical evidence when necessary.

Legal basis: our legitimate interest in protecting our systems, services and users.

Marketing communications

Where there is an appropriate legal basis, we may send you information about our services. Where your consent is required, you can withdraw it at any time.

Non-essential analytics and marketing

  • measuring visits and how the website is used, to improve it (Google Analytics);
  • measuring our campaigns on Google, Facebook and Instagram and seeing which ads bring enquiries (Google Ads, the Meta pixel and the Conversions API);
  • showing ads to people who have already visited us (remarketing);
  • loading Facebook and Instagram content on the website.

Legal basis: your consent, which you can withdraw or change at any time in the cookie manager. They are not active yet.

Enquiries from Facebook and Instagram

  • replying to what you ask us in a Facebook or Instagram form;
  • preparing a diagnosis or a proposal.

Legal basis: taking steps at your request before entering into a contract.

Providing Big Plum Connect

  • connecting an authorised account to the WhatsApp Business Platform;
  • identifying the connected WhatsApp Business account and business phone numbers;
  • retrieving authorised WhatsApp Business assets;
  • retrieving, managing, creating and sending message templates;
  • sending requested messages through the WhatsApp Business Platform;
  • receiving message and status events via webhooks;
  • checking that the integration works and providing support;
  • preventing unauthorised use and keeping the service secure and intact.

Legal basis: depending on the case, the performance of a contract, the provision of a service requested by the user or client company, compliance with the documented instructions of the data controller, or our legitimate interest in the security and proper operation of the service.

04Recipients and providers

To provide our services we work with specialist providers of hosting, technology infrastructure, email, forms, analytics, advertising, automation, invoicing, technical support and professional advice. They only process data when necessary to provide their services and under the corresponding legal and contractual terms.

Requests you send through our forms are delivered to our own request and client management panel.

Hosting

Our website, our panel and Big Plum Connect are hosted on servers in Germany, within the European Economic Area, provided by a specialised hosting provider. Backups are stored in the same provider’s storage service, also in Germany. Some of its technical subcontractors are in Switzerland, which has an adequacy decision from the European Commission.

Google

With your consent we will use Google Analytics and Google Ads, from Google Ireland Limited (Ireland) and Google LLC (United States). In Google Analytics, Google processes the data on our behalf, as a processor. In Google Ads, it also uses it for its own advertising purposes, as an independent controller. You can read how Google processes it on its business data responsibility site. They are not active yet.

Meta: advertising, content and forms

With your consent we will use the Meta pixel, the Conversions API and Facebook and Instagram content, from Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (United States). We are joint controllers with Meta for collecting your data on our website and sending it to Meta, under Meta’s joint controller terms for its business tools. Meta is solely responsible for what it does with the data afterwards, under its privacy policy. If you fill in a form on Facebook or Instagram, Meta passes us the data you enter. They are not active yet.

Meta and the WhatsApp Business Platform

To provide Big Plum Connect we use services from Meta Platforms and the WhatsApp Business Platform. Through this integration, Big Plum Connect may receive from Meta and send to Meta the data technically needed to perform the functions authorised by the user or client company:

  • WhatsApp Business assets and templates;
  • account, phone number and message identifiers;
  • statuses and webhook events;
  • recipients and parameters needed to send messages.

Meta and WhatsApp also carry out their own processing under their terms, policies and legal obligations, described in the Meta Privacy Policy and the WhatsApp Privacy Policy.

International transfers

Some providers, such as Google or Meta, may process data outside the European Economic Area, particularly in the United States. In those cases we rely on mechanisms recognised by law:

  • the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified;
  • the European Commission’s standard contractual clauses;
  • other legally valid mechanisms.

05Retention

We keep data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.

Requests and forms

Up to 24 months, unless they become a contractual relationship, there is a legal obligation to keep them, or they need to be kept longer to deal with possible liabilities.

Clients, contracts and invoicing

For the duration of the contractual relationship and then for the applicable legal, accounting or tax periods, usually up to 5 years where relevant.

Marketing communications

Until you withdraw your consent, unsubscribe or object to the processing where applicable.

Analytics and advertising

Cookies last as stated in our cookie policy. We will set Google Analytics to keep event data for 14 months, and remarketing audiences will last at most 540 days in Google Ads and 180 days in Meta. Data from Facebook and Instagram forms is kept like any other enquiry.

Technical and security logs

For as long as strictly necessary to ensure security, diagnose problems, prevent abuse, investigate incidents and maintain service continuity.

Data processed through Big Plum Connect

Big Plum Connect is designed around data minimisation. The current version does not store message content or recipient phone numbers: it sends them to the WhatsApp Business Platform to perform the requested function and does not keep them. For each event received via webhooks it only keeps a technical summary (type and number of events, business phone number identifier, and date and time).

These technical logs are kept for a maximum of 90 days, to identify the integration, check that it works, diagnose incidents, ensure security and meet legal or contractual obligations. If a security incident occurs, we keep the logs and copies needed to investigate it, or to establish, exercise or defend legal claims, only for as long as strictly necessary.

When Big Plum Digital acts as a data processor on behalf of a client company, retention also depends on that company’s instructions and the applicable data processing agreement.

06Your rights

You can exercise the rights granted to you by data protection law:

  • access;
  • rectification;
  • erasure;
  • restriction of processing;
  • data portability;
  • objection;
  • withdrawal of consent, which does not affect the lawfulness of prior processing.

To exercise them, write to hola@bigplumdigital.com or hej@bigplumdigital.com. We will reply within one month of receiving your request; if it is complex, we may extend this by two further months and will let you know.

We may ask for additional information when necessary to verify your identity and prevent anyone else from accessing or changing your data improperly.

You can also lodge a complaint with Datatilsynet, the Danish Data Protection Agency.

07Big Plum Connect and the WhatsApp Business Platform

Big Plum Connect is a tool operated by Big Plum Digital to integrate and manage certain WhatsApp Business Platform functions. It can be used for Big Plum Digital’s own needs and, where relevant, to provide technology services to other companies that voluntarily connect their WhatsApp Business accounts.

Information it may receive

  • WhatsApp Business Account identifiers;
  • Phone Number ID and other technical identifiers;
  • name of the connected account and authorised business assets;
  • template information and statuses;
  • message identifiers and statuses;
  • technical events and information received via webhooks;
  • the recipient’s phone number, when needed to perform an action;
  • data the user enters in template parameters;
  • other information needed to perform the functions authorised by the connected company.

How this data is used

Big Plum Connect uses this data only to provide the requested functions: connecting and managing authorised assets, managing templates and checking their status, sending messages with authorised templates, receiving and processing statuses and events, diagnosing technical problems, providing support and keeping the service secure.

Conversations and messages

Big Plum Connect does not use information received through WhatsApp to sell personal data, build its own advertising profiles, sell databases or carry out behavioural advertising unrelated to the purpose for which it was obtained.

Events sent by WhatsApp may include the content of incoming messages. The current version processes them on arrival to verify their origin and record their technical status, and does not store that content. It is not designed as a conversation repository either.

Relationship with client companies

When a company connects its WhatsApp Business account to Big Plum Connect, that company is the controller of the data of its own customers and contacts. Big Plum Digital acts as a data processor, processes the information only to provide the service and on the company’s instructions, and puts the corresponding data processing agreement in place when required.

Security

  • credentials and secrets stored only on the server;
  • restricted access to private configuration;
  • encrypted communications over HTTPS;
  • validation of requests received from Meta and cryptographic verification of webhook signatures;
  • access control for the panel;
  • minimal stored data and technical logs limited to what is needed for security and troubleshooting.

No system can guarantee absolute security, but we maintain technical and organisational measures proportionate to the risk and review the service configuration when necessary.

08Deleting Big Plum Connect data

You can request the deletion of personal data processed by Big Plum Connect by writing to hola@bigplumdigital.com or hej@bigplumdigital.com. Please say that your request relates to Big Plum Connect and include the information needed to find the data, such as the phone number or the WhatsApp Business account concerned.

We may ask for a reasonable identity check before deleting the data, to protect it against fraudulent requests.

What we will do

  1. identify the data processed by Big Plum Digital related to the request;
  2. delete or anonymise the data we no longer need to keep;
  3. let you know, within 30 days at most, that the request has been completed or whether we need more information.

Some data may be kept where there is a valid legal basis, such as legal, tax or accounting obligations, fraud prevention, security, or the establishment, exercise or defence of legal claims.

Data processed on behalf of a client company

If we process the data as a processor on behalf of a Big Plum Connect client company, we may pass your request on to that company, tell you who the controller is and carry out the deletion on its instructions.

Information kept by Meta or WhatsApp

Deleting the data processed directly by Big Plum Digital does not automatically delete information that Meta or WhatsApp keep independently. For that information you should also use the privacy and data rights tools provided by Meta and WhatsApp.

09Children

Our services are aimed at businesses and professionals. They are not directed at children under 16 and we do not knowingly process their data. If you believe a child has given us personal data, write to hola@bigplumdigital.com and we will delete it.

10Cookies and similar technologies

Today our website only stores your cookie choice, in the browser’s local storage. Google’s and Meta’s analytics and advertising cookies are not active yet; once they are, they will only work with your consent, and you will be able to change your choice at any time in the cookie manager.

You will find all the details in our cookie policy.

11Changes to this policy

We may change this policy due to changes in our services, new features, technological changes, new providers, legal changes or the evolution of Big Plum Connect. When we make relevant changes, we will update the date shown at the top. The version published on this page is the one that applies at any given time.

12Contact

For any questions about this policy or about how your personal data is processed:

Company
Big Plum Digital
CVR
45246000
Address
Lodsholmvej 36, 9270 Klarup, Denmark