1. What are cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently and to provide information to website owners. Cookies do not typically identify you as an individual — they identify your browser or device.
Cookies can be first-party (set by the website you are visiting) or third-party (set by a different domain, such as an analytics provider). They can be session cookies (deleted when you close your browser) or persistent cookies (which remain on your device for a defined period).
2. Who sets cookies on this site?
This website is operated by Opera Capital Management Ltd, trading as Not A Big Four, a company registered in England and Wales (Company No. 08355935). We are the data controller for cookies set directly by this website.
Where we use third-party services, those providers may set their own cookies subject to their own privacy and cookie policies. The third-party services currently integrated into this website are:
- GoDaddy Inc. — domain registration and web hosting provider. GoDaddy may process server-level data (including IP addresses and access logs) as part of delivering the hosting infrastructure. GoDaddy’s privacy policy is available at godaddy.com/legal/agreements/privacy-policy.
- Google LLC (Google Analytics) — website analytics. Google may set cookies on your device when you visit our website if you have consented. Google’s privacy policy is available at policies.google.com/privacy.
- Cal.com Inc. — appointment and consultation booking. When you click our booking link, you are directed to a cal.eu hosted booking page. Cal.com may set its own cookies and process your personal data (name, email, and selected time slot) as an independent data controller. Cal.com’s privacy policy is available at cal.com/privacy.
- Microsoft Corporation — business email communications via Microsoft 365. Microsoft may process email metadata as part of delivering our email service. Microsoft’s privacy policy is available at privacy.microsoft.com.
Please note: clicking the “Book a free consultation” button on our website takes you to a cal.eu booking page operated by Cal.com Inc. From that point, you are interacting with Cal.com’s platform and their terms and privacy policy apply.
3. What cookies do we use?
3.1 Strictly necessary cookies
These cookies are essential for the website to function. They cannot be disabled. They do not store any personally identifiable information.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| cookie_consent | notabig4.com | Stores your cookie consent preferences so we don’t ask on every page visit | 12 months |
| PHPSESSID / wp_session | notabig4.com (GoDaddy hosting) | WordPress session management — maintains your session state while browsing. Set by the WordPress installation on GoDaddy’s hosting infrastructure. | Session |
| wordpress_logged_in_* | notabig4.com | Used only by authenticated users (e.g. site administrators). Not set for regular visitors. | Session |
Our website is hosted by GoDaddy Inc. (GoDaddy Group, Inc., 14455 N. Hayden Road, Suite 226, Scottsdale, Arizona 85260, USA). As our hosting provider, GoDaddy processes web server access logs which include IP addresses, browser type, pages visited and timestamps. GoDaddy participates in the EU-US Data Privacy Framework. Full details are available in GoDaddy’s Privacy Policy and their Data Processing Agreement.
3.2 Analytics cookies
These cookies help us understand how visitors interact with our website — which pages are visited, how long people stay, and where they come from. This data is aggregated and anonymous. We use this information to improve the website.
You can opt out of analytics cookies via our cookie banner or your browser settings. If you opt out, we will only set the strictly necessary cookies listed above.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique users by assigning a randomly generated number. Used to calculate visit, session and campaign data for analytics reports. | 2 years |
| _ga_* | Google Analytics | Used to persist session state | 2 years |
| _gid | Google Analytics | Distinguishes users. Stores and updates a unique value for each page visited. | 24 hours |
We have configured Google Analytics with IP anonymisation enabled, meaning your IP address is truncated before any data is stored. We do not enable Google Signals or use Google Analytics data for advertising purposes. Google’s privacy policy is available at policies.google.com/privacy.
3.3 Third-party booking cookies (Cal.com)
When you click the “Book a free consultation” button on our website, you are redirected to a booking page hosted by Cal.com Inc. Cal.com may set cookies on your device for the following purposes:
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| cal-session-id and related session cookies | cal.com | Manages your session on the Cal.com booking platform — keeps your booking progress intact during the scheduling process | Session |
| Cal.com analytics / preference cookies | cal.com | Cal.com may set additional cookies for platform analytics and functionality. These are governed by Cal.com’s own cookie policy. | Varies |
Cal.com is not our data processor for the purposes of your booking — it acts as an independent data controller when you use their platform. By proceeding to our cal.eu booking page, you are subject to Cal.com’s own terms of service and privacy policy: cal.com/privacy and cal.com/terms. We receive only the booking confirmation details (name, email, selected time) necessary to prepare for and conduct the consultation.
3.4 Other functional cookies
We do not currently use other functional cookies (cookies that remember your preferences such as language or region). If this changes, we will update this policy and request your consent where required.
4. Cookies we do not use
We want to be explicit. This website does not use:
- Advertising or targeting cookies
- Social media tracking pixels (Facebook Pixel, LinkedIn Insight Tag, etc.)
- Cookies that track your behaviour across other websites
- Cookies that build profiles for the purposes of profiling or automated decision-making
- Any cookie that stores sensitive personal information
Please note that once you leave our website and proceed to a third-party platform such as Cal.com, the above commitment applies only to our own website. Third-party platforms operate under their own cookie policies, which we cannot control.
5. Your choices and how to manage cookies
5.1 Cookie consent banner
When you first visit this website, you will be shown a cookie consent banner. You can accept or decline non-essential cookies at that point. You can change your preferences at any time by clicking the “Cookie Settings” link in the footer of the website.
5.2 Browser settings
You can also control cookies directly through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and receive a warning before cookies are stored. Please note that disabling all cookies may affect the functionality of some websites, including this one.
Instructions for common browsers:
5.3 Opt out of Google Analytics
You can prevent Google Analytics from collecting data about your use of this website by installing the Google Analytics Opt-out Browser Add-on.
6. Changes to this policy
We may update this Cookie Policy from time to time — for example, if we add new features or services to the website. Any changes will be posted on this page with an updated effective date. If the changes are significant, we will display a prominent notice on the website.
We encourage you to review this policy periodically. Your continued use of the website after any changes constitutes your acceptance of the updated policy in respect of strictly necessary cookies. For non-essential cookies, we will re-request your consent if required by applicable law.
7. Contact
If you have questions about our use of cookies or this policy, please contact us:
Opera Capital Management Ltd
Trading as Not A Big Four
2nd Floor, 33 Newman Street, London W1T 1PY
Registered in England and Wales — Company No. 08355935
Email: hello [at] notabig4.com
If you are based in the EU and have a concern that we have not resolved, you have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu. If you are based in the UK, you may contact the Information Commissioner’s Office (ICO).
1. Who we are
Opera Capital Management Ltd (trading as Not A Big Four) is the data controller for personal data collected through this website and in the course of our business activities.
Opera Capital Management Ltd
Trading as Not A Big Four
2nd Floor, 33 Newman Street, London W1T 1PY
Registered in England and Wales — Company No. 08355935
Email: hello [at] notabig4.com
This policy applies to personal data we process about visitors to our website (notabig4.com), prospective clients, current and former clients, business contacts, and any other individuals whose data we handle in the course of our operations.
This policy complies with the UK GDPR and the Data Protection Act 2018, as well as the EU General Data Protection Regulation (EU) 2016/679 insofar as we process the personal data of individuals located in the European Economic Area.
2. What data we collect and why
2.1 Website enquiries
When you contact us via our website or by email, we may collect your name, email address, company name and the content of your message.
Why: To respond to your enquiry and assess whether we can be of assistance to you.
2.2 Client and business relationship data
Where you engage us as a client or enter into discussions with a view to doing so, we may collect and process:
- Contact details (name, email, telephone, business address)
- Business information (company name, registration details, sector, size)
- Information necessary to fulfil our engagement (which may include commercial, financial or operational data depending on the scope of work)
- Correspondence and communications
Why: To deliver our consultancy services, manage our client relationship, fulfil our contractual obligations, and comply with our legal and regulatory obligations.
2.3 Website analytics data
We use Google Analytics to collect aggregated, anonymised information about how visitors use our website. This includes pages visited, time spent on the site, device and browser type, and approximate geographic location (country/city level). This data does not identify you as an individual.
Why: To understand how the website is used and to improve its content and functionality. This processing is based on your consent, given via our cookie banner.
2.4 Booking and consultation data
When you book a free consultation via our cal.eu booking page, the following data is collected and shared with us by Cal.com:
- Your name
- Your email address
- Your selected date and time
- Any notes or additional information you choose to provide in the booking form
Why: To confirm, prepare for and conduct the consultation. Legal basis: legitimate interests (taking pre-contractual steps at your request) and, where a client relationship develops, contract performance.
Please note that Cal.com operates as an independent data controller for the data you submit on their platform. Their privacy policy governs that relationship: cal.com/privacy.
2.5 Data you provide in other contexts
We may also collect personal data when you connect with us via LinkedIn or other professional platforms, attend an event at which we are present, or are referred to us by a mutual contact.
3. Legal bases for processing
Under UK GDPR and EU GDPR, we must have a legal basis for each type of processing activity. Our legal bases are:
- Contract (Art. 6(1)(b)): Processing necessary to perform a contract with you, or to take steps at your request before entering a contract. This applies to the delivery of our consultancy services.
- Legitimate interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests, where those interests are not overridden by your rights. This applies to responding to enquiries, maintaining business records, and improving our website.
- Legal obligation (Art. 6(1)(c)): Processing necessary to comply with a legal obligation, including applicable financial services regulations, tax law, and anti-money laundering requirements.
- Consent (Art. 6(1)(a)): Where you have freely given, specific and informed consent. This applies to non-essential cookies and to any direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
4. Who we share your data with
We do not sell, rent or trade your personal data. We share your data only in the following limited circumstances:
4.1 Service providers (data processors)
| Provider | Purpose | Location | Privacy policy |
|---|---|---|---|
| GoDaddy Inc. | Domain registration and website hosting. Processes server access logs (IP addresses, browser data, page requests) as part of delivering hosting infrastructure. | USA — EU-US Data Privacy Framework; SCCs apply for UK transfers | Privacy Policy · DPA |
| Google LLC | Website analytics via Google Analytics (anonymised, IP-truncated). | USA — EU-US Data Privacy Framework; SCCs apply for UK transfers | Privacy Policy · Data Processing Terms |
| Cal.com Inc. | Appointment scheduling. Processes booking data submitted via our booking page. Cal.com acts as an independent data controller, not our processor. | USA — Cal.com’s own data transfer mechanisms apply | Privacy Policy · Terms |
| Microsoft Corporation | Business email communications via Microsoft 365. Processes email metadata as part of delivering our email service. | USA / EU — EU-US Data Privacy Framework; Microsoft Data Protection Addendum applies | Privacy Statement · GDPR commitments |
4.2 Legal and regulatory disclosure
We may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by law or where necessary to protect our legal rights or those of a third party.
4.3 Professional advisers
We may share data with our lawyers, accountants or insurers where necessary for the conduct of our business, subject to appropriate confidentiality obligations.
5. International transfers
Some of our third-party service providers are located outside the UK and/or EEA. Where we transfer personal data internationally, we ensure appropriate safeguards are in place.
| Provider | Country | Transfer mechanism |
|---|---|---|
| GoDaddy Inc. | United States | EU-US Data Privacy Framework (certified). UK transfers covered by GoDaddy’s IDTA. See GoDaddy DPA. |
| Google LLC | United States | EU-US Data Privacy Framework (certified). SCCs for UK transfers. IP anonymisation enabled. See Google Data Processing Terms. |
| Cal.com Inc. | United States | Cal.com is an independent data controller. Their own transfer mechanisms apply. Review cal.com/privacy before submitting a booking. |
| Microsoft Corporation | USA / EU (data residency options available) | EU-US Data Privacy Framework. Microsoft Data Protection Addendum includes SCCs. See Microsoft GDPR commitments. |
6. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Website enquiries (non-client) | 12 months from last contact | Legitimate interest in follow-up; deleted if no relationship develops |
| Consultation booking data (via Cal.com) | 12 months if no engagement follows; 7 years if client relationship develops | Legitimate interests / contract performance |
| Client engagement records | 7 years from end of engagement | Legal and regulatory obligations, including Companies Act and tax requirements |
| AML/KYC records (where applicable) | 5 years from end of business relationship | Proceeds of Crime Act 2002 / Money Laundering Regulations 2017 |
| Marketing communications consent | Until consent is withdrawn, plus 1 year for records | Consent-based; record kept to demonstrate compliance |
| Analytics data (Google Analytics) | 26 months (Google default) | Statistical purposes; anonymised data only |
7. How we protect your data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These measures include:
- Encrypted data transmission (TLS/HTTPS) for all website communications
- Access controls limiting data access to those with a legitimate need
- Use of reputable, security-vetted service providers
- Regular review of our data handling practices
- Strong password policies and multi-factor authentication on systems that hold personal data
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify you directly.
8. Your rights
Under UK GDPR and EU GDPR, you have the following rights. We will respond to all verified requests within one month of receipt.
You have the right to request a copy of the personal data we hold about you (a Subject Access Request).
You have the right to ask us to correct inaccurate personal data or complete incomplete data.
You have the right to ask us to delete your personal data in certain circumstances.
You have the right to ask us to pause processing your data while a request is resolved.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, machine-readable format.
You have the right to object to processing based on legitimate interests, and to processing for direct marketing purposes.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
You have the right not to be subject to decisions based solely on automated processing. We do not engage in such processing.
9. Children’s data
Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it promptly.
10. Third-party services and links
- Cal.com — our booking button takes you to a Cal.com hosted page. Cal.com is an independent data controller. cal.com/privacy
- GoDaddy — our domain and hosting provider. GoDaddy Privacy Policy
- Microsoft — our email service provider via Microsoft 365. Microsoft Privacy Statement
- LinkedIn — our website may link to LinkedIn profiles. LinkedIn operates as an independent platform. LinkedIn Privacy Policy
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Any changes will be published on this page with an updated effective date. Where changes are material, we will take reasonable steps to notify you.
12. Contact and complaints
For any questions about this policy, to exercise your rights, or to raise a concern about our data practices:
Opera Capital Management Ltd (trading as Not A Big Four)
2nd Floor, 33 Newman Street, London W1T 1PY
Company No. 08355935
Email: hello [at] notabig4.com
Supervisory authorities
If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the relevant supervisory authority:
- United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk — 0303 123 1113
- Italy: Garante per la protezione dei dati personali — garanteprivacy.it
- Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es
- EU (general): The supervisory authority of your EU member state of habitual residence, place of work, or place of the alleged infringement
We would however appreciate the opportunity to address your concern directly before you approach a supervisory authority.