Who is responsible
The data controller is Serallo Domains Ltd trading as BCP Web, company number 17217704. Registered office: Flat 2, Heather Court, 11a West Cliff Road, Bournemouth, Dorset, BH2 5EP, United Kingdom. Contact tom@bcpweb.com or 07356 243199 with a privacy question or request.
Information you provide
The enquiry form asks for your name, business name, email address and a description of what you would like to improve. You can also provide your website, telephone number, town or postcode and the service you are interested in. Digital-signage enquiries can include the number of screens, equipment and intended use.
The site records the website page associated with your enquiry, the submission time, an enquiry reference and notification status. A website address you submit is stored as part of the enquiry; the form does not automatically inspect it.
These details help me understand your request and contact you. You do not have to submit an online enquiry, and you can use email or telephone instead. Please do not send passwords, payment-card details or sensitive personal information through the form or chat.
Community project enquiries
If you email tom@serallo.co.uk about a community technology project, the organisation details, project summary and contact information you provide are used to discuss the idea and assess a possible future nomination. You are not added to a marketing list. Please avoid sensitive information about beneficiaries.
If we later agree to put a project forward, the agreed application details will be shared with Nominet for its GiveHub assessment, after checking our eligibility and the scheme rules. Making an initial enquiry does not automatically submit an application. Related correspondence is kept under the retention arrangements described in this notice.
Live chat
Live chat asks for your name, business name and a short enquiry. The private chat record contains these details, messages exchanged with Tom, message times, the known website page where the chat began and conversation status. It does not store campaign parameters as part of the conversation.
Opening chat sets a necessary cookie that identifies your conversation on this browser for up to 30 days. This lets you reopen the chat without entering your details again. Chat does not use your browser’s local or session storage to save messages, and it does not ask visitors for notification permission.
Messages are saved in encrypted records outside the public website directory and shown in Tom’s password-protected inbox. This uses the website’s own hosting rather than an embedded third-party chat service. Optional measurement tools do not receive the name, business or messages entered in chat, and the chat panel is masked from interaction recordings. The private inbox does not load those measurement tools.
Why the information is used
Your information is used to respond to your request, arrange discovery and, where agreed, prepare or manage consultancy work. Submitting an enquiry does not add you to a newsletter or marketing list.
Where you ask about a service for yourself, processing may be necessary to take steps at your request before entering a contract. For business-contact correspondence, enquiry handling and website security, the company relies on its legitimate interests in responding to genuine requests and running the service. Where required, information is retained to meet legal obligations. Optional analytics relies on your consent.
Storage and notification
Accepted enquiries are saved in encrypted records outside the public website directory before an email notification is attempted. This means a notification failure does not discard your enquiry.
SMTP2GO sends enquiry-form notification emails to Tom’s business email address. Hosting and business email providers also process information as needed to operate the website and handle correspondence. Google and Contentsquare process optional website measurement data only when their respective tools are configured and you allow them.
Tom can enable browser push notifications for his own inbox devices. Their push subscriptions are stored in the encrypted private chat records. Push alerts contain a generic message that a visitor is waiting and a link to the private inbox; they do not contain your name, business or enquiry text. The device’s browser push provider processes technical delivery information. Visitors are not subscribed to these alerts.
Relevant service providers may process information outside the UK under their applicable transfer arrangements. Contact tom@bcpweb.com for information about the providers, countries and safeguards in use, or to request a copy of the relevant safeguards.
Business work orders and optional connection details
The urgent PHP work-order form collects the business and billing address, signer name and authority, verified contact email, contact phone, systems in scope and explicit agreement confirmations. It records the exact terms version, typed signature, verification and acceptance times, and limited IP address and browser evidence to administer and evidence the signed instruction. The signed instruction is an offer; BCP Web accepts it by email or by starting authorised work under its terms.
Optional server and application access details are used only to arrange and carry out the authorised work. They are sealed in a separate encrypted record outside the public website directory, using a public key whose private decryption key is restricted to the server owner. Access details are not included in notification emails, customer receipts or signed-copy downloads, and are not copied back into a page after a failed submission. They are deleted when no longer needed and automatically expire no later than 30 days after submission. Please use temporary accounts and revoke or rotate them after the work.
Signed work-order evidence is stored separately in encrypted records and normally retained for six years from signature for business administration and legal claims. Necessary invoices, later approvals or records for an identified dispute may have separate lawful retention. Passwords are not retained with that six-year evidence. Contact tom@bcpweb.com to exercise rights or request an earlier review or deletion where applicable.
This signing flow does not load optional analytics, interaction recordings or live chat, even where a visitor previously allowed them elsewhere. The initial email-code request uses Cloudflare Turnstile for spam protection and SMTP2GO to send the verification email. The verified connection-details step does not load that third-party security script. SMTP2GO also sends the business notification and a signed terms and contact-details copy to the verified signer; private access details and system inventory are excluded from those emails.
For customer-system personal data processed while carrying out the work, the controller and processor responsibilities and instructions are set out in the service agreement, separately from BCP Web’s own administration of the signed work order.
Secure customer credential submissions
The separate credential page lets customers share optional server, SSH, file-transfer, website and other connection details for work they have already agreed with BCP Web. Visitors using the general form provide a name and email so we can identify the request; a personal submission link is associated with a customer or work reference by BCP Web. A personal link permits submission only and never permits viewing earlier submissions.
Connection details and identifying records are encrypted in storage outside the public website directory and sent over HTTPS. Only authorised BCP Web access through the protected administration area is used to view them. They are used only to arrange access and perform the agreed work. Notification emails contain a submission reference and a link to the protected administration area, never the submitted credentials.
When BCP Web marks the work complete, the associated submissions are destroyed from the credential store and the personal link is closed. Individual submissions can also be deleted sooner. Uncompleted submissions automatically expire after 30 days and are removed by scheduled maintenance. Please use temporary named accounts where possible, and revoke or rotate access when work ends. Contact tom@bcpweb.com if you need earlier deletion.
This flow does not load advertising, analytics, session replay or chat. A security check runs before access fields are shown; its third-party script is absent from the credential-entry and administration views. The administration area sends a short-lived login code only to BCP Web’s configured owner inbox. Necessary session cookies, security tokens and rate limits protect the form and administration actions.
Retention
The private website enquiry store has a configured retention period of 90 days. Information needed for an active enquiry or engagement may also be kept in business correspondence and project records.
Chat conversations are removed from the live chat store once there has been no message activity for 90 days, when scheduled or request-triggered maintenance runs. Expired chat-browser and inbox-login records are also removed during maintenance. Information copied into business correspondence or project records is subject to the separate retention described below.
Retention of correspondence, project records and backups depends on whether the information is still needed to handle the enquiry, deliver agreed work, maintain necessary business records or meet legal obligations. Contact tom@bcpweb.com to ask about a particular record or request deletion. Some information may need to be retained for a legal obligation or another legitimate reason.
Security and basic website operation
The hosting environment may record your IP address, requested page, request time and technical errors to keep the website working and investigate misuse. The enquiry form and chat use necessary cookies, security tokens and limits on repeated submissions to reduce abuse.
The cookie notice explains the necessary form, chat and private-inbox cookies, as well as optional analytics. You can submit an enquiry or use chat without accepting analytics.
Enquiry-form bot protection
The enquiry form uses Cloudflare Turnstile to help distinguish genuine visitors from automated spam. Cloudflare processes technical security signals, including your IP address, browser information and the website origin, to assess the check and improve its bot detection.
The site sends a challenge token and a security identifier to Cloudflare for verification. It does not send the name, business, email address or message you enter in the form as part of this verification. Security tokens are not included in enquiry records or deliberately sent to optional measurement providers.
This security check works independently of optional analytics choices. If it cannot complete, your message remains in the form and you can retry or contact Tom by email, telephone or live chat instead.
Optional visit measurement
Visit measurement uses Google Analytics 4 when configured and you allow that category. It helps show which pages and audit links visitors use, which contact methods they click, whether they open chat and whether the site has accepted an enquiry or a new chat. An accepted form-enquiry event can include the selected service and the known website page associated with the form. Chat events identify only the known website page and the action taken.
Page addresses exclude arbitrary URL parameters and search terms. Only known website paths, recognised service and source markers, and restricted campaign source, medium, campaign and content labels are used. Google Analytics receives only the referring website’s origin, without its page path or query string.
Contact details, business names, submitted website addresses, enquiry messages and enquiry reference numbers are not deliberately sent to either measurement provider. Email, telephone and WhatsApp clicks indicate interest; they do not establish that a conversation or sale took place.
Optional interaction recordings
Interaction recordings use Contentsquare when configured and you allow that category. It processes pseudonymous visitor and session identifiers, device and browser information, page visits and interactions such as clicks, scrolling and navigation. Heatmaps and session replays help identify confusing pages and improve the enquiry journey.
A session replay reconstructs interactions within this website. The site masks enquiry-form fields and their contents, the entire chat panel and its messages, security tokens, validation echoes, enquiry references and areas marked as containing personal information. It does not deliberately associate a recording with your name or contact details.
Contentsquare receives a restricted page path and allowlisted campaign and service markers. Referrer query strings are removed. Its data collection is excluded from search, error and private routes.
Campaign attribution and your choices
If you allow either optional category, this site can remember restricted campaign labels and the landing page for your current browser session. If you then submit the enquiry form, those labels and the landing page can accompany the encrypted form-enquiry record and notification email. This helps understand which promotion led to a genuine enquiry. Campaign attribution is not stored in the form enquiry when both optional categories are refused.
You can refuse both categories, allow either separately or change your preferences through Privacy choices on public pages where the tools are available. No requests to these measurement providers are made before an applicable choice allows them. Refusal does not prevent you submitting an enquiry or using chat.
Withdrawing consent stops further collection by the relevant integration and removes its first-party measurement cookies where possible. If you allow interaction recordings again after stopping them on a page, collection may resume on your next page visit. External services such as WhatsApp have their own privacy arrangements; this site does not embed a WhatsApp chat widget.
Your rights and contact
Depending on the circumstances, you can request access to your information, correction, erasure, restriction or portability. Contact tom@bcpweb.com to make a request.
You can object to processing based on legitimate interests. You can also withdraw analytics consent through Privacy choices, without affecting the lawfulness of processing carried out before withdrawal.
You have the right to complain to the UK Information Commissioner’s Office. You are welcome to contact me first so I can help resolve your concern.