1. Who is responsible
Serallo Domains Ltd, company number 17217704, is the controller for the personal information described in this notice. Our registered office and postal address is Flat 2, Heather Court, 11a West Cliff Road, Bournemouth, Dorset, BH2 5EP, United Kingdom. Privacy correspondence and rights requests: tom@serallo.co.uk.
This notice covers personal information handled through the Serallo website and our email and postal correspondence.
2. Information we handle
Technical connection information. Serving a website involves receiving an IP address and request details. Hosting, security and email infrastructure may log the requested page, date and time, browser or device information, referrer where supplied, and error or security events. Our website has no audience-analytics script or advertising tracker.
Correspondence. If you email or write to us, we receive the information you choose to provide, such as your name, reply address, message, domain details and attachments. Email systems also process delivery and anti-spam information.
Complaints and reports. A report may include information about a complainant, an authorised representative, a person mentioned in the report, technical evidence, URLs and relevant correspondence. We ask only for information reasonably needed to consider the issue.
Most information comes from you. A report may also be provided by an authorised representative, a rights holder, a service provider, Nominet or a competent authority. Where a case requires a public-record check, relevant information may come from public websites, Companies House or a registry’s lawful lookup facilities. We will identify the actual source and provide further privacy information when required.
3. What the website does not collect
There is no web enquiry form, account registration, checkout, newsletter subscription or database that collects visitor messages. Email links open your own email application; a message reaches us only if you send it.
The site’s own code does not set cookies, use browser storage, embed external media, or run analytics or tracking pixels. All styles and scripts are served from this website. Your browser and email provider have their own history, security, draft and synchronisation behaviour. See our cookie notice.
4. Purposes and lawful bases
General correspondence and company administration: our legitimate interests in running the business, answering relevant questions and keeping an appropriate record of communications.
Website operation, security, complaints and abuse: our legitimate interests in providing a reliable information site, protecting systems and registrations, investigating concerns and preventing misuse. We assess whether the processing is necessary and balance those interests against people’s rights.
Legal compliance: legal obligation where a specific duty requires us to respond to a rights request, comply with a lawful order or keep required records. Where we rely on this basis for a particular request, we can explain the applicable duty.
Legal claims: legitimate interests in establishing, exercising or defending legal rights, subject to applicable conditions. We do not treat an ordinary company enquiry as consent to marketing.
We do not ask for sensitive personal information. If a report contains special-category information or criminal-offence allegations, we will only retain or use what is necessary and for which the additional legal conditions are satisfied; otherwise we will remove or redact it.
5. Who may receive information
Information may be processed by our hosting, DNS, security, backup and email-communications providers as needed to operate the site and correspondence channels. Access within Serallo is limited to authorised people who need it.
Relevant information may also be shared with professional advisers, a responsible host or registrar, Nominet, a dispute-resolution provider such as WIPO, a regulator, law enforcement or a court where necessary and lawful for a specific matter. We do not sell personal information.
Providers acting on our instructions must be subject to appropriate data-protection arrangements. Other recipients, such as regulators or a registry acting under its own rules, may be separate controllers. We avoid unnecessary disclosure, including of a reporter’s identity.
6. International processing
Hosting and communication providers may operate infrastructure or support in more than one country. A person sending or receiving a report may also be outside the UK. We do not promise that all handling is confined to the UK.
Where a restricted international transfer is necessary, it must have a lawful mechanism, such as applicable UK adequacy arrangements or appropriate safeguards, including the UK International Data Transfer Agreement or UK Addendum where relevant, with the required assessment. You may contact us for the recipients and countries relevant to your information and a copy or explanation of the applicable safeguards.
7. Retention: how long information is kept
We retain personal information only for as long as reasonably needed for its purpose. The following criteria determine retention rather than a single period for every type of record.
Routine correspondence: until the question and reasonably expected follow-up are finished, unless specific information is still needed for a complaint, legal obligation or claim.
Complaints, abuse and security evidence: while the investigation, review and necessary follow-up continue, with further retention only where justified by an ongoing risk, a legal requirement or a relevant claim period.
Technical logs and backups: for the period reasonably necessary for security, diagnosing faults and recovery, taking account of the configured provider retention and backup cycle. Relevant incident evidence may be isolated and held separately while needed.
We review records, remove unnecessary information and delete or anonymise it when no longer required. A documented legal hold may delay deletion of particular records; access and use remain restricted. Contact us for the retention arrangements relevant to your information.
8. Your data rights
You can contact tom@serallo.co.uk or write to us to request access to your personal information, correction of inaccuracies, erasure or restriction where the applicable conditions are met. Data portability applies in the circumstances provided by law, generally to qualifying automated processing based on consent or contract; it is not a general right to every business record.
Where a specific activity is based on consent, you can withdraw it without affecting earlier lawful processing. We do not rely on consent for the routine processing described above. No decisions with legal or similarly significant effects on individuals are made solely by this website’s automated processing.
We normally respond to a rights request within one month and without undue delay. If a lawful extension or other permitted adjustment is needed, we explain it and the reason. We may ask for proportionate identity information. Requests are normally free; any permitted fee or refusal will be explained.
9. Your right to object
Email tom@serallo.co.uk and explain the circumstances. We will stop the relevant processing unless we can demonstrate grounds that lawfully override the objection or need the information for legal claims.
You have an absolute right to object to direct marketing. We do not operate a marketing mailing list or use enquiries to enrol you in one.
10. Information you choose not to provide
You can read the site without giving us your name or email address. Basic connection data is necessary to deliver pages. You are not obliged to send us an enquiry or report.
We may be unable to reply without a return address, verify a requested disclosure without sufficient authority, or investigate a report without necessary details. Where specific information is legally required, we will explain what is required and why. We do not make an initial abuse acknowledgement conditional on complete supporting evidence.
11. Privacy complaints
Email tom@serallo.co.uk with “Privacy complaint” in the subject, or write to the Director at our postal address. We aim to acknowledge within two working days and will do so within five working days where a reply address is available. We investigate without undue delay, provide updates and explain the outcome under our complaints procedure.
You have the right to complain to the Information Commissioner’s Office (ICO). Its contact page provides current contact details. Giving us an opportunity to resolve the matter does not remove your right to contact the regulator.
12. Changes to this notice
We will review this notice when our website, activities or use of personal information changes, and provide any additional information required. The current version and date are shown above.