Privacy policy.

1. Who is responsible

Serallo Domains Ltd, company number 17217704, is the controller for the personal information described in this notice. Our registered office and postal address is Apt 2, 11a West Cliff Road, Bournemouth, Dorset, BH2 5EP, United Kingdom. Privacy correspondence and rights requests: tom@serallo.co.uk.

This notice covers our corporate website, domain enquiries, private sales, Lease to Buy arrangements, registration services and correspondence, including funding project enquiries. A separate sale page, checkout or marketplace may provide additional information about its own processing before you use it.

2. Information we handle

Technical connection information. Serving a website involves receiving an IP address and request details. Hosting, security and email infrastructure may log the requested page, date and time, browser or device information, referrer where supplied, and error or security events. Our website has no audience-analytics script or advertising tracker.

Correspondence. If you email or write to us, we receive the information you choose to provide, such as your name, reply address, message, domain details and attachments. Email systems also process delivery and anti-spam information.

Domain purchases and registrations. We handle the name and contact details of a buyer, registrant or authorised representative, relevant organisation details, the domain, agreed terms, instructions, transaction references and payment status. Registration administration also involves the contact and domain information required by the registry. We may request proportionate evidence of identity or authority for a transaction or registration change. Please do not send passwords, full payment-card details or identity documents in an initial enquiry.

Funding project enquiries. If you contact us about a possible Nominet Members’ GiveHub nomination, we receive your organisation and project details, contact information, and any costs, timescales or intended benefits you share. Please describe benefits in general terms or totals, without personal records about beneficiaries.

Complaints and reports. A report may include information about a complainant, an authorised representative, a person mentioned in the report, technical evidence, URLs and relevant correspondence. We ask only for information reasonably needed to consider the issue.

Most information comes from you. Relevant information may also come from your authorised representative, the marketplace or payment provider involved in your transaction, a responsible registrar, Nominet, a rights holder or a competent authority. Where a case requires a public-record check, relevant information may come from public websites, Companies House or a registry’s lawful lookup facilities. We will identify the actual source and provide further privacy information when required.

3. What this corporate website collects

The public corporate pages at serallo.co.uk have no web enquiry form, customer account, checkout or newsletter subscription. The domain directory displays public listings and links to pay.serallo.co.uk for purchases. Search terms and filter selections are sent to this website to return matching listings. Email links open your own email application; a message reaches us only if you send it.

The corporate site’s own code does not set cookies, use browser storage, embed external media, or run analytics or tracking pixels. All styles and scripts are served from this website. Your browser and email provider have their own history, security, draft and synchronisation behaviour. See our cookie notice.

Individual domain sale pages, separate payment pages and external marketplaces can have different features and notices. The statements about this corporate website do not mean that those transaction services collect no personal information. Dropsnare is in development; information about its data handling will be provided when its service becomes available.

4. Purposes and lawful bases

Individual customer enquiries and services: processing necessary to take steps you request before a contract, or to perform our contract with you, including a quote, domain sale, Lease to Buy arrangement or registration service. This covers only information needed for the requested transaction and its administration.

Business representatives and registration administration: our legitimate interests in corresponding with a customer’s representatives, fulfilling business agreements, maintaining accurate registrations and keeping necessary transaction and authorisation records. When the contract is with a company, we do not treat that contract as a contract with its individual representative. We consider necessity and balance these interests against the person’s rights.

General correspondence, funding enquiries and company administration: our legitimate interests in running the business, answering relevant questions and keeping an appropriate record of communications. This includes considering funding project enquiries, discussing possible nominations and following up on those enquiries. We assess whether this processing is necessary and balance these interests against people’s rights.

Website operation, security, complaints and abuse: our legitimate interests in providing a reliable information site, protecting systems and registrations, investigating concerns and preventing misuse. We assess whether the processing is necessary and balance those interests against people’s rights.

Legal compliance: legal obligation where a specific duty requires us to respond to a rights request, comply with a lawful order or retain records required by tax or other applicable law. Where we rely on this basis for a particular request, we can explain the applicable duty.

Legal claims: legitimate interests in establishing, exercising or defending legal rights, subject to applicable conditions. We do not treat an ordinary company enquiry as consent to marketing.

We do not ask for sensitive personal information. If a report contains special-category information or criminal-offence allegations, we will only retain or use what is necessary and for which the additional legal conditions are satisfied; otherwise we will remove or redact it.

5. Who may receive information

Information may be processed by our hosting, DNS, security, backup and email-communications providers as needed to operate the site and correspondence channels. Access within Serallo is limited to authorised people who need it.

Relevant information may also be shared with professional advisers, a responsible host or registrar, Nominet, a dispute-resolution provider such as WIPO, a regulator, law enforcement or a court where necessary and lawful for a specific matter. We do not sell personal information.

For a domain transaction, we share the information needed with the registry, current or receiving registrar, and the marketplace or payment service involved in that transaction. This can include contact details, the domain, authorisation and transaction references. We do not send every customer’s details to every marketplace we use.

Nominet receives the information required to register and administer .UK domains and is responsible for its own registry processing. Its privacy notice explains how it uses and discloses that information. A marketplace or payment provider may also act as a separate controller for its own service.

For a funding project enquiry, we will share project and contact details with Nominet for a nomination only after discussing and agreeing that nomination with your organisation. We will explain what will be shared and check that the information is appropriate for the nomination.

Providers acting on our instructions must be subject to appropriate data-protection arrangements. Other recipients, such as regulators or a registry acting under its own rules, may be separate controllers. We avoid unnecessary disclosure, including of a reporter’s identity.

6. International processing

Hosting, communication, marketplace and transaction providers may operate infrastructure or support in more than one country. Customers, their representatives and people sending or receiving reports may also be outside the UK. We do not promise that all handling is confined to the UK.

Where a restricted international transfer is necessary, it must have a lawful mechanism, such as applicable UK adequacy arrangements or appropriate safeguards, including the UK International Data Transfer Agreement or UK Addendum where relevant, with the required assessment. You may contact us for the recipients and countries relevant to your information and a copy or explanation of the applicable safeguards.

7. Retention: how long information is kept

We retain personal information only for as long as reasonably needed for its purpose. The following criteria determine retention rather than a single period for every type of record.

Routine correspondence: until the question and reasonably expected follow-up are finished, unless specific information is still needed for a complaint, legal obligation or claim.

Sales and registration records: while needed to administer the agreement, payments, registration, renewal or handover, followed by retention of records needed for applicable tax or other legal duties, a complaint or a relevant claim. Retention depends on the record and purpose; an ended enquiry does not justify retaining every attachment indefinitely.

Funding project enquiries: while the enquiry or reasonably expected follow-up about a possible future nomination remains active. We review whether we still need the information as plans change. The same exceptions for a complaint, legal obligation or claim apply.

Complaints, abuse and security evidence: while the investigation, review and necessary follow-up continue, with further retention only where justified by an ongoing risk, a legal requirement or a relevant claim period.

Technical logs and backups: for the period reasonably necessary for security, diagnosing faults and recovery, taking account of the configured provider retention and backup cycle. Relevant incident evidence may be isolated and held separately while needed.

We review records, remove unnecessary information and delete or anonymise it when no longer required. A documented legal hold may delay deletion of particular records; access and use remain restricted. Contact us for the retention arrangements relevant to your information.

8. Your data rights

You can contact tom@serallo.co.uk or write to us to request access to your personal information, correction of inaccuracies, erasure or restriction where the applicable conditions are met. Data portability applies in the circumstances provided by law, generally to qualifying automated processing based on consent or contract; it is not a general right to every business record.

Where a specific activity is based on consent, you can withdraw it without affecting earlier lawful processing. We do not rely on consent for the routine processing described above. No decisions with legal or similarly significant effects on individuals are made solely by this website’s automated processing.

We normally respond to a rights request within one month and without undue delay. If a lawful extension or other permitted adjustment is needed, we explain it and the reason. We may ask for proportionate identity information. Requests are normally free; any permitted fee or refusal will be explained.

9. Your right to object

You have an absolute right to object to direct marketing. We do not operate a marketing mailing list or use enquiries to enrol you in one.

10. Information you choose not to provide

You can read the site without giving us your name or email address. Basic connection data is necessary to deliver pages. You are not obliged to send us an enquiry or report.

We may be unable to reply without a return address, complete a sale or registration without the required customer and registrant information, verify a requested disclosure without sufficient authority, or investigate a report without necessary details. Where specific information is legally required, we will explain what is required and why. We do not make an initial abuse acknowledgement conditional on complete supporting evidence.

11. Privacy complaints

Email tom@serallo.co.uk with “Privacy complaint” in the subject, or write to the Director at our postal address. We aim to acknowledge within two working days and will do so within five working days where a reply address is available. We investigate without undue delay, provide updates and explain the outcome under our complaints procedure.

You have the right to complain to the Information Commissioner’s Office (ICO). Its contact page provides current contact details. Giving us an opportunity to resolve the matter does not remove your right to contact the regulator.

12. Changes to this notice

We will review this notice when our website, activities or use of personal information changes, and provide any additional information required. The current version and date are shown above.