DRAFTnot legal advice
Privacy notice
How we handle personal data about the people who use Enquiry and visit this website. Enquiries sent through customers’ forms are covered by the data processing agreement instead.
DRAFT, not legal advice. Written as a starting point for a solicitor to check before Enquiry opens to the public. It isn’t in force, and nothing here is a promise yet. Marks like [To decide: this] are things still to be decided.
Last changed 26 Oct 2026. Earlier versions: none.
Who is responsible
The controller for this notice is [To decide: the legal entity that sells Enquiry (Bromputers is a trading name), its registered address and number]. Questions and requests go to hello@bromputers.co.uk.
This notice is about account holders (people who sign in to the dashboard) and visitors to this website. For enquiries your customers’ website visitors send through Enquiry, the business that owns the form is the controller and we are its processor; see the data processing agreement.
What we collect, and why
| What | Why | Lawful basis | Kept |
|---|---|---|---|
| Your email address and account name | To open the account, sign you in and send service emails | Contract | While the account is open, then deleted 7 days after it is closed |
| Sign-in links and sessions (a hash, the browser’s user agent) | To keep you signed in safely | Contract | Links 15 minutes; sessions 30 days |
| A record of changes in the account (who changed what, when) | So the account’s members can see what changed; security | Legitimate interests | While the account is open |
| Signup attempts: a salted hash of the IP address | To limit how many accounts one connection can try to open | Legitimate interests (preventing abuse) | 1 day |
| Billing: name, address, payment details | Taking payment, tax and receipts, by Paddle as merchant of record | Contract; legal obligation (tax) | Paddle keeps these under its own notice; we keep the subscription’s status and dates |
| Records of the emails we send (which message, to which address, whether it bounced) | To stop sending to addresses that bounce or complain, and to protect delivery for every customer | Legitimate interests | 31 days; an address that bounced or complained is kept on our do-not-send list until it is removed on request |
| “Ask for access” and support emails | To answer you | Legitimate interests | [To decide: how long support email is kept] |
This website sets no tracking or advertising cookies and runs no analytics. Signing in sets one cookie that keeps you signed in. The signup page uses Cloudflare Turnstile to tell people from bots.
Who else handles it
Only the providers on the sub-processor list, each for the job it says. We don’t sell personal data or share it for advertising.
Where it is kept
On Cloudflare (uploaded files in its EU region), with nightly backups on our own server in the UK and an encrypted copy in AWS in Stockholm, kept for up to 90 days. Where a provider is outside the UK, the transfer is covered by [To decide: the transfer mechanism, e.g. the UK addendum to the EU standard contractual clauses or the UK-US data bridge].
Your rights
You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how it is used, and to take it elsewhere. Most of this you can do yourself: the Account screen exports everything as one file and deletes the account. Otherwise write to hello@bromputers.co.uk; we answer within a month.
You can complain to the Information Commissioner’s Office (ico.org.uk), though we’d like the chance to put it right first.
Changes
If this notice changes in a way that matters, we email account owners before it takes effect. The date at the top says when it last changed.