Privacy Policy

This privacy policy explains how BOOM I.T. Ltd (“we”, “us”, “our”) collects, uses, stores and protects personal data when you visit our website at www.boom-it.co.uk or contact us through it. We are committed to handling your personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our website or submitting any form on it, you confirm that you have read and understood how we handle your personal data.

1. What personal data we collect

We collect personal data through the following routes on our website:

Contact form (contact page)

When you complete and submit the contact form, we collect:

• First name and last name
• Company name (optional)
• Phone number
• Email address
• The service you are enquiring about
• Your message

Homepage quiz

When you complete the quiz on our homepage and submit your contact details, we collect:

• Your name, phone number, email address and company name
• Your answers to our quiz questions: approximate business size, industry sector, current IT arrangements, IT frustrations, working pattern, and upcoming plans
• Your callback preference

Protection Check

When you complete the Protection Check assessment and submit your details, we collect:

• Your name, phone number and email address
• Your answers to 16 security assessment questions across four areas: email security, backup and recovery, identity and access, and devices and network
• Your overall score and per-area scores derived from those answers

Server logs and technical data

When you visit our website, our hosting infrastructure automatically records standard technical data including your IP address, browser type and version, operating system, pages visited, time and date of visits, and referring URLs. This data is used solely for security monitoring and to understand how the site is used.

Telephone and email communications

If you contact us by telephone or email, we may retain records of that correspondence. Telephone calls may be recorded for training and quality purposes.

2. How we use your personal data

Purpose	Legal basis (UK GDPR)
Responding to your contact form, quiz or Protection Check submission	Legitimate interests — responding to a direct enquiry you have made
Providing the IT support or other services you have requested	Contract performance
Following up on your enquiry by phone or email	Legitimate interests — following up on a genuine business enquiry
Sending you relevant information about BOOM I.T. services where you have indicated an interest	Legitimate interests (with opt-out available at any time)
Improving our website and understanding how it is used	Legitimate interests
Complying with legal and regulatory obligations	Legal obligation
Fraud prevention and security monitoring	Legitimate interests

We will never sell your personal data to third parties. We will never use it for purposes that are incompatible with the reason it was originally collected.

3. How form submissions are processed

When you submit a form on our website, your data is handled as follows:

• Your submission is sent from your browser to our web server via an encrypted HTTPS connection.
• Our server-side PHP code receives the data, validates and sanitises all inputs, and then forwards it securely to Microsoft Power Automate via an HTTPS webhook call — which in turn delivers a formatted notification to our internal Microsoft Teams channel so our team can respond promptly.
• Your data is not stored in a database on our web server. The website acts as a secure relay, not a data store.
• The webhook endpoint URLs used to transmit your data are stored server-side only in protected configuration files. They are never exposed in page source, JavaScript, or any client-facing response.
• All outbound connections from our server to Microsoft Power Automate enforce SSL certificate verification and do not follow redirects.
• Our forms are rate-limited to prevent automated abuse.

4. Who we share your data with

We share your personal data only where necessary to deliver our services or comply with legal obligations. The key third parties are:

Microsoft (Power Automate and Microsoft Teams)

Form submission data is delivered to BOOM I.T.’s Microsoft Teams environment via Power Automate. Microsoft processes this data in accordance with the Microsoft Services Agreement and Microsoft’s Data Processing Addendum. Data is processed within Microsoft’s EU/UK datacentre regions.

20i Ltd (web hosting)

Our website is hosted on 20i shared hosting infrastructure. 20i processes data on our behalf as a data processor, meaning they host and serve our website files but do not use your personal data for their own purposes. 20i’s servers are located within the European Economic Area.

Other disclosures

We may disclose your personal data to third parties if we are required to do so by law, in connection with legal proceedings, or to protect the rights, property or safety of BOOM I.T. Ltd, our clients, or others.

We do not use third-party marketing platforms, advertising networks, or social media tracking pixels on this website.

5. Where your data is stored and transferred

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area. Specifically:

• Our web hosting infrastructure is located within the EEA.
• Microsoft Power Automate and Microsoft Teams process data within Microsoft’s EU/UK regions. Microsoft is certified under the UK-US Data Bridge and EU-US Data Privacy Framework where applicable.

Where any data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.

6. How long we keep your data

Data type	Retention period
Website enquiries and form submissions (held in Microsoft Teams)	24 months from submission, or until you ask us to delete it
Client correspondence and service records	6 years from the end of the client relationship (legal / contractual obligation)
Financial records and invoices	Minimum 6 years as required under UK law
Website server logs (IP addresses, technical data)	Up to 12 weeks, then rotated. Anonymised data may be retained longer for security analysis.
Enquiries that do not convert to a client relationship	12 months from last contact

Where data is no longer required, we delete or anonymise it securely.

7. Cookies

Our website uses cookies — small text files stored on your device — to help the site function correctly and to understand how it is used. We use the following types of cookie:

• Essential cookies — required for the website to function. These cannot be disabled.
• Analytics cookies — used to understand how visitors navigate the site so we can improve it. No personally identifiable information is collected.

You can control cookie settings through your browser. Disabling cookies may affect how some parts of the website function. For more detail, please see our Cookie Policy.

We do not use cookies for advertising, retargeting, or social media tracking.

8. Your rights under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data where there is no longer a lawful reason for us to hold it.
• Right to restriction — you can ask us to restrict how we use your data in certain circumstances.
• Right to object — you can object to us processing your data where we rely on legitimate interests as our legal basis.
• Right to portability — you can ask for your data in a structured, commonly used format so you can transfer it to another organisation.
• Right to withdraw consent — where we rely on your consent to process data, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@boom-it.co.uk or write to us at our registered address above. We will respond within one calendar month.

9. How to complain

If you are unhappy with how we have handled your personal data, please contact us in the first instance at hello@boom-it.co.uk and we will do our best to resolve your concern.

You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Security

We take the security of your personal data seriously. Technical measures we have in place include:

• All data transmitted between your browser and our server is encrypted via HTTPS/TLS.
• Sensitive configuration files (including webhook credentials) are protected from direct web access at both the server configuration level and within the application code.
• Form submissions are rate-limited to prevent automated abuse.
• All user-supplied data is validated and sanitised before processing.
• Our website is hosted on infrastructure with regular security patching and monitoring.

No method of transmission over the internet or electronic storage is 100% secure. While we take every reasonable step to protect your data, we cannot guarantee absolute security.

11. Third-party links

Our website may contain links to third-party websites — for example, Microsoft’s remote support portal. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before submitting any personal data to them.

12. Changes to this policy

We review this privacy policy regularly and will post any updates on this page. We will notify you of significant changes where we are able to do so. The date at the top of this page shows when the policy was last updated.

Continued use of our website after any changes to this policy constitutes your acceptance of the updated policy.

13. Contact us

If you have any questions about this privacy policy or how we handle your personal data, please get in touch: