Most privacy policies only cover the first. If you are being asked to give an outside engineer access to production, the first is not the part you need.

Who you are dealing with

BespokeForge is the trading name of Christian Kelechukwu, working as an individual in Nigeria. For the personal data this website collects, Christian Kelechukwu, trading as BespokeForge, is the data controller.

For anything to do with this website or your data, write to chris@bespokeforgestudio.com. That address reaches one person, the same person who does the work. BespokeForge has not appointed a data protection officer, and it has no representative in the European Union or the United Kingdom: write to that address directly, wherever you are.

The work is done from Nigeria, which is outside the European Economic Area. That matters for your data, and it is dealt with plainly further down, under where your data goes.

Part one: this website

What this site collects

  • The contact form. Your name, your email address and your message. The form also asks how you found BespokeForge; the answer is optional, comes from a short list, and goes with your message. Nothing else: no phone field, no company field and no budget dropdown.
  • The Search Baseline order form. Your website’s address, your business name, your name and email address, the platform the site runs on, where your customers are, the services you want to be found for, up to three competitors, whether your Google Search Console access is ready to share, and a note if you add one. The order also records when you agreed to these details being stored.
  • The checklist form on the guides page. Your email address only.
  • The cost calculator. Nothing, unless you ask for the breakdown by email. The figures are worked out in your browser. If you ask for the email, your address and the six figures come to this site, which writes the email.
  • The page counter. A count of page views, kept on this site’s own server: which page, and on which day. No cookie, no identifier and no IP address, so it cannot tell one visitor from another or follow anyone from page to page. It is the only analytics this site has.
  • The web server’s access log. Your IP address, the page you asked for, the time, and the browser identification string your browser sends. Every web server keeps one of these.
  • Two things kept in your own browser, never sent anywhere: the light or dark mode you chose with the toggle, and the calculator’s figures while you send yourself the breakdown. The cookie policy names both.

You do not have to give any of these details. Without an email address, the checklist or the breakdown cannot be sent, and without the order’s details, the Search Baseline cannot be done. There are no visitor accounts on this site, so there is nothing to register for and no password to store. There are no comments and no advertising, and Google Analytics is not on this site.

Where it goes, exactly

This is the part usually left vague, so here it is in full.

  • A contact form message is emailed to the studio’s inbox, and it is also written to a log in this site’s own database. That log holds the most recent 200 enquiries and trims each message to its first fifty words. It exists because email delivery fails sometimes, and an enquiry that vanishes is worse than one stored.
  • A booking is written to a log in this site’s own database first, then passed to Cal.com, which books the call and sends the invitation. The log exists so a booking that does not arrive is not lost: the studio is then emailed and confirms a time with you by email. To stop one booking being made twice, the site keeps a keyed hash of your email address and of your connection’s address for up to an hour.
  • A Search Baseline order is stored in this site’s database first. It is then sent to the studio’s own automation server, which runs n8n, a workflow tool that BespokeForge runs itself rather than renting as a service. Through the studio’s Google Workspace mailbox, n8n emails you a confirmation with the next steps, including how to share Search Console access, and emails the order to the studio. n8n keeps a record of each run, order included, so a problem can be traced back and put right. If that server does not answer at all, the order is emailed to the studio directly instead, and the server is tried again every hour, up to five times. An order that has still not arrived stays flagged in the site’s admin until it is dealt with.
  • A checklist request is written to a log of the most recent 500 addresses. Two emails then go out: the checklist to you, and a one-line notice to the studio. Nothing else is sent to you afterwards.
  • A calculator breakdown goes to the same log. Two emails go out: the breakdown to you, and the same figures to the studio.
  • Every form is rate limited, so the same person cannot send fifty times in a minute. That check stores a keyed hash of your connection’s address (for an IPv6 address, of its network block), for fifteen minutes on the contact and order forms and for one hour on the checklist and the calculator. The checklist and the calculator also keep a keyed hash of the email address for a day, so one address cannot be sent the same thing over and over. The addresses themselves are not stored by these checks, and without the site’s own secret a keyed hash cannot be turned back into one.
  • A form sent back with a mistake keeps what you typed for ten minutes, so you do not have to type it again. After ten minutes it is gone.

The services behind the work

These are the services that handle your details when you deal with BespokeForge, and what each one does with them.

  • Google Workspace holds the studio’s email, and the order workflow sends its emails through it. Every message, order notice and enquiry ends up in that inbox.
  • Cal.com runs the booking calendar. When you book a call, it takes your name, your email address and anything you write in the booking form, and it sends the confirmation.
  • Google Calendar and Google Meet. A booked call becomes an event in the studio’s Google Calendar, and the call itself happens on Google Meet. The invitation carries your name and email address.
  • Google Drive and Google Docs hold the working documents of an engagement, such as proposals, notes and the written assessment from an audit. They are shared with you from the studio’s account.
  • Resend delivers the email this website itself sends: the checklist, the calculator breakdown and the notices to the studio.
  • Cloudflare sits in front of this website. Every request to the site passes through it, so it sees your IP address and the page you asked for, as any network in front of a website does. It protects the site from attacks and keeps it fast.
  • Google Search Console and Bing Webmaster Tools report how this site appears in search: queries, clicks and positions, as totals. They place nothing on this site and receive nothing from your visit. For a client, the same two tools are how search work is measured, with access the client grants (see part two).

The server this site runs on, and the company that provides it, are not named here. Naming the infrastructure would tell an attacker what to look for, and the same rule protects every client’s systems. It should not cost you an answer: ask before you send anything, and you will be told who it is and where it is.

Why BespokeForge is allowed to hold it

Each use rests on a lawful basis under the Nigeria Data Protection Act 2023, and on the matching legal basis in Article 6 of the GDPR for visitors and clients in Europe.

  • Your enquiry, your booking and your order. To answer you, and to take the steps you asked for: the performance of a contract, or steps taken at your request before one (Article 6(1)(b)).
  • The checklist and the calculator breakdown. To send you what you asked for, which is the performance of your request (Article 6(1)(b)), and a legitimate interest in keeping a short log of what was sent (Article 6(1)(f)).
  • The page counter, the logs, the backups and the rate limits. A legitimate interest in keeping the site up and recoverable, knowing which pages are read, and not being flooded by bots (Article 6(1)(f)). The counter holds nothing about you, so it needs nothing from you.

How long it is kept

  • The enquiry log keeps at most 200 entries and nothing older than 24 months: older entries are deleted every day. An enquiry thread in the studio’s inbox is deleted once it is clear nothing will come of it, and in any case within 24 months.
  • The booking log keeps nothing older than 24 months: older entries are deleted every day.
  • A Search Baseline order is a purchase, so it is kept with the engagement records below.
  • The checklist and calculator log keeps at most 500 addresses and nothing older than 12 months, and an address comes off sooner if you ask.
  • The page counts are kept for as long as they are useful. They hold nothing about anyone, so there is nothing in them to delete.
  • The rate limit hashes expire by themselves, within a day at most.
  • The server access log is kept for 90 days, then deleted.
  • The automation server’s record of each run, order included, is kept for up to 120 days, so a problem can be traced back to where it began, then deleted. A failed run is looked into first.
  • Backups of this site’s database, which hold the logs and orders above, are kept for up to 120 days, then deleted.
  • Engagement records, meaning orders, invoices and the correspondence around a contract, are kept for as long as accounting and limitation periods require, then deleted.

What does not happen

  • Nothing here is sold, rented, or handed to anyone for their own marketing.
  • There is no advertising, no remarketing, no profiling and no automated decision-making. Nothing on this site scores you or sorts you.
  • Nothing you send is used to train a machine learning model.
  • There is no newsletter. An address given for the checklist or the calculator gets that one email and nothing after it.

Your rights, and how to use them

Under the Nigeria Data Protection Act 2023, and under the GDPR (Articles 15 to 22) or the UK GDPR if you are in Europe or the United Kingdom, you have the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, to restrict how it is used, to object to its use for a legitimate interest, and to receive it in a portable form.

Ask by writing to chris@bespokeforgestudio.com. You do not need a form or a particular wording. You get an answer within a month, and if something will take longer, you hear why before the month is up rather than after.

If you are unhappy with how a request is handled, you can complain to the Nigeria Data Protection Commission, BespokeForge’s regulator. If you are in the European Union, you can also complain to the data protection authority of the country where you live or work, and in the United Kingdom to the Information Commissioner’s Office.

Part two: your systems, during an engagement

An engagement means access to systems that hold other people’s personal data: your customers, your staff, your enquiries. On that data, BespokeForge acts on your instructions and not its own. In the GDPR’s terms you are the controller and BespokeForge is a processor (Article 28).

The data processing agreement

Every engagement that touches personal data comes with a data processing agreement as standard, with the European Commission’s standard contractual clauses for the transfer described under where your data goes. It is signed before any access is taken. You do not need to ask for it; if your organisation has its own, it can be used instead, and the two are reconciled before the work starts.

What access is taken

  • The minimum the work requires, scoped to the task, and no standing access to things the task does not touch.
  • Named individual accounts rather than shared logins, with two-factor authentication wherever the system offers it.
  • The domain, the DNS and the repository sit in accounts you own before the work starts, and so does the server unless you choose to host with BespokeForge. The access is yours to grant, yours to watch, and yours to remove without asking.
  • For search work, access to your Google Search Console and Bing Webmaster Tools is granted by you, from your own account, and removed by you when the work ends.
  • Credentials never travel in plain text. They are held in an encrypted password manager, and they are revoked the day an engagement ends.

What is likely to be seen

Whatever your systems hold. Customer enquiries and their contents, order and booking records, CRM contacts, staff accounts, and email addresses sitting inside logs, exports and database backups.

Nothing beyond the task is looked at. But a database backup contains the whole database, and a server log contains everyone who visited, and this policy is not going to pretend otherwise. If there is a table you would rather nobody opened, say so at the start and it goes in the engagement agreement.

Copies, staging and backups

  • Production data is not copied out of your systems except where the work needs it: reproducing a fault, testing a migration, or checking that a backup actually restores.
  • Where a copy is made, it stays on systems BespokeForge controls, it goes to nobody else, and it is deleted when the task is done.
  • Where a staging environment would have to hold real customer data for longer than a single task, you are told first and it is agreed. Anonymised or reduced data is used instead wherever the work allows it.

Other services in the chain

Some work needs services underneath it: hosting, offsite backups, monitoring, email delivery. Those are sub-processors. The ones this practice uses for its own work are named in part one. The ones under your systems are named in the data processing agreement, for the same reason the server is not named here.

No new service that touches your data is added without telling you first.

Where your data goes

Your systems stay where you put them. Moving your data to another country is not something that happens as a side effect of ordinary work, and where a migration would move it, that is part of the scope you agree.

The honest part is about where the work is done rather than where the servers are. The work is done from Nigeria, so your data may be accessed from outside the European Economic Area. Under the GDPR that is an international transfer, and Nigeria has no adequacy decision, so the transfer rests on the European Commission’s standard contractual clauses in the data processing agreement (Article 46). Some of the services in part one are based in the United States. Where they are, the transfer relies on the safeguards those services provide, such as the EU-US Data Privacy Framework or standard contractual clauses.

If something goes wrong

If BespokeForge becomes aware of a breach affecting your data, you are told without undue delay and in any case within 72 hours, with what is known at that point, even when the picture is incomplete. Nobody waits for a full account, because your own 72-hour clock starts when you are told, not when the investigation finishes.

You then get everything that helps you meet your own duties: what happened, when, which systems, which data, what has been done, and what is still unknown.

When the engagement ends

  • Access is revoked the day it ends, and you can revoke it yourself the same day, because the accounts are yours.
  • Working copies, exports and staging data are deleted. Backups held by BespokeForge expire within 120 days.
  • The accounts are already yours. Once every invoice is settled, the handover is a call, the runbook and the list of access to revoke, as the terms of service set out.
  • If you want written confirmation of what was deleted and when, ask and you get it.

Part three: the audit

The audit runs across the servers, the site, the data and the automations between them. It needs read access, and read access to a live system means seeing live data. It is worth being clear about that before you grant it rather than after.

  • The notes, exports and screenshots taken to produce the assessment are kept while the engagement is live and deleted when it ends, or sooner if you ask.
  • The written assessment is yours, whether or not anything follows.
  • It names systems, versions and configuration, which is exactly the material an attacker would want. It is not published, not used as an example, and not shown to anyone else without your written agreement.

Which law this is written to

BespokeForge operates from Nigeria, so the Nigeria Data Protection Act 2023 governs how it handles personal data, and the Nigeria Data Protection Commission is its regulator. Because BespokeForge serves clients and visitors in Europe and the United Kingdom, it also meets the General Data Protection Regulation and the UK GDPR for their personal data.

That is also why this site sets no cookies of its own and counts pages without identifying anyone. A site that collects as little as possible has little to ask consent for, nothing to leak, and nothing to explain when somebody asks what it knows about them. The cookie policy sets out what was checked and what was found.

Changes to this policy

An updated version is posted here with its date. If a change materially affects an engagement that is already running, you are told directly rather than left to find it.

Contact

Everything on this page goes to chris@bespokeforgestudio.com, or through the contact page.