Privacy Policy

Who we are

dotbm is a Bermuda website and technology business operated by Christopher Bennett, trading as dotbm. We build and maintain technology platforms for Bermuda. You can reach us at [email protected].

Bermuda law applies

This policy is written for people in Bermuda, under the Personal Information Protection Act 2016 (PIPA). This site is for Bermuda, and PIPA is the only privacy law we make commitments under. If you are visiting from somewhere else, the same practices apply to you, but we do not offer the rights or procedures of any other country's law.

Our privacy officer under PIPA is Christopher Bennett. Any question or request about your personal information goes to [email protected].

What we collect

Analytics. This website uses privacy-friendly, cookieless analytics to understand aggregate traffic such as page views and referrers. We use Umami, self-hosted on our own domain. It does not set cookies, does not track you across other websites, and does not collect personally identifiable information. We do not use advertising cookies and we do not share analytics data with advertisers.

Contact and enquiry forms. When you submit the contact form or any enquiry form on this site, what you enter, meaning your name, email address and the answers you give, is delivered to our inbox by Resend, our email provider, and recorded in our own customer records so we can follow up. We keep those records on servers we run ourselves in Helsinki, Finland, with an encrypted backup copy in Canada, and we do not pass them to anyone else.

Domain security check. When you use the domain security check, the domain you type is sent to our server, which looks up that domain's public DNS records through Cloudflare's public DNS resolver (Google's if Cloudflare's does not answer) and reads its published MTA-STS policy file, if it has one. The domain and the results are shown to you and then discarded: we do not store them, log them, or connect them to you. To stop the check being abused, our server holds your IP address in memory for up to ten minutes to count how many checks it has made, and keeps no record of it.

Requests to other domains. The live widgets on our home page read current data straight from our own products, so your browser makes a request to wopnin.fyi when the page loads. Typefaces are served by Google Fonts and Adobe Fonts. Each may log standard server access data such as IP address, user agent and referrer, under their own privacy practices.

Where your information is held

Our customer records are stored on servers we run ourselves in Helsinki, Finland, with an encrypted backup copy in Canada. Access is restricted to dotbm and the service providers necessary to operate and secure that infrastructure. dotbm remains responsible for protecting the information in accordance with Bermuda's PIPA requirements. Resend, Cloudflare, Authorize.Net and the font providers named on this page also process data outside Bermuda under their own policies.

Cloudflare

This site is served through Cloudflare. Cloudflare may process request metadata (IP address, location, browser type) for security and performance purposes. See Cloudflare's privacy policy.

How we use your information

We only use information you submit through a form on this site to respond to your message and, if you become a client, to do the work you asked for. We do not sell, rent, or share your personal information with third parties for marketing purposes.

Becoming a customer

If you become a customer, our onboarding form has its own privacy notice. It covers your order, your agreement and any documents you upload: onboard.dot.bm/privacy.

In short: when we help you apply for a merchant account, we collect your business details, the details of the people we deal with, and the documents your bank's application asks for. The bank you are applying to receives the application, filled in from your answers. When we set up your payment gateway, Authorize.Net receives the business and contact details it needs to open your account, and processes them in the United States under its own privacy policy. Documents you upload for the bank are deleted 90 days after the application closes.

We never ask for card numbers, by email or through any form. If someone asks you for one in our name, it is not us: tell us at [email protected].

Your rights under PIPA

You can ask us what personal information we hold about you, ask us to correct it, ask us to stop using it, or ask us to delete it. Email [email protected] and we will act on the request promptly, and always within the 45 days PIPA allows. There is no charge.

If you are not satisfied with how we handle your information or your request, you can complain to the Privacy Commissioner for Bermuda.

Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page.

Contact

Questions about privacy? Email us: [email protected]