Privacy policy.

Last updated 18 October 2026

This page says what Castlane collects when you use this website or get in touch, why, where it is kept and for how long, and what you can ask for. It is written to be read, not skimmed past.

1. Who is responsible

Castlane is a Power Apps and Power Platform consultancy based in Tooting, London, run by Malacki Rhooms. Castlane is the data controller for personal data collected through this website and through its enquiry and client processes. Questions about this policy or about your data go to hello@castlane.co.uk or 0330 043 7410, and are answered within 30 days.

2. What is collected, and why

The enquiry form. Name, email address, company name and a description of what the spreadsheet does. Phone number and staff count are optional and marked as such. This is used to reply to you, to decide whether Castlane can help, and to prepare for the call if one follows. The lawful basis is legitimate interest: you have asked a business a question and the business needs your details to answer it.

Email and phone. If you email or call, whatever you send or say is kept as part of the record of the enquiry, on the same basis.

Booking a call. If you book through the booking link, Microsoft Bookings (part of Castlane’s Microsoft 365) records your name, email address and the time you chose so the call can happen. The lawful basis is the step you have asked for: arranging the call.

Client work. When Castlane builds a system for a business, it may see personal data belonging to that business’s staff, clients or candidates inside the business’s own Microsoft 365. Castlane acts as a processor for that data, on the client’s instructions, under the project agreement. It is covered in section 7.

Castlane does not collect special category data through this website, does not profile you, and does not send marketing emails. You will only hear from Castlane about the enquiry you made.

3. Where it is kept

Form submissions are emailed to hello@castlane.co.uk and also stored by the form plugin in this website’s database. The website is hosted on WordPress.com, run by Automattic Inc., which processes the data on Castlane’s behalf. Email, booking and enquiry records are kept in Castlane’s Microsoft 365 account. Access to both is limited to Malacki Rhooms and protected by multi-factor authentication.

Castlane does not use a third-party CRM, marketing automation tool or advertising platform, and does not pass your details to anyone else.

4. Who else processes it

• Automattic Inc. (WordPress.com hosting, and the Akismet spam check that runs on the enquiry form). Akismet receives the content of a submission to decide whether it is spam. Automattic is based in the United States and relies on the UK’s international data transfer safeguards.
• Microsoft (Microsoft 365, including Bookings, where email, booking and enquiry records are held). Data is held in Microsoft’s UK data centres.
• Google (YouTube). Each video on this site shows a preview image fetched from YouTube’s image server, which does not set cookies. The player itself, which can, loads only when you press play, through YouTube’s privacy-enhanced domain. From that point YouTube’s own privacy policy applies.

If a new processor is introduced, this page is updated first.

5. Cookies

This website sets no analytics, advertising or tracking cookies, which is why there is no cookie banner. The only cookies are those strictly necessary for the site to work, such as the one that stops the enquiry form being submitted twice, and WordPress.com’s own aggregate visitor count, which does not identify you. Pressing play on a video hands you to YouTube, which may then set its own cookies.

6. How long it is kept

Enquiries that do not lead to work are deleted three years after the last contact. Records of work done for a client are kept for six years after the project ends, which is the period needed for tax and contract purposes, and then deleted. You can ask for your data to be deleted sooner (section 8) and it will be, unless there is a legal reason to keep it.

7. Client data during a build

Systems are built inside the client’s own Microsoft 365 tenant. Client data stays there; Castlane does not copy it to its own systems except for short-lived working files needed for the build, which are deleted at handover. Castlane processes that data only as instructed by the client and only to deliver the agreed work, and is removed from the client’s tenant when the work ends unless the client keeps support. The client remains the data controller. Where the client needs a written data processing agreement, one is signed before the build starts.

8. Your rights

Under UK GDPR you can ask to see the data Castlane holds about you, have it corrected, have it deleted, have its use restricted, object to its use, or receive a copy in a portable format. Email hello@castlane.co.uk; the request is answered within 30 days, and you may be asked to confirm who you are. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. If something goes wrong

A personal data breach likely to put your rights at risk is reported to the Information Commissioner’s Office within 72 hours of Castlane becoming aware of it, and to you directly where the risk is high.

10. Changes

When this policy changes, the date at the top changes with it. Material changes, such as a new processor, are also noted here for three months.