Privacy Policy

1. Who we are

Castlane is an operational systems consultancy registered in England and Wales. Our website is castlane.co.uk. Our contact email is hello@castlane.co.uk and our telephone number is 0330 043 7410.

We are the data controller for all personal data collected through this website and through our service delivery processes. As data controller, we determine the purposes and means by which your personal data is processed.

If you have any questions about this privacy policy or about how we handle your personal data, please contact us at hello@castlane.co.uk. We will respond within 30 days.

2. What data we collect

We collect personal data through the following routes:

Contact form. When you submit an enquiry through our website contact form, we collect your full name, email address, phone number, company name, company size, business type, and a description of your biggest operational challenge. This data is collected for the purpose of responding to your enquiry and assessing how Castlane may be able to support your business.

Systems Health Check. When you complete our Business Systems Health Check, we collect your full name, email address, company name, company size, and your answers to the ten diagnostic questions. This data is used to generate your personalised results, to follow up with information relevant to your business systems, and to improve the diagnostic tool over time.

Calendly booking. When you book a consultation through our Calendly booking page, Calendly collects your name, email address, time zone, and any pre-call information requested. Calendly acts as a data processor on our behalf. Please refer to section 7 of this policy and to Calendly’s own privacy policy at calendly.com/privacy for further information.

Client project data. When we are engaged to design and implement operational systems for a client, we may access, process, or handle business data belonging to the client organisation. This is addressed separately in section 9 of this policy.

We do not collect special category data such as health information, financial records, or data relating to criminal convictions through any of the above routes.

3. Lawful basis for processing

Under the UK General Data Protection Regulation, we are required to identify a lawful basis for each type of processing we carry out. Our lawful bases are as follows:

Contact form submissions are processed on the basis of legitimate interests. We have a legitimate interest in responding to business enquiries and in assessing whether we can provide services to the enquirer. This interest is not overridden by the rights and freedoms of the individual given that the enquiry is made voluntarily in a business context.

Systems Health Check submissions are processed on the basis of consent. By submitting your details to view your results, you are consenting to us processing your data for the purposes described. You may withdraw this consent at any time by contacting us at hello@castlane.co.uk.

Calendly bookings are processed on the basis of contract performance, as the booking is a necessary step in arranging a consultation you have requested.

Client project data is processed on the basis of contract performance and, where applicable, legitimate interests in delivering the agreed services effectively.

4. How we use your data

We use the data we collect for the following purposes:

To respond to your enquiry and provide information about our services. To arrange and conduct consultations. To deliver agreed project work. To send follow-up communications relevant to your enquiry or assessment results. To improve our diagnostic tools and service offerings based on aggregated, anonymised insights.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not send marketing emails without your explicit consent. If you have provided consent to receive marketing communications, you may withdraw that consent at any time by contacting us at hello@castlane.co.uk or by clicking the unsubscribe link in any email we send.

5. How we store your data

Data submitted through our contact form and Systems Health Check is stored in our internal systems and spreadsheets hosted within secure cloud environments. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration.

These measures include access controls limiting who within Castlane can view personal data, use of password-protected and encrypted storage environments, and regular review of data held to ensure it remains accurate and necessary.

We do not use third party CRM platforms, marketing automation tools, or website plugins that independently receive or store your personal data beyond what is described in this policy.

6. How long we keep your data

We retain personal data for the following periods:

Contact form submissions are retained for 10 years from the date of submission. This allows us to maintain a record of business enquiries and to reference historical communications where relevant to ongoing or future engagements.

Systems Health Check submissions are retained for 10 years from the date of completion.

Calendly booking data is retained in accordance with Calendly’s own retention policy. We may retain notes from consultations for 10 years from the date of the call.

Client project data is retained for 10 years from the date of project completion, after which it is securely deleted unless a longer retention period is required by law or agreed with the client.

After the applicable retention period, data is deleted securely. If you wish to request deletion of your data before the end of the retention period, please see section 10 of this policy.

7. Third party processors

We use the following third party services that may process personal data on our behalf:

Calendly. We use Calendly to manage consultation bookings. When you book through our Calendly link, Calendly processes your name, email address, and booking information. Calendly is based in the United States and processes data in accordance with its own privacy policy and applicable data transfer mechanisms. You can view Calendly’s privacy policy at calendly.com/privacy.

We do not use any other third party processors that receive identifiable personal data submitted through our website. We do not use Google Analytics, Facebook Pixel, or similar tracking tools that collect personal data without your consent.

If we introduce any new third party processors in the future, we will update this policy accordingly.

8. International data transfers

Calendly is based in the United States. When you book a consultation through Calendly, your data may be transferred to and processed in the United States. Calendly relies on appropriate safeguards for such transfers in accordance with UK GDPR requirements.

Other than through Calendly, we do not transfer your personal data outside the United Kingdom.

9. Client project data

When Castlane is engaged to design and implement operational systems for a client, we act as a data processor in relation to any personal data belonging to the client’s customers, employees, or other data subjects that we encounter during the project.

In this capacity, we process client data only as instructed by the client and only to the extent necessary to deliver the agreed services. We do not use client data for any purpose beyond project delivery. We do not share client data with any third party without explicit written consent from the client.

Clients retain responsibility as data controller for any personal data within their systems. Where applicable, the terms of data processing will be set out in the project agreement or a separate data processing agreement.

Upon project completion, we delete or return any client personal data in our possession unless retention is required for legal or contractual reasons.

10. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

The right to access. You may request a copy of the personal data we hold about you. We will provide this within 30 days of your request.

The right to rectification. If any data we hold about you is inaccurate or incomplete, you may request that we correct it.

The right to erasure. You may request that we delete your personal data. We will comply unless we have a legal obligation or legitimate reason to retain it.

The right to restriction. You may request that we restrict processing of your data in certain circumstances, for example while a complaint is being investigated.

The right to data portability. Where processing is based on consent or contract performance and carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.

The right to object. You may object to processing carried out on the basis of legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

The right to withdraw consent. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at hello@castlane.co.uk. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are not satisfied with how we have handled your data or responded to a rights request, you have the right to lodge a complaint with the Information Commissioner’s Office. You can do so at ico.org.uk or by calling 0303 123 1113.

11. Data breach procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach, as required by UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

We maintain internal procedures for identifying, recording, and responding to data breaches.

12. Cookies

Our website may use cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit a website.

Strictly necessary cookies are required for the website to function and cannot be switched off. They do not collect personal data and do not require your consent.

Analytics cookies allow us to understand how visitors interact with our website. These cookies collect information in an aggregated, anonymised form. We will ask for your consent before placing analytics cookies.

We do not use advertising or targeting cookies.

You can manage your cookie preferences through the cookie settings on our website at any time. You can also control cookies through your browser settings, though disabling certain cookies may affect the functionality of the website.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always reflect when the policy was last updated. We encourage you to review this policy periodically.

Continued use of our website after changes are published constitutes acceptance of the updated policy.