Privacy policy
Privacy policy
Last updated: 6 October 2026
Casa Layer Ltd (registered name CASA LAYER LTD) is a private limited company registered in England and Wales. Company number 17491477. Registered office: Suite RA01, 195-197 Wood Street, London, E17 3NU.
Cookie policy: https://casa-layer.com/cookies
This policy explains how Casa Layer Ltd (“Casa Layer”, “we”, “us”) handles personal data. It is written in British English for visitors to casa-layer.com and for people who contact us about our services.
It is not the data processing agreement that governs hotel guest data. Hotel guests should read the privacy notice of the hotel that holds their stay.
1. Who we are
Casa Layer Ltd is a private company limited by shares, registered in England and Wales under company number 17491477. Registered office: Suite RA01, 195-197 Wood Street, London, E17 3NU. Incorporated on 30 September 2026.
We sell hotels a guest identity layer: it sits between a hotel’s source systems and the tools and agents the hotel already runs. It is not a CRM, a property management system, or a guest-messaging product.
Company particulars (Trading Disclosures Regulations 2015, regulation 25): CASA LAYER LTD, private limited company, England and Wales, company number 17491477, registered office Suite RA01, 195-197 Wood Street, London, E17 3NU.
1.1 How to contact us
- Privacy enquiries and rights requests: privacy@casa-layer.com
- General contact: hello@casa-layer.com
- Postal: Suite RA01, 195-197 Wood Street, London, E17 3NU
- Data Protection Officer: we have not appointed a DPO
1.2 Controller and processor
For the UK GDPR and the Data Protection Act 2018 we act as:
- Controller of personal data we collect about:
- website visitors;
- people who submit our contact forms, operator quiz or demo booking;
- newsletter subscribers;
- hotel staff users of our platform (account, support and related records);
- B2B contacts, suppliers and billing contacts;
- event contacts, investors and prospective investors.
- Processor of hotel guest personal data that we process on the written instructions of a hotel or hotel group. That hotel or group is the controller of its guest records. The written terms are the master services agreement and the data processing agreement, not this policy.
If you are a hotel guest and you want to know how your stay or guest record is used, contact the hotel. We cannot treat a guest request as if we were the controller of that hotel’s records.
1.3 Information Commissioner’s Office
You can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. https://ico.org.uk. Telephone 0303 123 1113. Please contact us first so we can try to resolve your concern.
We do not claim on this page that Casa Layer Ltd is “ICO registered” unless we have a real registration number.
- ICO data protection fee / register entry: TBC: not yet paid / insert registration number once issued. Do not invent.
Paying the ICO data protection fee, when required, is not ICO approval of this policy.
2. Scope
This policy applies to:
- visits to https://casa-layer.com and pages we publish on that host;
- our contact form, demonstration-booking form, operator quiz and similar forms we host;
- email we send from @casa-layer.com (including newsletters via news.casa-layer.com);
- hotel staff account, support and billing data where we are the controller;
- our use of the third-party tools listed in section 8 when we are the controller.
This policy does not apply to:
- hotel guest personal data we process as a processor (see section 10);
- third-party websites we link to;
- a hotel’s own PMS, POS, spa system or booking engine;
- a product environment a hotel logs into under a signed MSA (governed by the MSA, the DPA and the hotel’s own notices).
3. Personal data we collect as controller
We collect only what the relevant form, email or tool actually receives. We do not scrape hotel guest lists from the public website.
3.1 Information you give us
| Source | Typical data | Why we use it |
|---|---|---|
| Contact form | Name, work email, hotel or group name, role, message | To reply and continue a business conversation |
| Demonstration booking | Name, work email, hotel or group, role, scheduling data | To arrange and hold the demonstration |
| Operator quiz | Answers you submit and, if you ask for the result by email, your email | To send the result and understand operator problems people mark |
| Newsletter opt-in (Loops) | Email address and record of consent | To send the emails you asked for |
| Direct email to us | Content of the email, address and signature block | To reply and keep a correspondence record |
| Hotel staff platform account | Name, work email, role, organisation, login identifiers | To create and manage access to Casa Layer |
| Support (Intercom) | Contact details, ticket content, product context you share | To respond to support requests |
| Contract and billing contacts | Name, work email, job title, billing address, VAT number if supplied | To perform the contract and to invoice |
We ask for a work email where possible. We do not need a home address, date of birth, passport, payment card or special-category data from a website visitor. Please do not send those through the public forms. Where a card payment is taken, Stripe collects and processes the card details directly, and acts as an independent controller for that payment data. We do not store card data. We only see limited details, such as the card type, the last four digits and the expiry date.
3.2 Information collected automatically
When you load the site, our host and analytics tools may receive:
- the page requested, date and time, and a coarse referral source;
- browser and device type, and a truncated or anonymised IP address where the tool is configured to do that;
- a first-party visitor identifier, set only after you accept, as described in the cookie policy. There is no separate experiment or page-version cookie;
- a record of whether you accepted or declined the cookie banner.
How the banner works (controller / marketing site):
- PostHog does not load, and sends nothing, until you accept. A submitted email is not joined to PostHog analytics if you declined.
- Google Analytics 4 does not load until you accept. Accepting sets the first-party cookies
_gaand_ga_D6CVFD9TPL(about 400 days). - Microsoft Clarity does not load until you accept. It records sessions and heatmaps, with form fields masked.
- Apollo.io is no longer loaded on this site.
- Cloudflare Web Analytics is built to count visits without setting a cookie and without storing anything on your device. A scan of the home page, /use-cases/front-desk and /contact on 6 October 2026 did not see that beacon load. Cloudflare still processes request metadata to host the site.
- The first-party identifier is the cookie
_ph_did(httpOnly, one year). It is set only after you accept, so feature flags and analytics can share one visitor id. The home page and the quiz may also set_ph_flags(httpOnly, about 5 minutes) to cache those flags. There is no separate experiment cookie.
Details are in the cookie policy at https://casa-layer.com/cookies.
3.3 Information from other people
We may receive a name and work email from a colleague who asks us to include you in a demonstration or follow-up. We treat that as a business contact. If you do not want us to hold it, email privacy@casa-layer.com.
We use Attio as our CRM. Enquiries submitted on the site are stored there.
We do not buy marketing lists for this site. TBC: confirm none are bought or rented.
4. Purposes and lawful bases (controller)
| Purpose | Lawful basis (UK GDPR Art. 6) | Notes |
|---|---|---|
| Responding to a form, quiz or email you sent us | Art. 6(1)(f) legitimate interests (to reply); and Art. 6(1)(b) where you ask us to prepare a contract | You can object |
| Arranging and holding a demonstration | Art. 6(1)(b) steps at your request prior to contract; otherwise Art. 6(1)(f) | |
| Creating and managing hotel staff user accounts | Art. 6(1)(b) contract (or steps prior); Art. 6(1)(f) for related security and admin | |
| Invoicing and billing | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation where tax/company law requires records; Art. 6(1)(f) to recover sums owed | |
| Customer support | Art. 6(1)(b) and/or Art. 6(1)(f) | |
| Newsletters (Loops / news.casa-layer.com) | Art. 6(1)(a) consent, and PECR reg. 22 for electronic mail | Opt-in required. Unsubscribe in every email or email privacy@casa-layer.com |
| Relevant B2B updates to corporate / business contacts | Art. 6(1)(f) legitimate interests in promoting our services to businesses, with opt-out in every message and via privacy@casa-layer.com | PECR corporate-subscriber rules still apply. We will not email anyone who has opted out. |
| Strictly necessary service email (for example a calendar confirmation you requested) | Art. 6(1)(b) or Art. 6(1)(f) | Not marketing |
| Understanding how the website is used (PostHog, Google Analytics 4 and Microsoft Clarity) | Storage and access: PECR consent via the banner unless an exception applies. Subsequent processing of personal data: Art. 6(1)(a) consent aligned with the banner, unless a solicitor stamps another Art. 6 basis | PostHog, Google Analytics 4 and Microsoft Clarity do not load until Accept |
| Remembering your banner choice | PECR strictly necessary / consent-mechanism exception if used solely for that purpose | |
| Operating, securing and debugging the site | Art. 6(1)(f) legitimate interests | Not used for marketing |
| Keeping records we must keep (tax, company, dispute) | Art. 6(1)(c) where a legal obligation exists; otherwise Art. 6(1)(f) | |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) |
We do not carry out automated decision-making that produces legal or similarly significant effects about website visitors. We do not sell personal data.
We do not collect special-category data (Art. 9) or criminal-offence data (Art. 10) via the public website. If you send them anyway, we will delete them unless we must keep them for a legal claim.
5. Legitimate interests (summary)
Where we rely on legitimate interests we have considered, in outline:
- Reply to an enquiry. Someone who submits a work email and a message reasonably expects a reply. Impact is low. They can object.
- Secure the site. We and our visitors have an interest in a site that is not abused. Logs are not used to profile a person for sales.
- B2B updates. We have an interest in telling relevant hospitality businesses about Casa Layer. Impact is limited to work contact details; every message has an opt-out; we honour opt-outs.
- Short commercial record. We need to know who we have already spoken to so we do not spam the same person and can pick up a conversation. Retention is capped (section 7).
6. Marketing and PECR
- Newsletters (Loops): sent only with a clear opt-in (consent). Every email includes unsubscribe. You can also email privacy@casa-layer.com.
- B2B / corporate updates: may be sent on legitimate interests with opt-out in every message and via privacy@casa-layer.com. We do not email anyone who has opted out.
- We keep a record of consent or opt-out where relevant.
- We do not mask marketing as a “service update”.
- Opting out of marketing does not stop service messages about your account, billing or changes to our terms.
We do not make unsolicited marketing telephone calls as at this policy. If that changes, PECR telephone rules apply and this section must be revised first.
7. Retention (controller)
| Record | Period |
|---|---|
| Contact-form and demonstration enquiries | Up to 3 years from last meaningful contact, unless a contract follows or a legal hold applies |
| Newsletter / Loops marketing contacts | Until you unsubscribe. A marketing suppression record is then kept for 2 years so we do not email you again |
| Operator-quiz answers | 24 months, or until you unsubscribe if the result was emailed |
| Hotel staff account data | Life of the account, then deleted or anonymised within 90 days after the account ends, unless legal retention applies |
| Support tickets (Intercom) | 24 months after the ticket is closed |
| Transactional email logs (Resend) | Up to 12 months |
| CRM records (Attio) | Aligned with enquiry / customer retention above |
| PostHog analytics events | 12 months |
| GA4 user and event data | TBC: property setting; previously described as 14 months. The property setting is not readable from this website. |
| Security and request logs | 30 to 90 days unless we are investigating an incident |
| Consent and suppression records | Life of the list plus 2 years, to demonstrate compliance |
| Signed contracts, invoices, tax records | Statutory periods (typically 6 years from the end of the relevant financial year for UK company and tax records) |
When a period ends we delete or irreversibly anonymise the record, unless we must keep it for a legal claim or a legal obligation. Backups may take a short further period to roll off.
Hotel guest data we hold as processor is not retained under this table. It follows the customer DPA (typically deleted from our systems within 30 days after the MSA ends, unless the hotel instructs a return or a legal hold applies).
8. Who we share controller data with
We do not sell personal data.
| Provider | Role for controller data | What it typically receives | Location / transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge delivery, and Web Analytics | Request metadata. Visit counts when the Web Analytics beacon is enabled. A scan on 6 October 2026 did not see that beacon load | The network is global, and request data may be processed in the United States and elsewhere. UK transfers use the EU Standard Contractual Clauses as amended by the UK Addendum. Where the UK Extension to the EU-US Data Privacy Framework applies, Cloudflare treats that transfer as not restricted |
| PostHog, Inc. | Product and website analytics (after Accept) | Visitor identifier, pages and actions. An email is used as the identifier only if you submitted a form and analytics was accepted | This site uses PostHog EU Cloud (eu.i.posthog.com). Event data is stored in AWS eu-central-1 (Frankfurt). A transfer to the EEA relies on UK adequacy for the EEA |
| Astrodon Corporation (Loops) | Newsletters (news.casa-layer.com) | Email address and the consent record | Processed in the United States. Loops states that it complies with the UK Extension to the EU-US Data Privacy Framework |
| Plus Five Five, Inc. (Resend) | Transactional email | Email address and message metadata | Primary processing and storage are in the United States. Transfers use the EU Standard Contractual Clauses plus the UK Addendum, and the UK Extension to the EU-US Data Privacy Framework |
| Google (Workspace) | Business email and documents | Business correspondence and files that contain personal data | Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework. The Workspace data region is set in the Google admin console and is not recorded in this website. TBC: Workspace data region is not in this website or on a public page. |
| Google LLC (Analytics 4) | Website analytics (cookies only after Accept) | Pages, session and referral | Google stores GA4 data in the US under the Google Ads Data Processing Terms, UK Addendum |
| Attio | CRM | Name, email, hotel or group, role and message | Hosted on Google Cloud. The named hosting subprocessor is Google Cloud EMEA Limited (Ireland), under standard contractual clauses with a framework covering the UK. Other subprocessors are listed as using standard contractual clauses and the UK Addendum |
| Intercom, Inc. | Customer support | Contact details and ticket content | The published default is hosting in the United States (AWS us-east-1), unless a regional data hosting option was chosen. This website does not record which option the workspace uses. Affiliates include Intercom R&D Unlimited Company (Ireland). Intercom relies on the UK Extension to the EU-US Data Privacy Framework, and on standard contractual clauses if that framework is unavailable |
| Microsoft Clarity | Independent controller (Microsoft Ireland Operations Limited) | Session / heatmap signals after Accept; form fields masked | US processing under Microsoft Privacy Statement; Microsoft states MIOL to Microsoft Corporation SCCs cover the affiliate transfer. Casa Layer holds no Clarity DPA/SCC. |
| ZenLeads, Inc. (d/b/a Apollo.io) | No longer loaded on this site | None from this website | Not used |
| Sanity (Sanity AS, Oslo, or Sanity US Inc., San Francisco, whichever is party to the agreement) | CMS for site content | Site content. Form submissions are not stored in the CMS | Primary Content Lake storage is Google Cloud europe-west1 (St. Ghislain, Belgium). A transfer to the EEA relies on UK adequacy for the EEA. The CDN is global, and some subprocessors are outside Belgium. Restricted UK transfers use the UK Addendum incorporated in Sanity's DPA |
| Stripe | Independent controller for payment data | Card details, which Stripe collects and processes directly. We do not store card data. We only see limited details, such as the card type, the last four digits and the expiry date | For a UK business, Stripe's privacy centre names Stripe Payments UK, Ltd. together with Stripe Technology Company, Limited (Ireland) and Stripe Payments Europe, Limited (Ireland). Payment data may be transferred to Stripe, LLC in the United States. Stripe, LLC is certified under the UK Extension to the EU-US Data Privacy Framework. Standard contractual clauses plus the UK Addendum are the fallback. Processing in Ireland can also rely on UK adequacy for the EEA. This website does not record the Stripe account country |
Professional advisers (solicitors, accountants, insurers) may see personal data where necessary for their advice, under confidentiality.
We may disclose personal data if the law requires it, or in connection with a sale or restructuring of the company, under appropriate safeguards.
A separate subprocessor list applies when we process hotel guest data as a processor under a customer DPA.
9. International transfers (controller)
We are established in the United Kingdom. Some providers in section 8 may process personal data outside the UK (including in the United States and the European Economic Area).
Where UK GDPR Chapter V restricts a transfer, we only transfer personal data if an appropriate safeguard or other lawful mechanism applies, for example:
- a UK adequacy regulation covering the destination (including UK adequacy for the EEA, where it applies);
- the UK International Data Transfer Agreement (IDTA); or
- the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) plus the UK International Data Transfer Addendum.
We will not rely on a transfer mechanism we have not put in place. Where a cell in section 8 is still marked TBC, that point is not yet verified. Using the website alone is not consent to an international transfer.
10. Hotel guest data (Casa Layer as processor)
When a hotel connects source systems we may ingest records, resolve them into Master Profiles, keep a guest event log, and expose the result over API and MCP to the hotel and to agents the hotel has registered.
For that processing:
- the hotel (or hotel group) is the controller;
- Casa Layer is the processor;
- the data processing agreement (UK GDPR Article 28) is the governing instrument;
- we act only on documented instructions;
- we do not use guest records to train a public model, to market Casa Layer, or to enrich another hotel’s profiles.
If you are a guest, this policy cannot answer a request about your stay. Contact the hotel. If the hotel asks us to help it respond, we will, under the DPA.
11. Security
We apply organisational and technical measures appropriate to the risk, including:
- encryption in transit (TLS / HTTPS);
- encryption at rest;
- access to personal data on a need-to-know basis;
- multi-factor authentication on administrative systems;
- hosting with reputable cloud providers that maintain recognised security certifications;
- production customer (hotel guest) data hosted in AWS Europe West 2 (London / eu-west-2).
No method of transmission or storage is completely secure. A personal-data breach that meets the UK GDPR threshold will be notified as the law requires: to the ICO when we are controller, and to the hotel without undue delay when we are processor.
12. Your rights (controller data)
Where we are the controller you have the following rights under the UK GDPR, with the usual legal limits:
- Access: a copy of the personal data we hold about you.
- Rectification: correction of inaccurate data, and completion of incomplete data.
- Erasure: in the circumstances Article 17 sets out.
- Restriction: in the circumstances Article 18 sets out.
- Portability: for data you provided to us, where the basis is consent or contract and the processing is automated.
- Objection: to processing based on legitimate interests, and to processing for direct marketing (which we will always stop).
- Withdraw consent: where the basis is consent, without affecting processing that already happened.
- Complain to the ICO (section 1.3).
Account deletion
You may request deletion of your Casa Layer user account by emailing privacy@casa-layer.com (or using in-product controls where available). We will delete or anonymise account personal data we hold as controller without undue delay, unless we must keep it for legal or accounting reasons (we will tell you if so). Backups may take a short further period to roll off. This does not delete hotel guest data we process as a processor for a hotel; the hotel must instruct us under the DPA.
To exercise any other right, email privacy@casa-layer.com. We will need enough to identify you. We will respond within one month of receipt, or explain if we need more time (up to a further two months for a complex or numerous request). We will not charge unless a request is manifestly unfounded or excessive.
These rights do not let a hotel guest demand that we change a Master Profile over the hotel’s head. That request goes to the hotel.
13. Children and age limit
You must not use Casa Layer Ltd’s website or services unless you are aged 18 or older. This website is not intended for children and we do not knowingly collect data relating to children. If you believe we have, email privacy@casa-layer.com and we will delete it.
14. Cookies and similar technologies
Storage and access technologies on this site are described in our cookie policy: https://casa-layer.com/cookies.
In short:
- the banner is where you accept or decline analytics cookies;
- Cookie settings in the footer, next to Privacy, Cookies and Terms, reopens that banner so you can change or withdraw the choice;
- PostHog, Google Analytics 4 and Microsoft Clarity do not load until you accept. Apollo.io is no longer loaded on this site.
- choosing Decline switches those tools off going forward and deletes the first-party cookies this site can delete. Cookies set on another company’s domain have to be cleared in the browser. You can also email privacy@casa-layer.com.
Using the website alone is not consent to non-essential cookies or to marketing.
15. Changes
We may update this policy. The date at the top will change. If we make a material change to how we use controller personal data, we will email existing contacts where we can, or put a notice on the site.
This version is dated 6 October 2026.
16. English law
This policy is intended to comply with the UK GDPR, the Data Protection Act 2018, and PECR (including amendments made by the Data (Use and Access) Act 2025). Where UK analysis differs from EU GDPR, UK questions are analysed under UK law (including DUAA 2025). EU GDPR still matters for EU hotel customers and EU data subjects. Governing law: England and Wales. Lead supervisory authority for our controller processing: the ICO.