Privacy policy

1. Who we are

Casa Layer Ltd is a company registered in England and Wales. We operate the website at casa-layer.com and provide guest identity resolution services to hotel clients.

For the purposes of UK GDPR, Casa Layer Ltd acts as:

• Data controller in relation to personal data we collect about website visitors, contact form submissions, and marketing contacts.
• Data processor in relation to hotel guest personal data that we process on behalf of our hotel clients, who are the data controllers for that data.

Contact us at: hello@casa-layer.com

2. Data we collect and why

2a. Where Casa Layer is the data controller

Contact form. When you submit our contact form, we collect your name, work email address, hotel or group name, your role, and any message you provide. We use this to respond to your enquiry and, if appropriate, to follow up about our services.

Website analytics. We use Google Analytics 4 to understand how visitors use the site. This collects anonymised usage data including pages viewed, session duration, and referral source. IP addresses are anonymised. You may opt out by using browser-level settings or ad-blocker tools.

Marketing contacts. If you have agreed to receive communications from us, we hold your contact details for that purpose. You may withdraw consent at any time by contacting us or using the unsubscribe link in any communication.

2b. Where Casa Layer is the data processor

When we process hotel guest personal data on behalf of a hotel client, we do so under a written data processing agreement with that client. The hotel client is the data controller and determines the purposes of processing. Our role is to resolve guest identity across the hotel's connected systems and return a unified profile to the hotel.

If you are a hotel guest with a query about how your personal data is held, please contact the hotel directly. They are the data controller for their guest records.

3. Lawful basis

We process personal data under the following lawful bases:

• Legitimate interests: responding to contact form submissions, following up on business enquiries, and understanding how our website is used.
• Consent: marketing communications (where you have explicitly agreed to receive them).
• Contract: processing data as part of delivering our services to hotel clients.

4. Retention

We retain contact form submissions for as long as is reasonably necessary to pursue or conclude the relevant business relationship, and no longer than three years from last contact unless a longer period is required by law.

Analytics data is retained in accordance with Google Analytics default settings (14 months for user and event data).

Hotel guest data processed under a data processing agreement is retained in accordance with that agreement and deleted on termination of the contract, subject to any legal hold requirements.

5. Third parties

We use the following third-party services:

• Sanity: content management. This holds the words and images on this website. It does not receive anything you submit through a form. Sanity is hosted in the EU.
• Cloudflare: website hosting and edge delivery. Cloudflare processes request metadata as part of serving the site. We also use Cloudflare Web Analytics to count visits. It sets no cookies, stores nothing on your device and does not fingerprint you or follow you between websites, which is why it runs before you answer the banner: it is how we know how many people read the site at all.
• Google Analytics 4: website analytics. Data is processed by Google under their terms of service.
• PostHog: product analytics and the measurement of which version of a page you were shown. This receives a visitor identifier, the pages you view, and the actions you take on them. Where you have given us an email address through a form on this site, it is used as that identifier.
• Loops: email delivery. This receives your email address so we can send you the newsletter, or the result of the operator quiz if you complete it.
• Attio: customer relationship management. Enquiries you submit are stored here, including your name, email address, hotel or group, role, and message, so we can follow them up.
• Google Preferred Sources: the footer control that lets you add this site as a preferred source on Google. It is a link to Google’s source preferences tool, not the analytics tag already described, and the Accept/Decline banner does not switch it. We do not load Google’s Preferred Sources script on this site.

We do not sell personal data to third parties.

5b. Cookies

The banner you saw on your first visit links here, so this is what it covers. We set a long-lived identifier cookie so that repeat visits are recognised as the same visitor, and a short-lived cookie holding which version of a page you should be shown, so the page does not change under you between loads. Google Analytics 4 and PostHog set their own cookies once you accept. Before that they behave differently, so it is worth being exact. PostHog sends nothing at all until you accept. Google Analytics loads either way, but until you accept it runs in a mode where it sets no cookies and cannot recognise you on a later visit; accepting is what switches its cookies on. Cloudflare Web Analytics, described above, counts the visit either way and never sets a cookie at all.

Declining stops analytics collection. To clear the identifier cookies as well, delete this site's cookies in your browser settings, or email us and we will confirm what was held.

6. International transfers

Some of our third-party providers may process data outside the UK. Where this occurs, we rely on UK adequacy decisions or standard contractual clauses as the transfer mechanism.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (subject to legal obligations)
• Object to or restrict processing in certain circumstances
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, contact us at hello@casa-layer.com. We will respond within 30 days.

8. ICO registration

Casa Layer Ltd is registered with the Information Commissioner's Office. ICO registration details will be added when confirmed.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to existing contacts by email where appropriate. The effective date at the top of this page will be updated on each revision.