1. Who is responsible
Caseflow Systems LTD is the data controller for personal data submitted through caseflow.uk. We are registered in England and Wales under company number 08819092, with our registered office at Forma House, 40 Bowling Green Lane, London EC1R 0NE, United Kingdom.
For any question about this notice, or to exercise the rights in section 7, emailprivacy@caseflow.uk. You can also write to us at the registered office above, marking your letter Data Protection.
2. What we collect
Only two things.
- What you type into the enquiry form. Your name, organisation, role, country, email address, telephone number, project type, the challenge you describe, your target timeline and your preferred contact method. Nothing in that form is collected unless you submit it.
- Standard server logs. Our hosting provider records the technical information every web server records — IP address, time of request, page requested, browser type — for security and to keep the site running. We do not use these logs to identify or profile visitors.
The contact page also loads hCaptcha, a spam check operated by Intuition Machines, Inc. It receives your IP address and signals about how you interact with that page in order to distinguish a person from an automated script. It runs on the contact page only, we do not use it for analytics or profiling, and our lawful basis is our legitimate interest in keeping the enquiry form usable. Their privacy policy is at hcaptcha.com/privacy. If you would prefer not to load it, write to us at the address in section 1 instead.
We do not run analytics. We do not use tracking pixels, advertising tags or session recording. Fonts are served from our own domain, and apart from the spam check described above, no page on this site contacts another company.
3. Why we use it, and on what basis
We use enquiry details for one purpose: to respond to your enquiry and, if it goes further, to arrange and follow up a briefing or a project conversation.
Our lawful basis is legitimate interests — specifically, responding to someone who has approached us about our services. We think this is what you expect when you submit the form. If you would rather we did not hold your details at all, tell us and we will delete them.
Server logs are kept on the basis of our legitimate interest in operating a secure website.
4. Who else sees it
Nobody, other than the suppliers who operate our website and email on our behalf. Those suppliers act as our processors: they may only handle the data on our instructions and may not use it for their own purposes. We do not sell personal data, and we do not share enquiry details with any other organisation, including the public bodies we work with.
5. Where it is held
Our hosting and email suppliers may store or process data outside the United Kingdom. Where that happens, the transfer is covered by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.
6. How long we keep it
- Enquiries that do not proceed: deleted within 24 months of our last contact.
- Enquiries that become an engagement: kept for the life of the relationship and then for as long as we must retain business records, normally six years.
- Server logs: kept for a short operational period and then overwritten.
7. Your rights
Under UK data protection law you may ask us to:
- confirm what personal data we hold about you, and give you a copy;
- correct anything inaccurate or incomplete;
- delete your data, where we have no continuing reason to keep it;
- restrict how we use it, or object to our using it at all;
- provide it in a portable, machine-readable form.
Email privacy@caseflow.uk and we will respond within one month. There is no charge. If you are unhappy with how we have handled your data you may complain to the Information Commissioner’s Office atico.org.uk, though we would rather you raised it with us first.
8. Changes to this notice
If we add anything to the site that collects data — analytics, an embedded booking tool, a chat widget — we will update this notice before it goes live, and ask for your consent where the law requires it.