Last updated 21 August 2026
Casrose Ltd builds and operates business messaging and workflow software. This policy explains what we do with personal data — both data we hold in our own right, and data we handle on behalf of the businesses that engage us.
Casrose Ltd is a software company registered in England and Wales.
| Contact for privacy matters | cas@casrose.co.uk |
|---|---|
| ICO registration | ZB941135 |
| Registered office | 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ |
| Company number | 17394395 |
This matters, because it decides who you should contact about your data.
When you visit casrose.co.uk or contact us directly, we decide what we collect and why. We are the controller and we handle your request from start to finish.
We operate messaging and administration services for other companies. In that work the client business is the controller — it decides what is collected, why, and for how long — and we act on its documented instructions under a written agreement meeting UK GDPR Article 28.
If you are a worker or subcontractor and your employer or contractor uses one of our services, your data-rights requests are for that business to decide. We can't delete their records on our own initiative. You can still send your request to us — see our data deletion page — and we will acknowledge it, pass it to the business and help them action it. Contacting them directly is usually faster.
This site sets no advertising or analytics cookies, and loads no third-party fonts, scripts or trackers.
Acting as a processor for client businesses, the following may pass through or be stored in our systems: WhatsApp phone numbers, names and nicknames, message content, photographs and videos sent to the service, records of work carried out, day rates and pay calculations, and tax-scheme status such as Construction Industry Scheme verification outcomes.
Our services are designed to hold the minimum needed to do the job. Identity documents, bank details, National Insurance numbers and tax reference numbers are deliberately kept out of the messaging systems and are handled directly between the worker and the client business or its bookkeeper.
We use these sub-processors:
| Meta Platforms Ireland Ltd | WhatsApp Business Platform — message delivery |
|---|---|
| Google Ireland Ltd | Workspace, Drive and Sheets — record and media storage |
| Railway Corp. | Application hosting |
| Anthropic PBC | Automated interpretation of message text and photographs |
Client businesses are told before we add or change a sub-processor. We do not sell personal data, and we do not share it for anyone's marketing.
Some of the providers above process data outside the UK. Where they do, transfers rely on UK adequacy regulations or the UK International Data Transfer Addendum, together with the provider's own safeguards.
For data we hold as a controller, see section 3. For data we process for a client business, the client's retention schedule applies; when a contract ends we return or delete the data on their instruction, except anything we are required to keep by law.
Access is limited to named accounts protected by two-factor authentication. Data is encrypted in transit. Credentials and access tokens are held in managed secret stores — never in messages, spreadsheets or documents.
You have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how it is used, and to receive it in a portable form. Some of these rights have limits — for example, records that must be kept for tax purposes.
Email cas@casrose.co.uk. We will acknowledge within five working days and respond within one month. Where we act as a processor we will pass your request to the controller and support them in answering it.
If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Any change is published on this page with a new date at the top.