Last updated: 10 June 2026
This privacy notice tells you what to expect us to do with your personal information.
This notice contains
- Contact details
- What information we collect, use, and why
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- How to complain
Contact details
Email: [email protected]
What information we collect, use, and why
We collect or use the following information to provide services and goods, including delivery:
- Names and contact details
- Purchase or transaction details
- Payment details (including card or bank information where applicable)
- Account information
We collect or use the following information for the operation of customer accounts and guarantees:
- Names and contact details
- Account information
- Location data (where relevant to service delivery or support)
- Call recordings
- Notes from conversations with you
- Visual recordings (where CCTV or similar systems are in use at our premises)
We collect or use the following information for service updates or marketing purposes:
- Names and contact details
- Marketing preferences
- Website user information (including user journeys and cookie tracking)
- Information relating to customer feedback and responses to promotions
- Call recordings
- Notes from conversations with you
When you submit a contact, interest, or founding-member application form on our website, we may also collect your name, work email address, job role, organisation details, free-text messages, and information about your investigation challenges or volume. We use this to respond to enquiries, assess programme eligibility, and improve our service.
When you use our website, we use analytics tools that may collect technical usage data such as IP address, browser type, device information, pages visited, and interactions with the site.
Lawful bases and data protection rights
Under UK data protection law, we must have a lawful basis for using your personal information. The lawful bases we rely on are:
| Purpose | Lawful basis |
|---|---|
| Providing our services and managing customer accounts | Performance of a contract, or steps taken at your request before entering a contract |
| Responding to enquiries and processing applications | Legitimate interests (to operate and grow our business) or performance of a contract |
| Service updates and essential communications | Legitimate interests or performance of a contract |
| Marketing communications | Consent (where required) or legitimate interests |
| Website analytics and product improvement | Legitimate interests |
| Legal and regulatory compliance | Legal obligation |
Your data protection rights
Under UK data protection law, you have rights including:
- Your right of access — you have the right to ask us for copies of your personal information.
- Your right to rectification — you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure — you have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing — you have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing — you have the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at [email protected] if you wish to make a request.
Where we get personal information from
We collect personal information directly from you when you:
- Create or use a CaseGrid account
- Contact us by email, phone, or through forms on our website
- Apply for founding member access or register your interest
- Subscribe to updates or marketing communications
- Use our website (including through cookies and analytics technologies)
We may also receive information from publicly available professional sources where relevant to business development, or from referral partners where you have been introduced to us.
How long we keep information
We keep personal information only for as long as necessary for the purposes described in this notice, including to meet legal, accounting, or reporting requirements.
Typical retention periods include:
- Customer account data — for the duration of your relationship with us, and up to six years afterwards where needed for legal or contractual purposes.
- Enquiry and application data — up to two years from your last interaction, unless a longer period is needed to manage an ongoing relationship.
- Marketing preferences — until you withdraw consent or object to processing, or for up to two years from your last engagement.
- Website analytics data — according to the retention settings of our analytics provider (see Who we share information with).
Who we share information with
We may share personal information with trusted service providers who process data on our behalf and only according to our instructions. These include:
PostHog — website and product analytics. PostHog helps us understand how visitors use our website and improve our service. PostHog may process technical usage data such as IP addresses, browser and device information, page visits, and user journey data. See PostHog’s privacy policy.
Resend — transactional and operational email delivery. When you submit a form on our website, we may use Resend to send and manage emails related to your enquiry or application. Resend processes names and email addresses (and any other information included in the message). See Resend’s privacy policy.
Cloudflare — hosting infrastructure, content delivery, and security proxy. Our website is served through Cloudflare’s global network. As a reverse proxy, Cloudflare processes connection-level data for every visitor — including IP addresses, HTTP request headers, and device information — in order to route traffic, protect against threats, and improve performance. Cloudflare is based in the United States; international transfers are protected by Standard Contractual Clauses and Cloudflare’s participation in the EU-US Data Privacy Framework. See Cloudflare’s privacy policy.
We may also share information:
- With professional advisers (such as lawyers, accountants, or insurers) where necessary
- With regulators, courts, or law enforcement where required by law
- In connection with a business sale, merger, or reorganisation, with appropriate safeguards
We do not sell your personal information.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at [email protected].
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk