Privacy Policy

Who We Are

CassConsult ("we", "us", "our") is a specialist business consultancy operating in the payments industry, banking regulation and compliance, and process-flow improvement and automation. We act as the data controller for the personal information collected through this website and our professional services.

For any privacy-related enquiry, please contact us at cassconsulting.eu@gmail.com. Our correspondence address is provided upon request for verified business purposes.

What Personal Data We Collect

We collect only the minimum information necessary to deliver our services and respond to enquiries. The categories of data we may process include:

• Contact and enquiry data — name, business email address, company or organisation name, phone number (if voluntarily provided), and the content of your message when you complete our contact form or reach out by email.
• Professional context data — your role, industry, and the nature of the consultancy need you describe, which allows us to assess how best to assist you.
• Website usage data — IP address (anonymised where possible), browser type, operating system, referring URL, pages visited, and session duration, collected automatically through cookies and analytics tools.
• Communication records — correspondence exchanged with us by email or telephone in the course of a client engagement or pre-engagement discussion.

We do not collect sensitive personal data (e.g. health information, political opinions, biometric data) through this website. We do not process the personal data of children under 16.

How We Use Your Data

We use personal data for the following purposes:

• Responding to enquiries — to assess your needs, provide information about our services, and follow up on initial contact.
• Delivering consultancy services — to fulfil contractual obligations where a client engagement is agreed, including project management, reporting, and advisory communications.
• Improving our website — to understand how visitors navigate the site and to identify areas for enhancement, using aggregated and anonymised analytics data.
• Legal and compliance obligations — to comply with applicable laws, regulations, or professional standards, including record-keeping obligations relevant to the financial services sector.
• Legitimate business interests — to manage our business operations, protect our legal rights, and prevent fraud or misuse of our services.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

Legal Basis for Processing

Where the UK GDPR and EU GDPR apply, we rely on the following legal bases to process your personal data:

• Article 6(1)(b) — Contract: processing is necessary to take steps at your request prior to entering a contract, or to perform a contract to which you are a party.
• Article 6(1)(c) — Legal obligation: processing is necessary to comply with a legal obligation to which we are subject (e.g. anti-money laundering record-keeping, professional regulatory requirements).
• Article 6(1)(f) — Legitimate interests: processing is necessary for our legitimate interests (such as responding to enquiries, securing our systems, and improving our services), provided those interests are not overridden by your rights and interests.
• Article 6(1)(a) — Consent: where we rely on consent (e.g. for non-essential cookies or marketing communications), you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

For clients in jurisdictions subject to the Gramm-Leach-Bliley Act (GLBA) or other US federal or state privacy frameworks, we apply equivalent safeguards and provide required notices separately as part of the client onboarding process.

Cookies & Tracking Technologies

Our website uses cookies — small text files stored on your device — to ensure functionality and to help us understand how the site is used. The cookies we use fall into two categories:

• Strictly necessary cookies: required for the website to function correctly (e.g. session management, security tokens). These are placed without consent as they are essential to the service.
• Analytics cookies: used to collect aggregated, anonymised data about visitor behaviour (e.g. pages viewed, time on site). Where such cookies identify individuals or are non-essential, we request your consent before placing them.

All fonts used on this website are hosted on our own servers rather than loaded from a third-party font provider. Visiting this site therefore does not cause your browser to contact Google Fonts or any comparable external font service, and no data is transmitted to such providers for this purpose.

For website analytics, we use Cloudflare Web Analytics, a privacy-first service that does not use cookies and does not track individual visitors across websites. It collects only aggregated, anonymised metrics (e.g. page views, page load performance), so no cookie consent banner is triggered by its use.

You can manage or disable cookies through your browser settings at any time. Note that disabling certain cookies may affect your experience of the site.

Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to any third party. We may share your data only in the following limited circumstances:

• Service providers: trusted third parties who assist us in operating our website or delivering services, bound by contractual obligations to protect your data and process it only on our instructions. This currently includes Netlify, Inc. (San Francisco, USA), which hosts this website and processes submissions made through our contact form (name, company, email, phone number, and message content) on our behalf, and Cloudflare, Inc. (San Francisco, USA), which provides privacy-first website analytics (aggregated page views and load performance) without using cookies or tracking individual visitors.
• Professional advisors: lawyers, accountants, or insurers acting in their professional capacity on our behalf, subject to professional confidentiality obligations.
• Regulators and authorities: where required by applicable law, a court order, or a regulatory body with jurisdiction (e.g. the Financial Conduct Authority, European Banking Authority, or equivalent supervisory authorities).
• Business transfers: in the event of a merger, acquisition, or sale of all or substantially all of our business assets, your data may form part of the transferred assets, subject to equivalent privacy protections.

Where data is transferred outside the UK or European Economic Area (EEA) — for example, to Netlify, Inc. or Cloudflare, Inc. in the United States — we ensure appropriate safeguards are in place before any transfer takes place. Both Netlify and Cloudflare are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and are bound by Standard Contractual Clauses, both recognised transfer mechanisms under the GDPR.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Enquiry data (no engagement): retained for up to 12 months from the date of last contact, after which it is securely deleted unless an ongoing relationship has developed.
• Client engagement records: retained for 7 years following the conclusion of an engagement, in line with standard professional and financial services record-keeping requirements.
• Website analytics data: retained in anonymised or aggregated form for up to 26 months, consistent with standard analytics platform practices.
• Legal and compliance records: retained for the period prescribed by the applicable regulatory or statutory obligation, which may exceed the above periods.

When data is no longer required, it is securely deleted or anonymised in a manner that prevents reconstruction of personal information.

Your Rights

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at cassconsulting.eu@gmail.com. We will respond within 30 days and will not charge a fee for reasonable requests.

You also have the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the relevant supervisory authority — in the UK, this is the Information Commissioner's Office (ICO); in the EU, your national data protection authority.

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, disclosure, alteration, or destruction. These include:

• Encryption of data in transit using TLS (Transport Layer Security).
• Access controls ensuring that personal data is accessible only to personnel who require it in the course of their duties.
• Regular review of our information security practices in line with our obligations to clients in regulated financial services environments.
• Contractual data protection obligations imposed on all third-party service providers who process data on our behalf.

While we take all reasonable steps to protect your data, no method of internet transmission or electronic storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform you directly without undue delay.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the services we offer. Any material changes will be indicated by a revised effective date at the top of this page. Where required by law or where changes are significant, we will provide additional notice (e.g. by email to active clients).

We encourage you to review this page periodically to stay informed about how we protect your information.