Privacy notice

1. Who we are

Cask Manager is operated by [Operator legal name] Ltd, a company registered in Scotland with company number [Company number]. Our registered office is [Registered office address line 1], [Town], [Postcode].

We are registered with the Information Commissioner's Office under registration number [ICO registration number]. For anything to do with your personal information, contact us at [email protected].

2. When we are the controller and when we are a processor

Data protection law distinguishes between the organisation that decides why and how personal information is used (the controller) and an organisation that handles it on someone else's behalf (a processor). We are each of these at different times.

Customer data. The records an organisation keeps on the platform belong to that organisation. Cask registers, ownership and Delivery Order records, owner accounts, identity checks, invoices, HMRC returns and the like are all examples. For this information the organisation is the controller and we act as its processor, following its instructions under our agreement with it. If a warehouse or broker holds your details on Cask Manager, that business is responsible for how they are used, and you should contact it first. We will help it respond.

Our own data. We are the controller for information we use to run Cask Manager itself. That includes user accounts and sign-in records, security and abuse-prevention records, website analytics, support conversations, and enquiries from prospective customers.

3. The information we collect

Depending on how you use the service, we may hold:

• Account details: your name, username, email address, password (stored only as a secure hash), the organisation you work for, your roles, and any multi-factor authentication methods you set up.
• Sign-in and security records: the date and time of sign-ins, IP address, browser and device type, active sessions, and signals we use to detect fraud, account takeover and repeated abuse.
• Work you record: the operational and commercial records you enter or import on behalf of your organisation, together with an audit trail of who changed what and when.
• Owner and identity information: where a warehouse or broker onboards you as a cask owner, the contact details, identity documents and source-of-funds evidence it asks for.
• Messages and uploads: chat messages, comments, documents and photos you add.
• Location: a location you choose to save on your profile, or a map position recorded against a premises.
• Enquiries and claims: what you tell us when you request early access, contact us, or submit an ownership claim through our public form.
• Usage information: pages viewed, features used, clicks and errors, collected by our analytics and monitoring tools (see the section on cookies below).

4. How we use it and our lawful bases

Where we are the controller, we rely on the following lawful bases under Article 6 of the UK GDPR.

• Contract. Creating and running your account, signing you in, sending service emails such as verification links, password resets and notifications, and providing the features your organisation has subscribed to.
• Legitimate interests. Keeping the service secure, preventing fraud and misuse, moderating content, fixing faults, understanding how the product is used so we can improve it, and responding to business enquiries. We weigh these interests against yours and do not rely on them where your rights should come first.
• Legal obligation. Keeping records the law requires, responding to lawful requests from authorities, and handling your data protection requests.
• Consent. Sending marketing emails where the law requires your agreement. You can withdraw consent at any time, and doing so does not affect anything we did before.

Where we act as a processor, the customer organisation decides the lawful basis, and we use the information only to provide the service to that organisation.

We do not sell personal information. We do not use it to build advertising profiles.

5. Optional AI-assisted features

Cask Manager includes some AI-assisted features, for example help mapping an import file, reading the details from an uploaded document, or answering questions about the stock held in bond. These are off by default. They run only after we have enabled them for an organisation and one of that organisation's administrators has switched on each feature individually.

When a feature runs, the content it needs is sent to Anthropic, which provides the underlying model. Under Anthropic's commercial terms that content is not used to train its models. Every request is recorded so the organisation can see what was sent and why.

No AI feature makes a decision about you by itself. Its output is shown to a person, and records only change when someone accepts the suggestion.

6. Who we share it with

We use a small number of service providers to run Cask Manager. Each one handles personal information only on our instructions and under a written agreement.

• [Hosting provider] hosts our application servers and database.
• Cloudflare stores uploaded files and documents (Cloudflare R2), and runs the Turnstile check that protects sign-up and repeated sign-in attempts from automated abuse.
• Postmark delivers the emails the service sends, such as verification links, password resets and notifications.
• Anthropic provides the model behind the optional AI features, and receives content only when an organisation has switched a feature on.

Some tools run on infrastructure we operate ourselves, so the information in them is not shared with the companies that make them. These are our product analytics (PostHog), search, chat messaging, address lookup, and system monitoring.

If you or your organisation choose to sign in with Microsoft or Google, or connect a Microsoft, Google or Facebook account, that provider confirms your identity to us and shares your name and email address. Each provider handles your information under its own privacy policy. Map screens load map images directly from OpenStreetMap, which receives your IP address in doing so.

We may also disclose information to HMRC or another authority where your organisation instructs us to submit a return or notification for it, where the law requires it, or to protect the rights and safety of our users. If we reorganise or sell the business, information may pass to the new owner, who would be bound by this notice.

7. International transfers

Our main systems are hosted in [Hosting country]. Some of the providers listed above are based in, or may process information in, the United States or other countries outside the UK.

When personal information leaves the UK, we make sure it stays protected. We rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where a provider is certified under it. Otherwise we use the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard used for a particular provider.

8. How long we keep it

We keep personal information only for as long as we need it. Some typical periods are:

• Account details are kept while the account is open, and for a limited period after it closes so we can deal with queries, disputes and security investigations.
• Sign-in sessions expire after 30 days.
• Content removed by moderators is permanently deleted 90 days after removal. A record of the moderation decision is kept so it can be reviewed on appeal.
• Identity and source-of-funds documents collected during owner onboarding are kept for at least six years after the business relationship ends, because the warehouse's record-keeping obligations require it.
• Customer data is kept for as long as the customer organisation's agreement with us requires. Many warehouse, excise and accounting records must legally be kept for several years, and the organisation decides those periods.

When information is no longer needed, we delete it or anonymise it so it can no longer be linked to you.

9. Cookies and similar technologies

Cask Manager uses a small number of cookies and browser storage entries.

• Session cookie. Keeps you signed in. It is strictly necessary and lasts up to 30 days, or until you sign out.
• Security cookie (csrftoken). Protects forms against cross-site request forgery. It is strictly necessary.
• Product analytics. Our self-hosted PostHog instance sets a cookie and a browser storage entry that recognise a returning browser. It records pages viewed, clicks and errors and, for signed-in users, links that activity to your account. It can also record a replay of how a page was used. Anything typed into a form field is masked and never recorded.
• Preferences. Your browser remembers some display choices, such as the warehouse you last worked in. These stay on your device.

Cloudflare Turnstile may read information about your browser and device to tell people apart from automated software when you sign up. You can block or delete cookies in your browser settings. If you block the strictly necessary ones, you will not be able to sign in.

10. Keeping it secure

Information is encrypted in transit, and access to it is limited by role and by organisation, so people see only the records their role and their organisation's business relationships allow. We support multi-factor authentication, including security keys and passkeys, and record significant actions in an audit log. No system is perfectly secure, but if a breach affects your information we will tell you and the ICO where the law requires us to.

11. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to erase information, where there is no longer a good reason to keep it;
• ask us to restrict how we use it while a concern is looked into;
• object to our use of it where we rely on legitimate interests, and to direct marketing at any time;
• receive information you gave us in a portable, machine-readable format;
• withdraw any consent you have given.

To exercise any of these, email [email protected] from the address on your account, or tell us how else we can confirm it is you. We will reply within one month. That can be extended by two further months for complex requests, and we will tell you if it is. There is normally no charge.

Some things you can do yourself once signed in. You can update your profile in your account settings, choose what others see on the privacy settings page, and review or sign out of your devices under sessions. If you use the owner portal, you can ask for a document you uploaded to be erased from the Documents page. Each request is reviewed. Where a warehouse is legally required to keep a document, such as an identity check, we will tell you why it cannot be erased yet and when it can.

If your request is about customer data held by an organisation that uses Cask Manager, we will pass it to that organisation and help it respond.

12. Complaints

Please talk to us first if you are unhappy with how we have handled your information, and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. You can contact the ICO at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. Children

Cask Manager is a business service for the whisky trade. It is not intended for anyone under 18, and we do not knowingly collect information about children.

14. Changes to this notice

We review this notice regularly and will update it when our services or the law change. The date at the top shows when the current version took effect. If we make a significant change, we will let account holders know by email or with a notice in the app before it applies.

15. Contact us

Write to us at [email protected], or by post to [Operator legal name] Ltd, [Registered office address line 1], [Town], [Postcode]. The rules for using the service itself are in our terms of use.