Legal

Privacy Policy

Draft — not yet published

Draft for counsel review. Items in [brackets] require a business or legal decision before publication.

1. Who we are

CASPOMA is a cask portfolio platform: software that investment groups use to keep a member-facing system of record of the casks their members own. This policy is issued by [LEGAL ENTITY NAME, REGISTRATION NUMBER AND REGISTERED ADDRESS — COUNSEL] (“CASPOMA”, “we”, “us”). For anything in this policy, write to privacy@caspoma.com.

2. The two roles we play

We handle personal information in two distinct capacities, and your rights run differently under each:

  • This website (caspoma.com). For information collected on this marketing site — such as a contact enquiry — we decide how and why the information is used. We are the data controller.
  • The CASPOMA platform. The records inside the platform — investment group member details, cask holdings, documents — belong to the investment group that operates the account. The investment group decides why that information is processed; we process it on the investment group’s instructions under our License Agreement and data processing terms. We are a processor. If you are a member of an investment group that uses CASPOMA and want to exercise rights over your information in the platform, your investment group is the right first contact; we will assist them in responding.

3. What this website collects, and why

  • Contact enquiries. If you use our contact form we store the name, email address, phone number, company or investment group name, and message you give us, together with which enquiry type you selected and the page you came from. We use this solely to respond to you.
  • A security cookie. Pages with forms set a session cookie so we can verify that a submission genuinely came from you (protection against cross-site request forgery). See the Cookie Policy.
  • Abuse prevention. To limit automated abuse of the contact form we keep a short-lived, salted cryptographic digest of your IP address — not the address itself — which is deleted within 24 hours.
  • Analytics. [IF ANALYTICS ENABLED: name the tool, what it collects, and the lawful basis. The site currently sets no analytics by default — DECIDE.]

4. What we do not do

  • We do not sell or rent personal information to anyone.
  • We do not run advertising or advertising trackers on this site.
  • We do not profile visitors or build marketing audiences from platform data.

5. Information in the platform

Investment groups use CASPOMA to hold records about their members and their members’ casks. Those records are the investment group’s. Tenant isolation is enforced at the database layer, so one investment group’s records are not visible to another investment group. We access platform data only to operate, support, and secure the service, or where the operating investment group instructs us.

6. Sharing

We share personal information only with service providers who help us run the website and platform (such as hosting), under contracts that restrict their use of it; where a law or court requires disclosure; or in connection with a corporate transaction, in which case this policy continues to apply to the information transferred.

7. Where information is processed

[HOSTING LOCATION AND TRANSFER MECHANISM — CONFIRM. State where the servers are, and where visitors or members are in other jurisdictions, the mechanism relied on for the transfer (e.g. standard contractual clauses).]

8. Retention

  • Contact enquiries: kept while we correspond with you and for [RETENTION PERIOD — DECIDE] afterwards, then deleted.
  • Abuse-prevention digests: deleted within 24 hours.
  • Platform records: retained per the operating investment group’s instructions and the License Agreement, including deletion or return when an investment group’s agreement ends.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information, and to object to certain processing. Write to privacy@caspoma.com and we will respond within the period the applicable law requires. [REGULATOR AND COMPLAINT ROUTE — COUNSEL: name the supervisory authority appropriate to the chosen jurisdiction.]

10. Security

Records in the platform are kept with every change recorded and every state recoverable. Access to administrative systems is limited to authorised personnel, sessions are hardened, and we do not store more than the purposes above require. No system is perfectly secure; if we learn of a breach affecting your information we will notify you and any required authority without undue delay.

11. Changes to this policy

This policy is versioned. Each published version carries a version number and effective date, and every previous version remains permanently readable at its own address, so you can always see exactly what applied at a given time.