TRUST-01 · TRUST-02 · TRUST-03

Privacy by design, documented end to end

casaios acts as a processor for customer content and as a controller for its own account and billing data. This page summarises how personal data flows through the platform and how you exercise control over it.

Purpose and lawful basis

Every processing activity is recorded with its purpose, lawful basis and retention period. Customer content is processed only on documented instructions.

Data minimisation

We collect the smallest set of data needed to deliver the service. Optional data is clearly marked as optional and never pre-selected.

Data subject rights

Access, rectification, erasure, restriction, portability and objection requests are routed to a named owner with a documented response target.

International transfers

Primary hosting is in the European Union. Where a transfer is necessary, it is covered by Standard Contractual Clauses and a transfer assessment.

Retention and deletion

Retention schedules are defined per data category, with deletion on contract termination and verified erasure across backups within the documented window.