This policy explains how Charged Services Ltd (“Charged”, “we”, “us”) collects, uses, shares and protects personal data through this website (including our online shop) and through our Meta app ChargedGrokBot, which connects to WhatsApp, Facebook and Instagram. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Charged Services Ltd is a UK company that installs electric gates and barriers, access control, CCTV, intercoms and balustrades across South Essex and East London. Our website is charged.services.
Charged Services Ltd
13 Fleming Road, Chafford Hundred, Grays RM16 6YA
Email: info@charged.services
Phone: 01375 886299
We are registered with the Information Commissioner’s Office (ICO) and pay the data protection fee. ICO registration reference: ZC278103.
ChargedGrokBot is our app on the Meta platform. It uses the WhatsApp Business Cloud API, the Facebook Pages API and the Instagram API to:
- send and receive messages with customers and enquirers on WhatsApp, Facebook Messenger and Instagram;
- publish and manage posts, and read and reply to comments, on our Facebook Page and Instagram account;
- read Page and account insights (performance statistics);
- as a Meta Tech Provider, onboard other businesses’ WhatsApp numbers through Meta’s Embedded Signup so that we can send and receive WhatsApp messages on their behalf.
2. Controller and processor roles
When we are the controller
For our own customers, enquirers and followers (for example, when you fill in a form on this website, message Charged on WhatsApp, comment on our Facebook or Instagram posts, or ask us for a quote), Charged is the data controller. We decide why and how your data is used, and this policy applies in full.
When we are a processor
When a business connects its WhatsApp number to our app through Embedded Signup, that business is the data controller for the messages exchanged with its own customers, and Charged acts as its data processor. We process that data only on the business’s documented instructions, to provide the messaging service, and not for our own purposes. We keep it confidential and secure, and we help the business respond to requests from its customers.
If you are a customer of a business that uses our service, please contact that business first about your data; its own privacy policy applies. If you contact us instead, we will pass your request to the business and support it in responding.
For the business itself (for example, the contact details of the person who sets up the connection, and account and billing information), Charged is the controller.
3. Data we collect
We collect only what we need. Depending on how you interact with us, this may include:
| Source | Personal data |
|---|---|
| Website forms (contact and Remootio warranty registration) | Your name, email address, phone number, the service you are interested in and your message; for warranty registrations, the product, purchase date, where you bought it, order reference and any notes. |
| Quote enquiry form (sales.charged.services) | Your name, mobile number, email address, the site postcode and address, whether it is a home or business (and the company name), the systems you are interested in, your answers about the job (for gates: the type of gate, how it opens, its width and whether there is power nearby), your description, any links you add, how you found us (for example, the link in our text message), and the photos and videos of your site and the example pictures you upload. We also keep the date and time you sent it, the wording you agreed to, and whether you ticked the optional marketing box. The form uses Cloudflare Turnstile and simple checks to block spam, and keeps a scrambled copy of your IP address (scrambled differently each day, so it cannot be linked across days) to limit repeat submissions. If you press Save on step 1 of the form but don't send the rest, we keep your name, mobile number and address so we can call you back about your enquiry. |
| Shop orders (charged.services/shop) | Your name, email address, phone number, billing and delivery address, the items you order, the amounts paid or refunded, order and payment references, and delivery and tracking status. You enter your card details on Stripe’s secure checkout page; they are not sent to or stored by us. Your basket is kept in your own browser until you go to checkout. We keep a record of each order (your email address, the items, quantities and amounts, and refunds) in our order database. |
| Shop accounts (charged.services/account, optional; you can still check out as a guest) | Your name, email address and phone number (if you give it), whether it is a retail or trade account, and the date you confirmed your email address. For trade accounts: your company or trading name, business type, Companies House number (for limited companies and LLPs), VAT number (optional), trade type, website (optional), and our decision on your application. Your order history, including the units you have ordered while signed in and any units refunded, which we use to work out your trade discount. Whether you have agreed to marketing emails, and when and where you agreed. To keep you signed in and to protect sign-in, we store a sign-in record (a scrambled copy of the session code, a scrambled copy of your IP address, your browser type and the expiry time) and, for each sign-in link we email you, a scrambled copy of the link code and when it was used, the email address the link was sent to, and short-term counters (using scrambled copies of your email and IP address) that limit how many sign-in emails can be sent. |
| WhatsApp (WhatsApp Business Cloud API) | Your phone number; your WhatsApp profile name; the content of messages you send and that we send to you; photos, videos, voice notes, documents and other media you share; message timestamps and delivery/read status. |
| Facebook (Pages API, Messenger) | Your name and profile name; your page-scoped user ID; messages sent to our Page and any media in them; comments and reactions on our posts; Page IDs; Page insights. |
| Instagram (Instagram API) | Your Instagram username and profile name; your Instagram-scoped user ID; direct messages and media sent to our account; comments and mentions on our posts; account IDs; account and post insights. |
| Post, comment and insights data | Content of posts we publish, comments and replies, and insights such as reach, impressions and engagement. Insights are mostly aggregated and do not usually identify individuals. |
| Businesses onboarded via Embedded Signup | Business name, WhatsApp Business Account ID, phone number ID and display phone number, the name and contact details of the person who connects the account, and the access tokens Meta issues to let our app act for the business. We also process the business’s customer messages (as described under WhatsApp above) as its processor. |
| Site visits, installations and servicing | The name and contact details of the site contact, the site address, the details and test results of the system we work on, photos of the installation, and the signature of the person who signs off the work. We avoid photographing people and never photograph identifiable children. For CCTV work we may keep a few reference stills to check image quality. |
| Information you give us directly | Anything you choose to share during a conversation, such as your address, site details, photos of your gate or property, and preferred appointment times, so we can quote for and carry out work. |
We do not ask for special category data (such as health information). Please do not send it to us through our forms or messaging channels.
4. How we use data and our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Replying to enquiries, giving quotes, booking surveys and installations, registering warranties, and providing service and support | Steps taken at your request before a contract, and performance of a contract (Art. 6(1)(b)) |
| Taking payment for, delivering and supporting shop orders, including cancellations, returns, refunds and faulty goods | Performance of a contract (Art. 6(1)(b)) |
| Creating and running your shop account: emailing you sign-in links, keeping you signed in, showing your orders, and linking orders to your account | Performance of a contract (Art. 6(1)(b)) |
| Checking trade account applications (for example on Companies House and HMRC’s VAT checker), applying trade discounts at checkout, and keeping the running unit total that sets your trade discount | Steps taken at your request before a contract, and performance of a contract (Art. 6(1)(b)); legitimate interests in offering trade prices only to businesses (Art. 6(1)(f)) |
| Looking at the details, photos and videos you send through our quote enquiry form so we can reply, prepare a quote or book a visit. We may use AI tools to help read your photos and draft a quote; a member of our team always checks it before anything is sent to you, and no decision is made about you by automated means alone | Steps taken at your request before a contract (Art. 6(1)(b)); legitimate interests in quoting quickly and accurately (Art. 6(1)(f)) |
| Calling you back about a part-filled enquiry (you pressed Save on step 1 but didn't finish), about that enquiry only and never for marketing | Legitimate interests in following up enquiries people have started (Art. 6(1)(f)); you can object at any time |
| Sending you offers, news and tips by email and text message, if you tick the optional box on our quote enquiry form | Your consent (Art. 6(1)(a)), which you can withdraw at any time (see opting out of marketing) |
| Sending you marketing emails about offers and new products, if you tick the box to agree | Your consent (Art. 6(1)(a)), which you can withdraw at any time by unsubscribing or contacting us |
| Keeping shop order, payment and refund records | Legal obligation for accounting and tax records (Art. 6(1)(c)); contract (Art. 6(1)(b)) |
| Keeping records of jobs, quotes, invoices and customer communications | Contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c)); legitimate interests in keeping accurate records (Art. 6(1)(f)) |
| Keeping safety records for gates, barriers and doors (risk assessments, force test reports, certificates, safety notices and the signed job sheets for that work) | Legal obligation (Art. 6(1)(c)) and legitimate interests in being able to show the work was done safely (Art. 6(1)(f)) |
| Publishing and managing our Facebook and Instagram posts, and replying to comments | Legitimate interests in promoting our business and responding to the public (Art. 6(1)(f)) |
| Reading insights to understand how our content performs | Legitimate interests in improving our marketing (Art. 6(1)(f)) |
| Using automation and AI tools to help triage, draft and route messages (always overseen by Charged) | Legitimate interests in responding quickly and efficiently (Art. 6(1)(f)); contract where it relates to your job (Art. 6(1)(b)) |
| Sending marketing or promotional messages on WhatsApp | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Providing WhatsApp messaging to businesses we onboard as a Tech Provider | We act as processor on the business’s instructions; the business is responsible for its own lawful basis. For the business’s own account details: contract (Art. 6(1)(b)) |
| Keeping our website and systems secure, preventing spam and misuse, and complying with Meta’s platform terms | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have balanced our interests against your rights, and you can object at any time (see Your rights). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share data with
We do not sell your personal data, and we do not share it with third parties for their own marketing. We share it only with:
- Meta Platforms (including WhatsApp, Facebook and Instagram), which provides the messaging and social media services our app uses. Messages and content pass through Meta’s systems. Meta’s own processing is covered by its policies: Meta Privacy Policy and WhatsApp legal information.
- Anysphere, Inc. (United States), which provides the cloud computer and AI assistant platform we use to run our business automations, including our WhatsApp and social media tools. It stores and processes messages and account details from WhatsApp, Facebook and Instagram so that we can receive, sort and draft replies to them, acting as our processor. It may use the data only to provide its service to us.
- Cloudflare, Inc., which hosts this website, keeps it secure (including spam protection on our forms with Cloudflare Turnstile) and runs the web endpoint that receives notifications from WhatsApp and Meta, such as new messages, acting as our processor. It also stores our shop account and order database, and the details, photos and videos sent through our quote enquiry form, in private storage that is not publicly accessible (Cloudflare D1 and R2).
- Stripe, which takes card payments for shop orders on its secure checkout page. Stripe receives your payment details and the contact, billing and delivery details you enter at checkout. It acts as our processor for the payment, and as an independent controller for its own legal duties such as fraud prevention and anti-money-laundering checks, under its own privacy policy.
- Amazon, which packs and delivers shop orders from its UK warehouse through its Multi-Channel Fulfilment service, acting as our processor. We send Amazon your name, delivery address and phone number and the items you ordered, so it can deliver them and give us tracking details.
- Brevo, which sends our emails, acting as our processor: website form submissions, shop order notifications and new trade account applications to us, and order confirmation emails, account sign-in links, trade application updates and the confirmation of your quote enquiry (with your reference) to you. These emails contain your order details, name, contact details and delivery address, and the confirmation may attach your VAT invoice. Brevo does not receive any data from WhatsApp, Facebook or Instagram.
- Xero, our accounting software, acting as our processor. For shop orders we send Xero your name (or business name), email address, phone number, billing address, the items, delivery and any discount on your order, and the order reference, so that we can issue your VAT invoice and keep our accounting and tax records. Xero hosts its service outside the UK, mainly in the United States (see section 6).
- Professional advisers (such as accountants and insurers) where needed, under duties of confidentiality.
- Authorities such as law enforcement or regulators, where the law requires it.
- The business concerned, where we act as a processor for a business onboarded through Embedded Signup.
Anysphere and Cloudflare are the only service providers with access to the data we receive from Meta (WhatsApp, Facebook and Instagram). All our processors are bound by written contracts that require them to keep data secure and use it only on our instructions.
6. International transfers
Meta and some of our service providers (including Stripe, Amazon, Brevo and Xero) may process data outside the UK, including in the European Economic Area and the United States. Where data is transferred outside the UK, we make sure appropriate safeguards are in place, such as UK adequacy regulations (including the UK–US Data Bridge for certified organisations), the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information about these safeguards.
7. How long we keep data
We keep personal data only for as long as we need it for the purposes above:
- Messages and media (WhatsApp, Messenger, Instagram, and website contact forms): up to 24 months from the last message, unless they form part of a job record.
- Quote enquiry form (details, photos and videos): if the enquiry does not lead to a job, we delete it 12 months after you sent it. If it leads to a job, it becomes part of the job record (below). If you ticked the marketing box, we keep your name, contact details and that choice until you opt out.
- Job records (quotes, invoices, job notes and the related messages): 6 years after the end of the financial year in which the job was completed, to meet accounting, tax and warranty needs.
- Safety records for gates, barriers and doors (risk assessments, force test reports, certificates of conformity, safety notices and the signed job sheets for that work): 15 years from the date of the work, or for the life of the installation if longer, because claims about safety can be brought up to 15 years later (Limitation Act 1980).
- CCTV reference stills: 12 months, or until our next service visit if that is sooner.
- Shop orders (order, payment, delivery and refund records, and order notification emails): 6 years after the end of the financial year in which the order was placed, to meet accounting and tax requirements and to deal with any claim about faulty goods.
- Shop accounts (your account details, trade application details and marketing choice): while your account is open. You can ask us to close your account at any time (see User data deletion). Orders placed with an account are kept as shop order records (above).
- Sign-in records: sign-in links expire after 15 minutes and work once; you stay signed in for up to 30 days unless you sign out. Once a sign-in record, sign-in link or the short-term counter we use to limit sign-in emails has been expired for 30 days, we delete it automatically the next time our sign-in system runs its clean-up, which happens when sign-in emails are requested. This means some expired records may be kept for longer than 30 days if the system has not been used in the meantime.
- Comments and post data: for as long as the post is live on our Page or account. Copies we hold are deleted within 24 months.
- Insights: up to 24 months. We may keep aggregated statistics that do not identify anyone for longer.
- Data for businesses onboarded via Embedded Signup: for as long as the business uses our service. We delete it within 30 days after the business disconnects or ends the service, unless the business instructs otherwise. Access tokens are revoked and deleted when the connection ends.
- Marketing consent records and opt-outs: kept while we hold your email address or number, so that we keep respecting your choice.
When data is no longer needed, we delete it securely or anonymise it.
8. Security
We use appropriate technical and organisational measures to protect personal data. These include encrypted connections (HTTPS/TLS), access limited to authorised people who need it, strong authentication on our accounts, secure storage of access tokens, and regular review of the services we use. WhatsApp messages are encrypted in transit. No system is completely secure, but if we become aware of a personal data breach we will act promptly and notify the ICO and affected people where the law requires.
9. Your rights
Under UK data protection law you have the right to:
- Access: get a copy of the personal data we hold about you;
- Rectification: have inaccurate or incomplete data corrected;
- Erasure: have your data deleted in certain circumstances;
- Restriction: ask us to limit how we use your data;
- Objection: object to processing based on legitimate interests, and to direct marketing at any time;
- Data portability: receive data you gave us in a commonly used, machine-readable format, or have it sent to another organisation;
- Withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.
How to exercise your rights: email info@charged.services, call 01375 886299, or write to us at the address above. We may need to confirm your identity (for example, by asking you to message us from the same WhatsApp number). We will respond within one month, and there is normally no charge.
10. User data deletion
How to ask us to delete your data
- Email info@charged.services with the subject line Data deletion request.
- Tell us how you contacted us (website, WhatsApp, Facebook or Instagram) and include the email address, phone number, profile name or username you used, so we can find your data.
- We will delete your personal data from our app and systems within 30 days and email you to confirm when it is done.
If we must keep some data for legal reasons (for example, invoices we are required to keep for tax purposes), we will tell you what we are keeping and why, and delete it once that period ends.
Removing the app from Facebook: if you have connected ChargedGrokBot to your Facebook account, you can also remove it at any time. Go to Facebook Settings & privacy → Settings → Apps and websites, select ChargedGrokBot and choose Remove. Then email us as above to have the data we already hold deleted.
Businesses onboarded via Embedded Signup: to disconnect your WhatsApp number and have your data deleted, email us with the subject Data deletion request. You can also remove our app’s access in Meta Business Settings. We will delete your data, including your customers’ messages, within 30 days and confirm in writing.
Deleting data from our systems does not delete messages from your own WhatsApp, Messenger or Instagram app, or data that Meta holds under its own policies.
11. Opting out of WhatsApp messages
You can stop receiving WhatsApp messages from us at any time by replying STOP to any of our messages. We will confirm and stop sending you marketing or non-essential messages. You can also block our number in WhatsApp, or contact us using the details above. If you have an active job with us, we may still need to contact you about it by another method, such as phone or email.
If you receive messages from another business that uses our service, replying STOP will opt you out of that business’s messages, and we will pass your choice on to that business.
Opting out of marketing emails and texts
If you ticked the optional box on our quote enquiry form, you can stop our offers, news and tips at any time: use the unsubscribe link in any marketing email, reply STOP to any marketing text, or contact us using the details above. Opting out does not affect your enquiry or any job with us.
12. Cookies
This website does not use advertising or analytics cookies or tracking scripts. Our forms are protected by Cloudflare Turnstile, which may use strictly necessary technologies to tell people from bots. If you sign in to a shop account, we set one strictly necessary cookie, __Host-cs_session, which keeps you signed in for up to 30 days (or until you sign out). It holds only a random code and is not used for tracking. Our shop basket is saved in your browser’s local storage so it is still there when you come back; it holds only product codes and quantities, is not sent to us until you go to checkout, and you can clear it by emptying your basket. The checkout page is run by Stripe, which may use its own strictly necessary cookies for security and fraud prevention. Some pages include embedded YouTube videos; YouTube may set its own cookies when you play them, under Google’s privacy policy.
13. Complaints
If you are unhappy with how we have handled your data, please contact us first and we will try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator:
- Website: ico.org.uk (complaints: ico.org.uk/make-a-complaint)
- Helpline: 0303 123 1113
14. Changes to this policy
We may update this policy from time to time, for example when our services or the law change. We will post the updated version on this page with a new “last updated” date. If we make significant changes, we will take reasonable steps to let you know.
15. Contact us
Charged Services Ltd
13 Fleming Road, Chafford Hundred, Grays RM16 6YA
Email: info@charged.services · Phone: 01375 886299
ICO registration reference: ZC278103