Privacy Policy

1. Who we are

The data controller for personal data described in this policy is ZenGeist Ltd, a company registered in England and Wales (Company Number: 17288296).

Registered address: Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, UK.

Privacy contact email: info@zengeistltd.com. For privacy enquiries, data subject requests, or data deletion requests, please use this address and include “Privacy Request” in the subject line.

2. Scope of this policy

This policy applies to personal data we process when you:

• Visit or use the ZenGeist Ltd website (zengeistltd.com) and related online properties
• Enquire about or engage our software development, web & digital, IT consultancy, hosting, or related services
• Use or evaluate our digital products (including Chariflex and future products)
• Use, administer, or are messaged through Meta Apps or WhatsApp Business API solutions that we provide, host, or operate as a technology provider for business clients

Where we process personal data solely on behalf of a client under a written agreement (for example as a processor for a client’s WhatsApp Business Account), that client’s privacy notice and our data processing terms also apply. This policy describes ZenGeist’s own practices and the categories of processing we perform.

3. Personal data we collect

The data we collect depends on how you interact with us.

Website visitors

• Technical data such as IP address, browser type, device information, and pages visited (typically via server logs)
• Information you submit voluntarily by email or other enquiry channels (name, organisation, email address, and message content)

Clients and business contacts

• Identity and contact details (name, job title, organisation, email, phone)
• Contract, billing, and project communications
• Account credentials where we provide hosted systems or portals

Meta Apps and WhatsApp Business API solutions

• Business account and onboarding data needed to connect WhatsApp Business Accounts (WABAs), phone numbers, and Meta Business assets
• Message content, templates, delivery status, and related metadata processed to send and receive WhatsApp messages on behalf of our clients
• Webhook payloads and API logs required to operate, secure, and support the messaging service
• End-user phone numbers and message content that pass through the WhatsApp Business Platform when our clients (or we on their behalf) communicate with customers

We do not knowingly collect special category data through the corporate website. Messaging solutions may transmit content chosen by end users or clients; clients are responsible for ensuring a lawful basis and appropriate notices for their messaging programmes.

4. Lawful bases for processing

We rely on one or more of the following UK GDPR Article 6 bases, depending on the activity:

• Contract — to enter into or perform a contract with you or your organisation
• Legitimate interests — to operate, secure, and improve our website and services; to respond to business enquiries; and to support clients’ messaging platforms, where those interests are not overridden by your rights
• Legal obligation — where we must retain or disclose data to comply with law
• Consent — where we rely on consent (for example certain optional cookies or marketing), which you may withdraw at any time

5. How we use personal data

We use personal data to:

• Provide, maintain, and improve our website and professional services
• Respond to enquiries and manage client relationships
• Deliver hosting, software, consultancy, and product services under contract
• Operate Meta Apps and WhatsApp Business API solutions, including sending and receiving messages, managing templates, webhooks, quality, and support
• Secure our systems, prevent abuse, and investigate incidents
• Comply with legal, regulatory, and Meta Platform obligations

6. Meta Platform Data and WhatsApp Business API

ZenGeist Ltd may act as a Meta technology provider (or similar solution provider) offering WhatsApp Business API and related Meta App integrations to business clients.

In that capacity we may access and process Meta Platform Data — including WhatsApp Business messaging data — solely to provide the contracted solution. We do not sell Platform Data. We do not use Platform Data to build unrelated advertising profiles. We process such data in line with Meta’s Platform Terms, WhatsApp Business terms and policies, and applicable data protection law.

Clients remain responsible for their own messaging content, customer consent, opt-outs, and compliance with WhatsApp Commerce and Business messaging policies. ZenGeist processes end-user messaging data as needed to operate the technical service for the client, typically as a processor or under joint arrangements set out in the client agreement.

Infrastructure and subprocessors (for example cloud hosting providers) may process data under our instructions and appropriate contracts. Meta Platforms, Inc. and its affiliates process WhatsApp Business Platform data under Meta’s own terms as part of the WhatsApp service.

7. How to request deletion of your data

You may request that we delete personal data we hold about you. To submit a deletion request:

• Email info@zengeistltd.com with the subject line “Data Deletion Request”
• Include your full name, the email address or phone number associated with your interaction with us, and a brief description of the data or service involved (for example website enquiry, client account, or WhatsApp messaging)
• If you are an end user of a client’s WhatsApp channel operated through ZenGeist, also name the business you messaged where known — we may need to coordinate with that client, who may be the primary controller of your messaging data

We will acknowledge your request and respond within one month (or longer where permitted by UK GDPR for complex requests). We may need to verify your identity before deleting data. We may retain information where we have a legal obligation or overriding legitimate need (for example security logs or billing records), and we will explain any such retention in our response.

For Meta Platform Data deletion relating to a specific Meta App, you may also use in-product deletion flows where we provide them, or contact us using the steps above. We will delete or anonymise Platform Data under our control as required by Meta’s Platform Terms and applicable law.

8. Sharing and international transfers

We may share personal data with:

• Service providers who support hosting, email, security, and operations under contract
• Meta and WhatsApp as required to deliver WhatsApp Business API and related Platform features
• Professional advisers, insurers, or authorities where required by law or to protect our rights
• A successor entity in the event of a business reorganisation or sale, subject to appropriate safeguards

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement, adequacy regulations, or equivalent measures) as required by UK GDPR.

9. Retention

We retain personal data only for as long as needed for the purposes described in this policy, including to meet legal, accounting, or reporting requirements. Typical periods include:

• Website enquiry emails — retained for up to 24 months after the last meaningful contact, unless a longer relationship follows
• Client contract and billing records — retained for the life of the contract plus statutory periods (often up to 6 years in the UK)
• WhatsApp / Platform operational logs — retained for the period needed for delivery, support, security, and Meta policy compliance, then deleted or anonymised

10. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. No method of transmission or storage is completely secure; if we become aware of a personal data breach affecting your rights, we will notify you and the ICO where required by law.

11. Cookies

Our corporate website currently uses only essential cookies and similar technologies needed for the site to function (for example remembering that you have acknowledged our cookie notice via local storage in your browser). We do not currently use advertising or third-party analytics cookies on zengeistltd.com.

You can clear or reset the cookie notice preference at any time using the “Cookie Notice” control in the website footer. For more detail on how messaging and Meta Platform data are handled, see the Meta and WhatsApp sections above — that processing is separate from this website cookie notice.

If we introduce non-essential cookies in future, we will update this policy and, where required, seek appropriate consent.

12. Your rights under UK GDPR

Subject to legal limitations, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Data portability (where applicable)
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent
• Lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk

To exercise these rights, email info@zengeistltd.com with “Privacy Request” in the subject line and describe the right you wish to exercise. We will respond in accordance with UK GDPR timescales.

13. Children’s data

Our website and business services are directed at organisations and adults. We do not knowingly collect personal data from children under 16 through the corporate website. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Significant changes will be highlighted on the website or communicated to clients where appropriate.

15. Contact

For privacy questions, data subject requests, or deletion requests:

ZenGeist Ltd — Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, UK

Email: info@zengeistltd.com