Howwehandle
personaldata.

1.Who we are

OpusRay ("OpusRay", "we", "us", "our") provides SMS-based customer database reactivation services to businesses in the United Kingdom. This policy explains how we collect, use, and protect personal data in connection with:

• our website, opusray.co.uk;
• our business relationships with client businesses; and
• the SMS reactivation campaigns we run on behalf of those clients, which involve processing personal data belonging to our clients' customers.

Data controller: OpusRay Ltd, company number 17321480, registered office at Brierley House, Barnet Road, Barnet, United Kingdom, EN5 3LW.

Contact: info@opusray.co.uk

ICO registration number: ZC225968

2.Who this policy covers

This policy applies to three groups of people, and different sections below apply depending on which group you're in:

• Website visitorsAnyone browsing opusray.co.uk, filling in a contact form, or booking a call with us.
• Client contactsIndividuals at the businesses we work with.
• Reactivation contactsIndividuals in a client's customer database who may receive an SMS message as part of a campaign we run on that client's behalf. If you have received a text message from or associated with OpusRay, you are in this group, and section 6 is most relevant to you.

3.Our role as controller and processor

For website visitor data and client contact data, OpusRay is the data controller. For reactivation contact data (the customer databases our clients ask us to work), OpusRay acts as a data processor, and the client business is the data controller. The client is responsible for having a lawful basis to contact their customers under PECR before we are engaged; we process this data only on that client’s documented instructions, and check for a valid basis before any message is sent.

4.Personal data we collect

• From website visitorsContact details you provide via a form or when booking a call, information you share on a call, and technical or usage data collected automatically when you browse the site (see section 9).
• From client businesses (client contact data)Name, role, email, and phone number, plus billing and contract information.
• From client businesses, on their instruction (reactivation contact data)Contact details from the client's existing customer database (name, mobile number, and possibly email, enquiry or purchase history, and consent records), plus records of SMS conversations including message content, timestamps, and any appointment or outcome.

5.How we use personal data, and our legal basis

6.If you've received a text message from a client campaign

If you've received an SMS as part of a campaign we ran for a business, that business is the controller of your data. We require the client to confirm they hold a valid basis to contact you before any campaign starts.

How a conversation is actually processed. Your contact details and message history are stored in GoHighLevel. When you reply, your message and relevant context are sent to Anthropic’s Claude API, which generates a reply in the style agreed with the client, sent back to you through GoHighLevel. If a conversation needs a person, it is flagged for our team or the client’s staff. No conversation is used to train Anthropic’s models.

If you no longer wish to be contacted: reply STOP to the SMS, or contact us at info@opusray.co.uk with the business name and your phone number.

7.Who we share data with

• Sub-processorsGoHighLevel (database, SMS, calendar), Calendly (booking), Vercel (hosting), Anthropic (AI-generated replies).
• The relevant client businessFor responses, appointments and outcomes.
• Professional advisers and regulatorsWhere required by law.
• A buyerIf we sell or transfer part of the business.

We do not sell personal data.

8.International transfers

GoHighLevel, Calendly, and Vercel are US-based and may process data outside the UK and EEA. Where this happens, transfers are covered by UK International Data Transfer Agreements or equivalent safeguards under each provider’s data processing terms.

9.Cookies and website analytics

This site uses Google Analytics and cookies set by the Calendly booking widget. Google Analytics only loads after you accept the cookie banner shown when you first visit the site; declining means it does not load.

10.Data retention

• Website visitor data12 months after last interaction, or until deletion is requested.
• Client contact dataDuration of the relationship plus six years.
• Reactivation contact dataOnly for the campaign duration and any agreed handover period, then deleted or returned per the client's instruction.

11.Security

Data is encrypted in transit (HTTPS) and at rest by our sub-processors; access is limited to authorised OpusRay staff using unique credentials.

12.Your rights

Under UK GDPR, you have the right to access, correct, delete, restrict or object to processing, receive your data in a portable format, and withdraw consent. Contact info@opusray.co.uk to exercise any of these rights. You also have the right to complain to the ICO at ico.org.uk.

13.Children

Our services are directed at businesses, not children, and we do not knowingly collect personal data from anyone under 18 through our website.

14.Changes to this policy

We may update this policy from time to time. The "last updated" date reflects the most recent revision.

15.Contact us

Questions or requests regarding this policy or your personal data: info@opusray.co.uk