WhatsApp Assistant Privacy Notice

What the Assistant Is

The Delta WhatsApp Assistant ("the Assistant") is an AI-powered messaging assistant that lets authorised Delta staff query and update the Delta Security Systems CRM by sending messages on WhatsApp. Typical uses include checking the status of a job, looking up the work history at a site, adding a note to a job, or updating a job's status.

The Assistant is operated by Delta Security Systems NI Ltd (Company Registration Number: NI622073) using the WhatsApp Business Platform provided by Meta Platforms, Inc.

Data Controller and Processors

Delta Security Systems NI Ltd is the data controller for all personal data processed through the Assistant. Our registered address is:

Delta Security Systems NI Ltd
Unit C22, 67 Church Road
Newtownabbey, BT36 7LS
Northern Ireland

We use the following processors and sub-processors to deliver the Assistant:

• Meta Platforms, Inc. / WhatsApp: message transport and delivery via the WhatsApp Business Platform.
• Our software provider:the developer and operator of the Delta CRM and the Assistant, acting on Delta's documented instructions under a written data processing agreement.
• An AI language model provider: interprets your messages and drafts replies. Data sent to this provider through its API is not used to train its models.
• Cloud hosting, file storage, and database providers: run the CRM application and store its records.

A full, named list of our current sub-processors is available on request — please use the contact details at the end of this notice.

Information the Assistant Processes

• Your WhatsApp identifiers: the mobile number you message from, your WhatsApp display name, and your WhatsApp profile information as made available to us by Meta. We use your number to confirm you are an authorised Delta user.
• Message content: the text, images, documents, and voice notes you send to the Assistant, and the replies it sends you.
• Message metadata: timestamps, message and conversation identifiers, and delivery or read status.
• CRM data returned or changed: job records, site and client details, engineer assignments, notes, photographs, and scheduling information retrieved or updated in response to your request.
• Audit records: a log of every action the Assistant takes on your behalf, including who requested it, what changed, and when.

CRM records may contain personal data about third parties — for example a site contact's name and telephone number, a tenant's address, or an engineer's notes about a visit. Where the Assistant returns such data it does so only to staff who are already authorised to see it in the CRM itself.

Why We Process It

• To authenticate you and confirm you are permitted to use the Assistant.
• To understand your request and return the correct information from the CRM.
• To carry out the updates you ask for, such as adding a note or changing a job status.
• To maintain an audit trail of changes made to business records.
• To monitor for misuse, diagnose faults, and improve the reliability of the Assistant.

Our legal basis is legitimate interests — operating and administering our business efficiently and keeping accurate records of work carried out — and, where the Assistant is used in connection with a customer instruction, performance of a contract. Where we are required to keep records for tax, health and safety, or insurance purposes, our basis is legal obligation.

Automated Decision-Making

The Assistant uses a large language model to interpret your messages. It does not make decisions that produce legal effects or similarly significant effects on any individual. Actions that change business records are limited to a defined set of operations, are restricted to authorised users, and are logged. AI-generated content can be inaccurate; staff are responsible for checking anything the Assistant reports before relying on it.

Group Chats

Where the Assistant is used in a WhatsApp group, every participant in that group can see the messages sent to and from the Assistant, including any CRM information it returns. Do not request information in a group that should not be visible to everyone in it. Staff must not share customer, tenant, or employee personal data in group chats beyond what is necessary to carry out the work.

Message Storage and Retention

• Conversation history: retained for 12 months, then deleted.
• Audit logs of CRM changes: retained for 7 years, in line with our business records retention period.
• CRM records themselves: retained under the periods set out in our main Privacy Policy.
• Diagnostic and error logs: retained for 90 days.

Messages are transmitted through Meta's WhatsApp infrastructure and are subject to Meta's own retention practices, described in the WhatsApp Business Terms. Once a message reaches our systems it is no longer covered by WhatsApp end-to-end encryption.

International Transfers

Some of our processors are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations where these apply, together with appropriate additional safeguards.

Security and Access Control

• Only mobile numbers on an approved allow-list can use the Assistant. Unrecognised numbers receive no CRM data.
• The Assistant applies the same role-based permissions as the CRM. Financial and revenue data remains restricted to the company Director.
• Data is encrypted in transit, and at rest in our database and file storage.
• Every change made through the Assistant is attributed to the requesting user and logged.
• Access is revoked immediately when a member of staff leaves or changes role.

Your Rights

You have the rights set out in the "Your Rights" section of our main Privacy Policy — including access, rectification, erasure, restriction, portability, and objection. These apply to the data processed by the Assistant.

You can stop using the Assistant at any time by not messaging it, and you can ask us to remove your number from the approved list and delete your conversation history by contacting us. Note that audit records of changes made to business records cannot be deleted on request, as we are required to retain them.

Complaints

If you have concerns about how we handle personal data, please contact us first. If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
www.ico.org.uk

Changes to This Notice

We may update this notice from time to time. Any changes will be posted on this page with an updated revision date.