Last updated: 29 October 2026

1. Who we are

This policy explains how Copper Industries Ltd, trading as Charlie Xray (“we”, “us”), collects and uses personal information. We are the controller of the personal information described here.

Copper Industries Ltd is registered in England and Wales, company number 05944458. Registered office: C/O Mjb Avanti, Office 12 Epsilon House, West Road, Ipswich, Suffolk, England, IP3 9FJ..

Questions about this policy or your information: [email protected].

2. What we collect

When	What we collect
You contact us or book a call	Name, email, company, job title, phone if given, and what you tell us.
You buy the Rebrand Rollout Toolkit or another product	Name, email, business name, billing address and any VAT number. Card details are taken and held by Stripe; we never see them.
You order a Brand Signal Scan, audit or other service	Your contact details, the information on the intake form, and links to your public brand materials.
You sign up for emails or the BrandOps Starter Kit	Name, email, and whether you open or click our emails.
You use our website	Pages visited, device and browser type, approximate location and how you arrived, through cookies and analytics. See section 8.
We research potential clients	Business contact details that are publicly available, for example from company websites and LinkedIn.

We don’t knowingly collect special category information, such as health or political opinions, and we ask you not to send it to us.

3. How we use it, and our lawful basis

Purpose	Lawful basis
Delivering products and services you buy, including emailing download links	Contract
Answering enquiries and arranging calls	Legitimate interests (responding to people who contact us) or steps before a contract
Keeping invoices, VAT and accounting records	Legal obligation
Sending follow-up emails after a purchase about using the toolkit or related services	Legitimate interests; you can opt out at any time
Sending our newsletter and marketing emails	Consent, or for business contacts, legitimate interests; every email has an unsubscribe link
Contacting businesses that may need our services	Legitimate interests (business-to-business marketing); you can ask us to stop at any time
Measuring and improving our website	Consent, through the cookie banner
Preventing fraud and protecting our business	Legitimate interests

4. Client engagements

Some services involve information about our clients’ staff, for example surveys, interviews or workshop notes in a Drift Audit or BrandOps Blueprint. In those cases our client decides why and how that information is used, and we process it on their behalf under our engagement terms. We keep it confidential, use it only for that engagement, and delete or return it when the work ends unless we’ve agreed otherwise.

5. Who we share it with

We don’t sell personal information. We share it only with providers who help us run the business, under contracts that require them to protect it:

• Stripe, for payments, invoices and tax calculation.
• Mailerlite, for newsletters and the Starter Kit.
• Microsoft 365, for scheduling calls.
• Zapier or Make, to send purchase emails automatically.
• Microsoft 365, for email and file storage.
• Google, for website analytics and our website tools.
• Our website host, for running charliexray.com.
• Associate consultants who deliver work with us, only where needed for your engagement and under confidentiality terms.
• Our accountants and professional advisers, and authorities where the law requires.

6. International transfers

Some of these providers store or access information outside the UK, mainly in the US and the EU. Where they do, we rely on UK adequacy regulations, including the UK–US data bridge, or the UK’s approved contract terms, so your information keeps an equivalent level of protection.

7. How long we keep it

• Purchase, invoice and accounting records: six years after the end of the financial year, as UK tax law requires.
• Client engagement records: six years after the engagement ends, for contract and liability purposes.
• Enquiries that don’t lead to work: up to two years.
• Marketing contacts: until you unsubscribe or ask us to stop, after which we keep only enough to make sure we don’t contact you again.
• Website analytics: up to 14 months.

8. Cookies and analytics

We use essential cookies to make the site work and, with your consent, analytics cookies through Google to understand how the site is used. You can accept or decline non-essential cookies in the banner, and change your choice at any time through “Manage consent” in the footer or your browser settings.

9. Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal information
• correct anything that’s wrong
• delete it, where we have no reason to keep it
• restrict or object to how we use it, including objecting to marketing at any time
• transfer information you gave us to another organisation, where that applies
• withdraw consent you’ve given, without affecting what we did before

We’ll respond within one month. There’s normally no charge.

10. Contact and complaints

To use your rights or ask a question, email [email protected] or write to us at our registered office.

11. Changes

We’ll update this policy when how we handle information changes. The date at the top shows when it last changed.