Overcharged Privacy & Data

1. Who is responsible?

Overcharged is Shane Murphy's self-employed business. Shane is responsible for the personal information used to handle enquiries and provide Overcharged services.

Email: [email protected]
Business and correspondence address: Dromsally, Cappamore, Co. Limerick, Ireland.

This notice covers the website, enquiries, household bill checks, employer staff clinics, business energy checks and ongoing Bill Watchdog help. We explain any extra information needed before collecting it or arranging a switch.

2. Start with a short note

The contact form asks for your name, email and message. The area-interest form also asks for your area or town and the help you want. Do not send bills, supplier account numbers or payment details through either form.

We use the details to answer your request, arrange the help you asked for and follow up about it. We do not automatically add you to a marketing list. Registering your area does not book a visit or start a subscription.

3. Bills, clinics and account details

At a clinic you can show Shane your bill there and then. You can also send it directly by a route convenient for you, such as email or WhatsApp. Showing a bill does not require you to leave a copy. If a copy is needed, Shane explains why.

A check may need your name, contact details, account-holder name, service address, supplier, tariff, usage, charges, discounts and contract or renewal dates. An account or meter identifier is requested only when needed before a switch. You can send that directly to Shane or tell him in person; it is not collected through the website enquiry forms.

Send only what is needed. Cover unrelated details where possible. Do not send banking passwords, card security codes or supplier login passwords. If a bill contains information about someone else, make sure you are entitled to share it.

If you send a photo or file, a copy can remain in the messaging or email service and on the devices used to receive it. Those services have their own security, backup and international-processing arrangements. We do not promise that every convenient route keeps all processing in Ireland or Europe. You can ask Shane about a different route or show the bill in person.

For ongoing Watchdog help we keep the limited service information needed to review available rates, contact you about renewals and discuss a new deal. We do not switch your account without the required authority.

4. Staff and employers

Taking part is your choice. Your employer paying for the service does not authorise a switch on your account.

Overcharged gives the employer the participating employee information needed to administer and invoice the benefit, including the attendee list used for payroll. Before taking part, you can ask what participation information will be provided. Household bills and supplier account numbers are used for your bill check or switch, not as payroll information.

The employer handles its own employment, payroll and benefit records under its own privacy notice. Where it supplies your name or contact detail to arrange the clinic, we explain that source to you. We prefer you to provide household information directly.

5. Business checks and switching partners

We use the business contact and energy information needed for the requested check. A business bill can contain personal information, especially for a sole trader.

The business check is free. If a business switches with Overcharged, our partner SaveAdvice pays us a referral fee. Before sending identifiable bill or account information to a switching partner or supplier, we explain who receives it, what is needed and why. A referral fee does not allow us to share unrelated information.

A supplier or switching partner may use information under its own responsibilities, as well as to complete the requested next step. We explain the relevant recipient and notice before the handover. The contract and data needed for a supplier switch are separate from the website enquiry.

6. Why we use personal information

When you ask us to take steps towards your own service agreement, we use the information necessary for those requested steps. When you are our customer, we use information necessary to provide that agreement. This is the contract basis under GDPR Article 6(1)(b).

For a business contact, a general enquiry, or an employee receiving an employer-funded benefit without their own Overcharged contract, we use limited necessary information to answer the request, arrange the service and administer the benefit. Our basis is legitimate interests under Article 6(1)(f), balanced against your rights. You can object to this use.

Information needed for tax, accounting and other legal duties is used under Article 6(1)(c). Where we ask for consent, for example for optional marketing, you can refuse or withdraw it. This is Article 6(1)(a). Device-storage consent has separate rules, explained below.

You do not have to provide a bill, but we cannot carry out a meaningful check without the relevant information. Refusing to share it does not affect your employment. Shane reviews the options with you; we do not make solely automated decisions with legal or similarly significant effects.

7. Services behind the website and email

Tally hosts our contact and area-interest forms and stores form submissions in Europe. Tally sends email alerts containing the form answers to Shane's Gmail, provided by Google. Tally lists SendGrid as a provider for enabled form-email notifications.

Email to [email protected] is handled by Google Workspace. Cloudflare hosts the website. Google reCAPTCHA on the forms helps prevent spam and abuse. The website does not currently use Cloudflare Web Analytics.

If you choose to send a bill through WhatsApp or another messaging service, that service processes the communication under its own terms and notice. Its involvement is additional to the website providers above.

Providers receive the information needed for their role. We may also share information where required by law or necessary to handle a legal claim. We do not sell your personal information.

8. International processing and safeguards

European storage does not mean all processing stays in Europe. Email copies, support access, messaging services and technical security services can involve processing outside the European Economic Area.

Google's published framework says Google LLC and its covered US subsidiaries use the EU-US Data Privacy Framework for covered EEA-to-US transfers. Google uses European Commission standard contractual clauses where required and where an adequacy decision does not cover the transfer. Gmail alerts are not a promise of EU-only storage.

Tally is based in Belgium and states that submitted form data is stored in Europe. Section 14 of its Data Processing Agreement requires a lawful mechanism for necessary transfers to countries without an adequacy decision, including the European Commission's 2021 standard contractual clauses. This does not mean that Tally is itself a US-certified company or that all its providers are covered by Google's certification.

Cloudflare's published Data Processing Addendum provides for covered Data Privacy Framework transfers and standard contractual clauses for restricted transfers.

These mechanisms depend on the recipient, activity and applicable agreement. They are not a guarantee that no foreign access occurs. Ask [email protected] for information about the safeguards applicable to your data and how to obtain a copy, subject to lawful redactions.

Provider information:
https://policies.google.com/privacy/frameworks?hl=en
https://tally.so/help/data-processing-agreement
https://www.zoho.com/privacy/privacy-faq.html
https://www.cloudflare.com/cloudflare-customer-dpa/

9. Payments

The current website forms do not take payments or start subscriptions. Employers may pay a clinic invoice separately. We use the invoice, payer, amount, payment-status and related correspondence information needed to administer that payment and meet accounting duties.

Do not send card details through the contact forms. Before online Watchdog payments become available, we will update this notice to name the payment provider, explain which payment information Overcharged receives, and describe the provider's processing and safeguards. Asking about the service does not start a paid subscription.

10. Keeping and deleting information

For people who enquire or register their area but do not become customers, our policy is to keep enquiry information for 12 months and then delete it.

For customers, we keep the limited information needed to provide the service and contact them about renewals while that relationship continues. We do not need to keep every full bill for that purpose. Our policy for copies of bills is 90 days. A bill only viewed in person need not be copied or stored.

Tax, invoice and payment records are kept for the legally required period, generally six years where Irish tax rules require it. Information needed for an active dispute may be kept for the time justified by that dispute or a legal requirement. Other details are deleted or anonymised when no longer needed.

You can ask for earlier deletion or ask us to stop renewal contact. We explain any information we must retain and why. Deleting a bill includes the copies we control in email, messages and downloaded files, not just the form submission. Provider backups may take longer to remove deleted information; Tally states that deleted form data is removed from backups within 90 days unless its Trash is emptied earlier. Other providers' backup rules can differ.

11. Browser storage and reCAPTCHA

The embedded Tally form does not load until you click "Load the form". Until then nothing from Tally or Google reCAPTCHA is loaded. When you do click, Tally and Google reCAPTCHA may store information in your browser, for example form-session and form-data entries and a respondent identifier in local storage. reCAPTCHA processes browser information to check for spam or abuse. Third-party security services may use cookies too. If you do not want to use the embedded form, email [email protected] instead.

Irish ePrivacy rules apply to local storage and similar technologies as well as cookies. Consent is normally needed to store or access information on your device. An exception applies only where the operation is strictly necessary for a service you explicitly request, or solely for transmitting a communication. Calling something “security” does not automatically make all its activity exempt. A GDPR legitimate interest does not replace device-storage consent.

Our check on 4 October 2026 found no first-party cookies or local-storage entries on the Overcharged contact page itself. This section describes how the form loads now and we will update it if the setup changes.

12. Your rights

You can ask for access, correction, erasure, restricted use or a portable copy where the law provides for it. You can object to legitimate-interest processing. Where we rely on consent, you can withdraw it at any time; that does not change the lawfulness of earlier use.

Email [email protected] or write to the address above. No special form is required. We may ask for information reasonably needed to check your identity, but not more than necessary.

We respond without undue delay and normally within one month of receiving your request. For complex or multiple requests, the law may allow up to two additional months. We will tell you within the first month if an extension is needed and explain why. We also explain any lawful limit or refusal and your complaint rights. Requests are normally free, subject to the narrow legal exceptions.

You can complain to Ireland's Data Protection Commission without first complaining to Overcharged: https://www.dataprotection.ie .

13. Updates

We update this notice when the service or tools change and give relevant information before a new use of your data. This is a review draft, not a claim that it has replaced the notice on overcharged.ie.

Short staff notice to give before a bill check

Overcharged is Shane Murphy's business at Dromsally, Cappamore, Co. Limerick. Taking part in this bill check is your choice. You can show Shane the bill here or send it directly by a route that suits you, such as email or WhatsApp. Send only what is needed; a copy is not required just because we look at a bill together.

We use the contact, tariff, usage and contract information needed to explain the options. If an account or meter identifier is needed before a switch, give it directly to Shane or tell him in person, not through a website form. Nothing switches without the required authority.

Your employer receives the participation information needed to administer and pay for the benefit, including the attendee list for payroll, not your household bill or account number for payroll. We explain any switching-partner or supplier handover before it happens.

Full bill copies are kept for 90 days; limited service and renewal details are kept while needed for your service. Email and messaging providers may keep additional copies under their own arrangements. You can ask about the route, deletion or your rights at [email protected]. Read the full Overcharged Privacy & Data notice for details of providers, transfers and rights. If this revised notice has not yet been put on the website, Shane can give you a copy directly.