This notice outlines your rights and our responsibilities regarding your personal information. It covers how and why we collect, use and share your information, the legal bases for doing so and how you can exercise your rights as a data subject.
Who we are
Yorkshire Water provides households in Yorkshire with water and waste water services. It is part of the Kelda Group. For the purposes of Privacy Law, the data controller is Yorkshire Water Services Ltd] (company number 2366682) registered at Western House, Halifax Road, Bradford BD6 2SZ.
Privacy Law means the Data Protection Act 1998 (as amended), the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation (from 25 May 2018) and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority;
Changes to Our Privacy Notice
We review this notice regularly as part of our internal processes or as our services, activities, or regulatory requirements change. It’s subject to change at any time, but the most up to date version is published here on this page of our website.
This notice is dated 27 January 2020.
By email to Dataprotectionofficer@yorkshirewater.co.uk
By post to Data Protection Officer, Kelda Group, Western House, Halifax Road, Bradford BD6 2SZ
We take any concerns we receive very seriously. If you think our collection or use of your personal information is unfair, misleading or inappropriate, please bring it to our attention. We’ll investigate and respond to your concerns including any additional information or explanations needed. We also welcome suggestions for improving our procedures. If you are unhappy with our response you can request our Data Protection Officer to review the case.
The Information Commissioner’s Office (ICO) regulates adherence to Privacy Law. For information, advice or to make a complaint you can:
- go to the ICO website
- write to The Information Commissioner's Office, Wycliffe House Water Lane, Wilmslow, Cheshire SK9 5AF; or
- call them on 0303 123 1113
1. The right to be informed
You have the right to be informed about how and why we process your personal information
Any time you give us personal information you have the right to be informed about why we need it and how we’ll use it.
You can find most of the information you need in this Privacy Notice.
If you have any questions please contact us.
2. The right of access
You have the right to access your personal information.
You can request a copy of information we hold about you at any time.
We’ll try to deal with your request informally, for example by providing you with the specific information you need over the telephone providing we have the satisfactory evidence of your identity and the information you are requesting.
You can however formally request access to the personal information we hold about you by getting in touch through any of our customer service channels, but we’ll ask you to provide evidence of your identity before we process your request. We may also contact you to clarify your request or to ensure we have all the information we need to fully meet your request.
Privacy Law requires us to respond to your request within one month of verifying your identity (or within three months for more complex cases). You’ll receive a full response as soon as we can reasonably provide one and we aim to resolve all subject access requests within one month from confirming your identity. In more complex cases where we cannot provide a full substantive response within that time frame, we’ll write to you within one month to explain why an extension is needed.
We don’t charge for subject access requests.
3. The right to rectification
You have the right to ask us to correct inaccurate personal information we hold about you.
If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time, through any of our customer service channels. Wherever possible, we’ll correct inaccurate or incomplete information immediately.
In more complex cases we’ll take reasonable steps to confirm the accuracy of the information we hold. Whilst we investigate the accuracy of the information, we’ll restrict the processing of the information in question.
We’ll let you know the outcome of our investigation as soon as we can. Any information we can verify as inaccurate will be corrected within one month of receiving your request.
4. The right to erasure
You have the right to ask us to delete your personal information.
In some circumstances you have the right to ask us to delete information we hold about you. For example, if we have asked for your consent to process the information, and you withdraw that consent.
We’ll respond to your request as soon as we can and we’ll act on any requests granted within one month of your request.
We can’t delete any information where we have a legal or regulatory obligation to keep it. This applies to all outstanding debts or anything in connection with our Water Supply Licence (e.g. water quality concerns related to the water supply for your property. We may also refuse your request if we believe it to be excessive. If your request for deletion is refused, we’ll explain the reasons for refusal.
5. The right to restrict processing
You have the right to ask us to restrict the use of your personal information.
In some instances, you have the right to ask us to restrict the use of your personal information (for example if you’ve challenged the accuracy of the information we hold, or have objected to our processing). We’ll restrict our use of your information whilst we investigate your objection or request to correct your information.
We’ll respond to your request as soon as we can and we’ll act on any requests within one month of your request.
If your objection is unsuccessful, we’ll only continue processing once we’ve let you know the outcome of the investigation.
When processing is restricted, we are still permitted to store your personal data, but not use it. Information related to these requests will not be automatically deleted unless you expressly ask us to.
6. The right to data portability
You have the right to data portability.
You have the right to move, transfer or copy data to another system for your own purposes. However, this right only applies where processing is automated and consent based.
7. The right to object
You have the right to ask us not to process your personal information.
We process most of the information we collect about you under the lawful basis of ‘public task’ or ‘legitimate interest’. You have the right to object to our processing your personal information under these lawful bases (including for marketing purposes and profiling).
We will respond to your objection as soon as we can, detailing any actions we can reasonably make. If we believe there is an overriding compelling reason to continue the processing, we will explain why we think this is.
We’ll action any requests to stop direct marketing as soon as we receive your objection.
You can object to us using your data at any time through any of our contact channels.
8. Rights in relation to automated decision making and profiling
You have the right to request not to be subject to a decision based solely on automated processing, including profiling, which has an adverse effect on you.
We will consider any requests regarding automated decision making, including profiling, as soon as we receive your request.
Lawful basis for processing
Privacy Law states we must have a lawful basis for processing your information. We have identified the legal bases on which we process your information, and this varies depending on how and why we have your information. The legal bases we use are:
- Public Task: if the processing is necessary for the performance of our public tasks as a water company (e.g. arranging and maintaining your water supply and waste water services, billing and account management, collecting debt, maintaining our infrastructure);
- Consent: if you’ve given consent for us to process your personal information (e.g. in relation to certain support schemes or in relation to certain marketing activities);
- Legitimate interest: if the activities are for our business purposes and do not impede your rights as data subjects (e.g. carrying out market research or customer satisfaction surveys to improve our service to you, complaints that have been made to CCWater, communications around your water usage, certain marketing activity such as WaterAid or other promotional material in your billing envelopes, data sharing with credit reference agencies, fraud prevention and detection, ensuring network information and public security etc.)
- Contracts: where our processing is necessary for the performance of a contract where you are a party to the contract.
- Legal obligations: if the processing is necessary for compliance with one of our legal obligations (e.g. we’re required to provide certain contact information and other details about our services to Ofwat, the Consumer Council for Water and the Water Redress Scheme (WATRS)); and
- Vital interests: we may need to process your personal information to protect your vital interests (e.g. because there is a risk to you and your household due to water quality issues or where the water supply has been disrupted).
If we process any special category information i.e. information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, health data, or data concerning your sex life or sexual orientation, we must have a further lawful basis for the processing. These further legal bases include where:
- you give us your explicit consent to process your special category information (e.g. in relation to a support scheme);
- the processing is necessary to protect your vital interests or someone else's vital interests;
- you make the information public;
- the processing is necessary for a legal claim (e.g. because you’ve failed to pay your bill);
- the processing is necessary for reasons of substantial public interest (e.g. where we suspect fraud on the part of a customer); or
- the processing is necessary for reasons of public interests in the area of public health (e.g. to manage a water quality incident or contamination).
Yorkshire Water supply and wastewater services
Yorkshire Water priority services customers
Customers requesting financial support with their bill
Falling into arrears or failure to pay your water bill
Yorkshire Water e-billing customers
Former household customers - moving out of our supply area
Yorkshire Water as a Landlord
Information we collect or obtain from others about you
We prefer to collect information directly from you so we can ensure it’s as up to date and as accurate as possible. However, we also collect information about you from other sources outside of the Kelda Group. These include:
- credit data and publicly available information about you from Credit Reference Agencies;
- information collected by our business partners or sub-contractors relating to services they are delivering to you on our behalf, or to respond to a concern you have;
- information about you from members of the public (e.g. if someone reports a leak) or other third parties with an association with your property (e.g. landlords, tenants, letting agencies, shared occupiers, previous or future occupiers, family);
- information about you or your property from public bodies (e.g. the Environment Agency);
- opinion data about your preferences, the level of service we provide or on key industry topics, provided to us by market research agencies. All agencies commissioned to undertake this work are done so following the Market Research Society code of practice;
- demographic data from third party sources with access to publicly available information (e.g. parliamentary constituency information).
If you apply for one of our support schemes we may collect additional information from third parties to verify your application. We’ll explain if and how we’ll do this in the application form or when you contact us.
For non-household customers we may receive information from your retailer or MOSL (Market Operator of England’s non-household water retail market) in order for us to deliver water and sewerage services to you.
We also work closely with affiliated partners (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, local authorities, Department for Works and Pensions, debt relief charities and agencies, Citizens’ Advice Bureaus, Credit Reference Agencies and debt collection agencies) and may receive information about you from them.
In future, we may also receive information about you from public authorities and other utility companies to improve public service delivery and ensure that priority customers can access available support and discount schemes.
Profiling and automated decision making
We use your personal information on its own, in an aggregated anonymous form, or mixed with publicly available demographic information to profile you. We do this to:
- ensure we deliver the best possible service to you
- use the right method and right message to communicate with you
- understand how you use water to help our business planning and to keep you informed about your water usage
- identify service disruption that may affect you
If your account is in arrears, we will use the information we collect from CRAs to profile you. This includes the use of statistical analysis, credit scorecards, payment trends, behaviour analysis, and demographic information. We do this so we can manage your account and find the best possible solution that fits your needs or situation.
Contacting us by telephone
Contacting us by post
Contacting us by Webchat
Contacting us via social media
Making a complaint
Information about cookies we use
Information about using our online billing platform
Visiting our offices
CCTV on commercial vehicles
Our use of Unmanned Aerial Vehicles (‘UAV’s or Drones)
The obligations that we have to our Regulators
Agreements we have with other organisations for sharing information
Affiliated Partners we use who may have access to your Data
We use affiliated partners to help us process your personal information and provide services to you including to:
- manage mains replacement and pipe repairs or fit new meters. They, their employees and subcontractors have access to some customer information relevant to their work;
- provide software services, like our meter reading system, social media management, case management and workflow systems etc. to support us with processing the large amounts of data that we need to manage. Occasionally these providers store or back-up information on servers outside the European Economic Area (EEA)
- process information and provide statistical analysis, management information and IT support. This requires them to process your personal information, and this may happen outside the EEA
- help us process card payments, payment card transactions and to process refunds;
- print bills and customer communications; and
- provide additional support to our customer services teams in busy times. They have access to relevant customer information in our billing system and may use your data to contact you on our behalf.
Where we store your information and how we keep it safe
All customer personal information stored on our corporate systems is kept securely. We operate a suite of Information Security Policies to minimise the risk of security breaches, including appropriate access and auditing controls.
We use industry standard protection methods to minimise the risk of cyber-attack. Unfortunately, the transmission of information via the internet may not always be secure. Although we’ll do our best to protect your personal information, we cannot guarantee the security of information you send to us that is outside of our security arrangements; any transmission is at your own risk.
We also operate strict physical security at all our sites and employees all receive security and data protection awareness training.
We may store your personal information on your local device, such as your computer or mobile phone to assist you in your repeated use of our services. We have no control over inappropriate access to this information. You can delete this information at any time using the facilities of your Internet browser or by removing our application from your mobile device.
Where we transfer information to third parties to enable them to process it on our behalf (see the information about affiliated partners above), we seek confirmation of their compliance with security industry standards, legal and regulatory requirements.
Storing or transferring your information outside the European Economic Area ("EEA")
We may transfer or store your personal information outside the EEA. It may be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the provision of support services and management information reporting. Where information is transferred to a country or international organisation outside of the UK / EEA, we’ll comply with the relevant legal rules governing such transfers.
How long we keep your information for
We only keep your information for as long as we need it. We’ll retain certain information (e.g. contact information and bank details) for as long as you have a relationship with us. Our data retention policy outlines these time frames but the length of time depends on the purpose of the processing.
Generally, we’ll keep your account information for up to seven years from account closure (e.g. if you move out of the Yorkshire Water supply area), after which time your personal information will be either deleted or anonymised from closed and finalised accounts.
Retention periods may be extended in certain limited cases as prescribed or permitted by law – e.g. because of an accident or to bring or defend a legal claim.
Yorkshire Water online bill/statement guide
In order to access the Yorkshire Water online bill/statement guide you will need to provide us with your customer reference number and your postcode.
Yorkshire Water cannot guarantee uninterrupted and/or reliable access to the online bill/statement guide and makes no guarantees whatsoever as to its operation, availability, functionality, that it will be free of error or disruption or otherwise.
Yorkshire Water reserves the right to refuse the use of the online bill/statement guide to anyone for any reason whatsoever in its absolute discretion. Further, we reserve the right to modify or discontinue (permanently or temporarily) offering the bill/statement guide to you or all recipients at our discretion and at any time.