Customer Privacy Notice

The purpose of this Privacy Notice, together with the relevant website terms of use (depending on whether you are accessing the South West Water (SWW), Bournemouth Water or the Bristol Water webpage, sets out how we use and protect your Personal Data. Personal Data is any data that can identify you either on its own or used with other data.

This Privacy Notice will help you understand your privacy rights, how and why we need to process your Personal Data, and how you can get in touch with us if you need to. Processing Personal Data involves any activity to do with that data, for example collection, storage, editing and deletion.

We’ve presented this information in different sections so you can access the information you need more easily. You’ll find our general privacy information under the headings below to cover the different types of individuals whose data we use.  We encourage you to read each section thoroughly.

We take your Personal Data privacy very seriously and we're committed to protecting your Personal Data by complying with the relevant privacy legislation (including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018).

We also endeavour to follow relevant industry Best Practice, Codes of Practice and Guidance, such as ICO’s Data Sharing Code of Practice.  

We regularly review and update this Privacy Notice to reflect changes in our services, as well as to comply with changes in Data Protection Laws and Legislation. We would, therefore, encourage you to review this Notice on a regular basis and if we make any significant changes impacting your privacy, we'll make this clear on our website; please remember to check from time to time.

We use some formal terms in this Notice, such as Data Subject, Personal Data and Data Controller. For an explanation of these terms, please see the definitions section.

Who are we?

We are South West Water Limited (including Bournemouth Water (BW) and Bristol Water (BRL) and may describe ourselves as "We" “Us” or "SWW" in this Notice). We are the statutory water and wastewater undertaker† (supplier, also known as provider) for the South West of England, covering the whole of Devon, Cornwall, The Scilly Isles and parts of Somerset, and Dorset including Bournemouth and the surrounding area and Bristol (Bristol City, North Somerset, areas of Bath, North East Somerset and South Gloucestershire). †SWW provides water only services to BW and BRL customers; sewage services are provided by Wessex Water, Severn Trent, or Southern Water.

For a map showing the areas we cover, please click here for SWW, here for BW and here for BRL. Some households in the wider area that we cover (BW and BRL) might have more than one provider for water and sewage services, for example if your property is on the border of two different statutory providers areas; or if your property is part of a new build housing estate, where the developer chose to “self-supply” water or waste services, these “self-supply” arrangements used to be known as “inset agreements” but are now known as “new appointments and variations” or “NAVs” for short. Please see your water or sewerage bill for details if you are unsure of who provides you with relevant services, or visit www.water.org.uk/advice-for-customers/find-your-supplier/ for more information.

We are a company registered in England and Wales under number 02366665 with our registered office at Peninsula House, Rydon Lane, Exeter, Devon, EX2 7HR. SWW is part of a group of companies owned by Pennon Group Plc. In addition to SWW, some of the other companies in the Pennon Group will look after and process your Personal Data. Some of these companies are separately responsible for your data (referred to as Data Controllers) and some carry out processing on our behalf (referred to as Data Processors).

Pennon Group Companies include the following companies or brand names which are listed below (updated from time to time):

Bournemouth Water: is the brand name for customers in the Bournemouth area as described above; Bournemouth Water is part of South West Water Limited and operates under South West Water’s license to supply water. Sewage services are provided to Bournemouth customers by either Southern Water or Wessex Water.

Bristol Water: is the brand name for customers in the Bristol area; Bristol Water is part of South West Water and also operates under South West Water’s license to supply water. Sewage services are provided to Bristol customers by either Wessex Water or Severn Trent.

Pennon Group Plc: is the parent company for SWW and Pennon Water Services.

South West Water Customer Services Ltd is a SWW subsidiary providing customer services to SWW customers, excluding customers in the Bristol area. Customer services for customers in the Bristol area are provided by a data processor (jointly owned by the Pennon Group and Wessex Water) called Bristol Wessex Billing Services Ltd and trading as Pelican Business Services (also known as “Pelican” or “BWBSL”); Pelican provides Customer Services relating to billing, metering and account management for customers in the Bristol area only.

Pennon Water Services Ltd (also known as “PWS”) and trading under the brand Source for Business (a “sister company” of SWW) is a water and sewage retailer for commercial customers.

Water 2 Business Ltd (also known as “W2B”) is also a water and sewerage retailer for commercial customers.

South West Water Limited (also known as “SWW”) is the water and sewage company for Devon, Cornwall, the Isles of Scilly and parts of Dorset and Somerset and owns Bournemouth and Bristol Water.

The company/companies or brand names listed above which are relevant to you will depend upon who you are and what type of interaction you have with SWW. Your point of contact for all matters relating to privacy and Personal Data in connection with us will be SWW or Pennon Group.

For the purposes of Data Protection laws, SWW is the Data Controller of Personal Data. This means that we make decisions about how and why we process your Personal Data, and, because of this, we’re responsible for making sure your Personal Data is only used in accordance with those Data Protection laws. When we work with third-party companies, like Pelican, they will process your Personal Data on our behalf. These companies are referred to as ‘data processors’. When we use data processors, they’ll use your Personal Data on our behalf but only for the services and limited purpose that we instruct them to use it. When we use data processors, we remain responsible, as a controller, for compliance with all data protection legislation.

More detail about our working with third parties is detailed below.

If you want more information about this Privacy Notice, have any comments or observations about it (or about the way that we handle your Personal Data), or if you would like to exercise any of your Data Subject Rights (see below for more information), or want to contact us about how we process your Personal Data, please see the section below on “Who can I contact about my Personal Data?”

While we would prefer you to contact us first, you can also contact the Information Commissioner’s Office via ico.org.uk or 0303 123 1113 for information, advice or to make a complaint.

Definitions and phrases used in this Notice

As mentioned above, we use various formal expressions or phrases in this Notice. Below is an explanation about what these mean in this context:

Data Controller - The data controller determines the purposes for which and the means by which Personal Data is processed. SWW is considered to be a data controller for most of the Personal Data it holds. There are some circumstances where we might be a” joint controller” with another party (such as with a neighbouring water company who provides you with sewage services (for BW and BRL customers), but SWW will remain liable to you in how we use your Personal Data

Data Subject - A Data Subject is an individual - any person whose personal data is being collected, held or processed. For example, each SWW customer will be a Data Subject

Data Processor - A data processor is responsible for processing Personal Data on behalf of a controller. For example, where we have used a third party as a data processor to provide us with bill processing services, SWW would be the controller and the third party would be our data processor

Personal Data - Personal Data is any information which is related to an identified or identifiable natural person. (Full definition provided in Article 4 of the UK GDPR)

Processing - Any operation or set of operations which is performed on personal data or on sets of personal data (whether or not by automated means, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure or destruction)

Special Category Data – Special Category Data (also referred to as Sensitive Personal Data) is data relating to sensitive information about an individual (that is given a further level of protection) such as their ethnic or racial background, political opinions, health, biometric data (where used for identification purposes). (Full definition provided in Articles 4 and 9 of the UK GDRP).

Who does this Notice apply to?

This Notice relates to the collection and use (Processing) of the Personal Data of individuals, sole traders and individuals who are in business partnerships. It does not apply to commercial information we collect or use in relation to companies or other organisations.

It is intended that this Notice covers:

• Existing, potential and previous customers and those acting on their behalf
• Members of our customers’ households (if we have been provided with information about them, or where we interact on non-billing related matters)
• Competition entrants and winners
• Those applying for any grant schemes or funding arrangement that we manage
• Those who interact with us on social media platforms (whether as our customers or otherwise)
• Individuals who work for suppliers and contractors
• Members of Customer Challenge Groups
• Members of Parliament and Members of the European Parliament
• Members of Regional Action Groups
• Members of Environmental Action Groups
• Journalists
• Developers
• Motorists encountered by our staff
• Visitors to our sites (including in vehicles)
• Visitors to our websites
• Shareholders
• Individuals interacting with our legal department
• Individuals who make general enquires about our services or make requests under the Environmental Information Regulations or make complaints or comments about our services
• Advisors to all of the above or other people providing assistance to them
• Other individuals not listed above who interact with us or our sites.

This Notice does not apply to how we process Personal Data relating to our employees, former employees, pensioners, agency staff or contractors (or their employees).

How do we collect Personal Data?

We collect your Personal Data in a number of direct or indirect ways. These, for example, include:

• Anything you have provided us with in "MyAccount", on our websites (including southwestwater.co.uk, www.bournemouthwater.co.uk and www.bristolwater.co.uk), provided over the telephone, via video calls in a letter, e-mail, WhatsApp, facsimile, Mobile Application (App), our LiveChat service, via social media like Twitter and Facebook, or any other communications channel. We may also access information about you that is already publicly available
• Data you have provided to us in relation to registration on the Priority Service Register or in application for one of our social tariffs
• Data received from water meters or other similar technology
• If we have merged with or acquired a company who has supplied water or wastewater services to you
• Outbound and inbound calls. Calls to and from our call centres and our control centre are usually recorded for training and quality purposes (subject to available recording capacity). However, calls to and from ordinary office ‘phones and mobiles are not recorded
• CCTV cameras on our sites (and where used, body worn cameras) or when we (or our contractors) are working in public spaces on our assets to capture images of people and vehicle identification information such as number plates. This may include recorded conversations between our staff or contractors and members of the public
• Drone video and audio footage. Drones are used for many purposes, for example to survey our infrastructure and to take water samples from waterway in our region. We do not intentionally film members of the public during these operations
• Health and safety equipment taking video and audio footage of a workspace to assess for health and safety risks prior to commencing work. We do not intentionally film members of the public during these operations
• Some SWW vehicles that are fitted with dashcams to capture images and footage in the event of road traffic incidents and may also capture instances of poor driving. When required, dashcam footage will be provided to insurers and may also be provided to the relevant police force if requested or required by law
• All visitors, who may be subject to surveillance for the purposes of safety and crime prevention. Recorded material may be used in the monitoring, prevention and investigation of Health & Safety incidents and crimes and bringing crimes to justice
• The collection of Personal Data given to us if we meet in person for example whilst visiting your home, worksite, business premises; or if you come to one of our sites we will collect visitor signing-in data including personal photograph for health and safety and identification purposes
• When we take photographs, for example, to help identify and record locations of damage, theft, faults, leaks, repairs, locations for future or planned works, and for work undertaken and completed by us or our contractors; photo’s could be taken on private or in public spaces
• Photographs which are also routinely taken by our staff during inspections to identify breaches of legislation, and for which we have legal duty to enforce, for example, The Water Supply (Water Fittings) Regulations 1999
• Photographs or video which are also taken to identify and prosecute occurrences damage to the network and theft of water from our network. Photographic and video evidence is used in enforcement and in prosecution actions; photo’s and videos could be taken on private or in public spaces
• From time to time, customers provide us with photographs or videos they have taken to assist in reporting concerns they might have and have requested that we follow up.

In addition, we collect your Personal Data from third parties, for example, from:

• Individuals that have permission to contact us on your behalf
• New residents of a former supply address*, estate/letting agents or solicitors acting on behalf of you. *New resident of a former supply address, for example, where you are moving home and the third party is providing a forwarding address (with or without your consent)
• Your registration on our Priority Services Register by another individual, for example another family member, friend or other person
• The landlord of your supply address
• Our regulators including OFWAT, the Consumer Council for Water, Water Redress Scheme (WATRS) the Drinking Water Inspectorate, the Environment Agency and the Information Commissioner’s Office
• Partners or subcontractors such as Kier who work on our behalf under a contract
• Public authorities and agencies with whom we work in connection with the provision of water and sewerage services, such as local councils and the lead local flood authorities and the Benefits Agency for our Social Tariffs.
• Law enforcement agencies
• Other water and sewerage companies where required for the supply of water or sewerage services to your supply address
• Credit reference and tracing agencies and the Electoral Roll, for example, where it has not been possible to identify the person responsible for payment of water or services charges
• Local authorities, other utilities or providers of public services in relation to the provision of priority services and or social tariffs (see our section on Processing of Sensitive Personal Data including Priority Services Register and Social Tariffs below)
• Other organisations or individuals not listed above who interact with us and provide us with data.

What Personal Data do we process?

The Personal Data that we process about you will depend on the type of relationship that we have with you (for example if you are a customer, this will be different from Personal Data we hold about journalists).

However, generally for customers and others, we collect and process the following data about you:

• Identification and contact data: this would include your title, name, date of birth and contact details such as your email address and mobile telephone number
• Information about your SWW customer account: this would include your supply address, correspondence address, billing address, billing history (which may include accounts previous addresses), water meter serial number and water consumption and usage data, information required to estimate water usage, data from smart meters and customer password and customer contact/complaints history
• Payment information: this would include transaction records of payments made in connection with your SWW customer account and details of your bank account or credit or debit card in order to process payments or set up direct debits. This would also include details of monies owed and any data shared for the purposes of debt recovery action
• Personal circumstances information: this means information that would affect our supply arrangements and your entitlements, for example for registration on the Priority Services Register or WaterSure or WaterCare social tariff schemes (see below for more details). Such data may include your income data, welfare benefit entitlements, national insurance number, dates of birth of your children or dependants and medical information (Special Category/Sensitive Personal Data) of those persons living at your supply address, if relevant
• Delegated Authority: including powers of attorney or people you have authorised to discuss your account, e.g. partner, adult children, solicitor etc.
• Supply network information: this means information relating to the supply address that is necessary for the supply of water and sewerage services such as location of network infrastructure (whether owned by South West Water or not) present on or near to the supply address and the maintenance and repair history
• Financial performance data: means information received from and provided to credit reference agencies
• Behavioural information: if there has been any vexatious or abusive behaviour made towards South West Water staff, contactors or agents
• Our own enforcement activities: including using powers to fulfil obligations under the Water Industry Act, such as carrying out water quality sampling, exercising powers under the Water Supply (Water Fittings) Regulations 1999, or to carry out our own investigations
• Data received from and provided to law enforcement agencies: this means information to assist in the prevention, detection, apprehension and prosecution of criminal activity from agencies such as the Police, Department for Work and Pensions, HM Revenues and Customs (HMRC), UK Visas and Immigration and the Environment Agency
• Website tracking information: this means details of transactions you carry out through our website and details of your visits to our website
• Information gathered from My Account and social media interaction: including customer comment and contacts
• Survey information and focus groups: this means information you provide as part of customer or stakeholder surveys. On request, we shall provide Ofwat with customer contact data so that Ofwat may contact customers to complete additional surveys or to verify services received
• Preference information: this means any opt in or opt out preferences that you have provided us with confirming whether you wish to receive information about offers and information that may be of interest to you
• Grant or funding applications: made either by a customer for themselves or on behalf of a group (for example a community society or charity)
• Photographic, video and audio recording data: this means any data collected through our interactions with you, through site visits by us, our inspectors or our contractors, from CCTV cameras and or signing-in when you visit our sites, when you contact our telephone call centres and provide us with data, data captured by our vehicle dashcams or body worn equipment or other audio visual recording equipment.

Why do we process your Personal Data (our lawful basis for processing)?

We’re required by law to always have a permitted reason or justification (called a “lawful basis” or “legal basis”) for processing your Personal Data. We only process your Personal Data if we have a lawful basis to do so, if the processing is necessary, reasonable and proportionate, and in accordance with the way in which we describe in this Privacy Notice.

Depending on the processing activity, we may use one or more of the following lawful bases for processing your data:

• Consent: where you’ve given your consent for the processing
• Contract: where processing is necessary for the performance of a contract
• Legal obligation: where processing is needed to comply with our legal obligations
• Vital interests: where processing is needed to protect your vital interests or those of another person
• Public task: where processing is needed for us to perform a task in the public interest of for our official functions
• Legitimate interests: where processing is needed for our legitimate interests or those of a third party unless on balance, these are outweighed by the need to protect your individual rights.

Providing water or sewerage services

As a water and sewerage undertaker, we have legal (statutory) obligations to supply water, maintain water quality, promote water efficiency, to maintain adequate drainage and make charges. These legal obligations are regulated by OFWAT and our other regulators.   These obligations are derived from and include compliance with all relevant legislation such as the Water Industry Act 1991, our Instruments of Appointment also known as our Licence (as issued by the Secretary of State for the Environment), tax laws, and consumer protection laws, as well as the need to provide information to law enforcement agencies or other authorities when we’re required to do so.

Most of the processing we carry out at SWW and in relation to your Personal Data, is necessary for the performance of one of our legal obligations or statutory entitlements as a statutory water and sewerage undertaker (e.g. supplying clean water to you; removing sewerage (also called wastewater)); managing our network; encouraging water efficiency; reducing waste (leakage); raising and collecting our charges; reducing debt; and our duty to protect the health, safety and wellbeing of those who visit our sites.

So that we can provide the services that we are obliged to provide, we need to process Personal Data for the following purposes:

• Managing enquiries, including customer queries and complaints
• Metering and billing
• Receiving payment and debt recovery (to process payments – we use a legitimate interest to preserve the security of any payment made through our online portal using authentication measures that require validation of the email address associated with your payment card account with your card issuer. When you provide your email address, it will only be used for this purpose and will not be retained for other uses.)
• Managing network operations (e.g., customer water quality sampling, water supply and blockage issues, drought management)
• Dealing with new connections to our network
• Maintaining our land holdings and sites
• Fraud prevention and detection of criminal activity
• Public education on matters affecting our regulated services (such as water efficiency and leakage reduction)
• Internal training
• Listening and addressing concerns and customer satisfaction surveys, customer focus groups and service improvement communications
• Research and statistical analysis for matters affecting our regulated services (such as understanding and predicting water demand, reducing water consumption, managing resources and drought prevention)
• Managing legal claims
• Carrying out audits
• Responding to requests for information and media queries/broadcasts
• Enforcement of government legislation, for example, the Water Supply (Water Fittings) Regulation 1999
• To comply with our legal obligations under the Water Industry Act 1991, regulatory obligations and license conditions.

In order to carry out these activities, we need to keep reliable, accurate and up-to-date records of customers' (and others) details as well as any interactions with them related to these regulated services. This also includes billing customers and taking surveys to improve customer satisfaction.

Our regulated services include billing our customers under the legal basis of legal obligation; we do not require a contract or customer consent to process the information required to do this.

Providing Additional Services

Where we’re delivering a contractual service to you outside our legal (and statutory) obligations or taking steps at your request, prior to entering into a contract with you, we process your Personal Data on the legal basis of a contract, for example, for our Con29 Search facility to carry out property searches, or additional products or services like the provision of water saving devices.

We use certain types of Personal Data collected to help us understand how we can focus on sending you information which is relevant to you or to your circumstances.   This is usually because we have a legitimate interest in processing information required to help us become more effective and efficient, or because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. For example, whether you could benefit from having a water meter or a more manageable payment scheme, or to promote water efficiencies.

We do not make choices based solely on automated decision-making or profiling.

Processing of Sensitive Personal Data, including Priority Services Register

We sometimes need to process Sensitive (Special Category) Personal Data, such as medical details, when we’re carrying out public tasks that have a substantial public interest. This processing is based on our Legitimate interest and Substantial public interest.

We also process limited Sensitive (Special Category) Personal Data for other tasks with the explicit consent of the customer or stakeholder, for example, in relation to billing social tariff applications.

Along with others in the water and sewerage industry we follow industry guidance and operate a Priority Service Register (PSR) which holds details of individuals who may, from time to time, require priority assistance. This assistance could be in relation to an interruption to supply of water in an area, or because an individual has a specific need.

If this applies to you (see next paragraph), rather than seeking individual explicit consent, we will rely on “Legitimate Interest” and “Substantial Public Interest” to justify using your Personal Data in this way. Please note that relying on Legitimate and Substantial Public Interests, rather than your explicit consent, does not impact your rights or your ability to control how your PSR data is used.

The PSR is intended to help provide additional services, to protect you from harm or safeguard your interests (where we think that we need to, where you tell us that you need assistance or where a third party, e.g. a family member or landlord advises us). We have a moral and social duty to help safeguard the customers we serve, which means we may share limited data with other trusted organisations (please see the information about these organisations below). This PSR enables us to have a record of what your priority needs are, so we can provide you with the support that you need.

The PSR contains limited details of individuals who have particular requirements (e.g. due to age, health, a medical condition or extra communication requirements) where those requirements mean that we might need to contact the individuals in a particular way or as a matter of priority in the event of an interruption to supply or another operational emergency. Keeping information on the PSR means that we can respond quickly and adapt our services. For example, we might need to send a team to the address if someone can’t communicate by phone, or we might need to deliver bottled water if someone has a particular medical condition.

Because your PSR data may contain health data, we restrict who has access to this information and only record the information that is necessary to provide you with our priority services.

Including your Personal Data on our PSR also means that we share and receive your Personal Data with other trusted organisations. We do this to help with safeguarding and to save you the trouble of keep telling other organisations about the assistance you need. The organisations we currently share this information with, are neighbouring water companies (who provide your sewerage services) and energy infrastructure providers. These organisations have similar obligations and share the moral and social duty to help keep you safe and safeguard your interests or needs to help you during an emergency situation; vice versa, they share their PSR data with us for the same reasons. In the future we might identify the need to share data with other organisations like the emergency services, local authorities and health care services, but we will update this privacy notice and keep you informed if we do.

Before we share any PSR data, we carry out all necessary assessments, undertake due diligence and data security checks, and we enter into data sharing agreements with these organisations. We only share basic identifiers like name, address, and a code (that would be meaningless to anyone else), which tells the other organisation what your specific need is. We share this simple code because we recognise that health data is sensitive, and it is unnecessary to share all your details with these organisations.

We currently only share and receive PSR data with National Grid, Scottish Southern Energy and Wessex Water, but we may share PSR data with other trusted organisations in the future, as referenced above (having carried out our assessments, due diligence and implemented agreements) where we think there is a benefit to you. If you have been added to our PSR because another organisation or individual has let us know about your additional needs, we will let you know. Equally, if we share your data with other organisations, we will update this privacy notice.

Please get in touch with us for more information on our PSR.

If you don’t want to receive Priority Services by being on the PSR, you can let us know by:

Emailing us at: customercontact@southwestwater.co.uk or by contacting Customer Services on the telephone numbers below in the “Who can I contact section”.

Social Tariffs

In limited circumstances we require consent from you to process your Personal Data – for example where you provide us with Sensitive Personal Data such as medical or health information in discussions with us about our Social Tariffs (e.g. information relating to disability/sickness benefits). When we collect your Sensitive Personal Data for these purposes, we will ensure that we get your explicit consent to collect and record it (and share with others if applicable) and tell you how you can withdraw your consent if you change your mind (see paragraphs below on Exercising your Rights for further information on your right to withdraw your consent).

To ensure that we are providing Social Tariffs to all those who are eligible, we share and receive limited relevant personal data with local authorities and government departments like the Department of Work and Pensions, on the basis of legitimate interests, to help us identify households who may benefit from one of our social tariffs. The Personal Data that is shared is kept to an absolute minimum, shared safely and securely via encrypted email or SFTP, and does not include any Sensitive (Special Category) Personal Data.

For more information on our Social Tariffs please click here for our WaterCare and WaterSure Tariffs.

Business Efficiency

Where our processing is not necessary for compliance with a legal obligation or a Substantial Public Interest (as described above), we generally rely on our legitimate interests to run our business efficiently and improve our services (e.g. assisting our billing and collection activities; to enable us to deliver affordable bills to our customers; carrying out customer satisfaction surveys or market research; letting you know about campaigns such as “The 3 Ps” and informing you on how to help prevent “Fatberg” in our sewers and ways in which you can increase water efficiency).

Before rolling out any new campaign or business initiative, we carry out an internal review (known as a Data Privacy Impact Assessment or DPIA) to check that our legitimate interests are not overridden by your rights, and to check that we will only process your Personal Data in a way that we think you would reasonably expect (such as. as set out in this Notice).

Why we contact you (electronic messaging)

From time to time, we may send electronic communications to you via email, text message or through social media channels for the reasons set our below. These messages are typically essential service messages, public service/service messages, surveys (market research), information updates or educational messages and they are sent under the public interest or legitimate interests’ lawful bases. As such, these messages do not fall into the category of direct marketing so they do not require your consent to be sent; we will send them to you as appropriate or unless you tell us you do not wish to receive them (with the exception of essential service messages). While we do not currently send any direct marketing material via electronic means, should this change, we will ensure that we have your consent before any messages are sent.  

Essential Service Information (service messages)

We will inform you of critical information about your water supply, such as interruptions to supply or anything that will affect your water quality. These messages are typically sent as texts or recorded messages to your phone.

We will inform you that a bill payment is due, this is usually sent via a text message or to the email address registered with us for on-line account management and paperless billing.

If you have requested a service from us, or you are impacted by our operations in the area, we will keep you informed of progress.

Who will see your Personal Data?

Marketing WaterAid

We also process your Personal Data based on legitimate interests (whether in your interests, our interests or those of a third party, providing an impact assessment has been carried out). This includes providing you with information about and appeals made by or on behalf of Water Aid (a registered charity 288701 set up by the water industry to promote water efficiency and water for all), including the circulation of their annual charitable leaflet. You may request that you do not receive direct marketing communications from or about WaterAid by contacting us at:

customercontact@southwestwater.co.uk for SWW and BW customers, and

customer.services@bristolwater.co.uk for BRL customers

Please refer to WaterAid in your email Subject heading.

Marketing HomeServe

Also, where we are obliged to fulfil our statutory duty or based on our legitimate interests to promote water efficiency, we share your contact details with third parties to provide relevant services on our behalf.  At present, we contract with HomeServe plc* (and its group companies) who periodically distribute information about their insurance backed water efficiency and plumbing services in a letter or bill insert along with your water and/or wastewater bill.  This letter may be jointly branded between us and HomeServe, or it may be issued under our branding alone.  When you give us your verbal consent (which is noted on our system by the call handler) and are on a ‘phone call with our customers services teams, they may connect you to HomeServe or provide HomeServe with your contact details to discuss HomeServe’s insurance backed services. You may request that we do not share your Personal Data with HomeServe or that you do not receive direct marketing communications from HomeServe by contacting us on customercontact@southwestwater.co.uk

You can find out more about how HomeServe use your Personal Data here: - www.homeserve.com/uk/about/privacy-policy

We may also rely on legitimate interests to process your personal information to send you information either by or on behalf of third parties about their products or services which relate to our regulated services. You may request that you do not receive direct marketing communications from or about these third parties by Emailing us at: 

customerscontact@southwestwater.co.uk  for SWW customers
customer.services@bristolwater.co.uk for BRL customers

We will need to share some of your Personal Data with others in order to do this. If you have agreed to receive marketing, products or services from another company and later decide you no longer want these, please contact that company directly to let them know (as it will be that third party who you have a relationship with, not us, who manage the mailing lists).

We may also rely on legitimate interests to process your personal information to send you information either by or on behalf of third parties about their products or services which relate to our regulated services. You may request that you do not receive direct marketing communications from or about these third parties by

Emailing us at:

customercontact@southwestwater.co.uk for SWW customers
customer.services@bristolwater.co.uk for BRL customers

We will need to share some of your Personal Data with others in order to do this. If you have agreed to receive marketing, products or services from another company and later decide you no longer want these, please contact that company directly to let them know (as it will be that third party who you have a relationship with, not us, who manage the mailing lists).

Sharing your data

Who sees or has access to your Personal Data within SWW will depend on why we need to process the data. The following functions, for example, will have access to your Personal Data (only for Personal Data that is necessary for their functions):

• Our Customer Services Teams for billing enquiries, operational repairs and complaints
• Our Developer Services Team and their contractors in relation to connections to our network
• Our Legal Team for dealing with any complaints or disputes, requests for information and advice
• Our Water Regulations Team to carry out inspections of plumbing systems to confirm compliance with the Water Supply (Water Fittings) Regulations 1999
• Our Water Quality team to enable them to take water samples to maintain our excellent water quality
• Our Leakage, Metering and Distribution teams to enable them to monitor and maintain the water network, monitor and measure consumption and reduce customer leakage
• Our Property Searches Team to assist in providing connection, supply, drainage and flooding history information (such as under Con29 Conveyancing searches)
• Our Group I.T. Services to assist with software and application support and data security.
• Our internal audit team to provide assurance for business processes and decisions

Some of the above activities, particularly in relation to leakage and metering, may also be carried out by our partner contractors. We also use data processors to provide some of our customers with a Customer Services facility and for Customer Service support.

We will also share your Personal Data with third parties, in order to meet our legal obligations or to fulfil our or your legitimate interests, such as:

• Our regulators
• Law enforcement agencies
• Public authorities and agencies with whom we work in connection with the provision of water and sewerage services and the provision of priority services
• Other water and sewerage companies where required for the supply of water or sewerage services to your supply address and the provision of priority services
• Self-lay providers for making new supply connections at development sites
• Land Agents for the management of our land, property and obtaining land rights
• Our external legal and professional advisors
• Software providers and I.T. support providers (and their sub-contractors) for our I.T. systems
• Credit reference agencies and debt collection services
• Market researchers to carry out and analyse surveys and feedback
• Social media platforms for responding to enquiries and complaints
• Insurance providers for managing litigation and insurance claims
• Auditors to provide assurance for business processes and decisions
• Other third parties providing assistance to our customers, such as bottled water suppliers for vulnerable customers
• Contractors who carry out activities to educate the public on matters relating to our regulated services (such as water efficiency and leakage)
• Partner Contractors and third-party contractors (and their sub-contractors) who carry out work on our behalf, such as a works contractors undertaking repairs
• Third party analytics providers who help us so we can get a better understanding of our customers’ lifestyle and water consumption habits. This assists us in understanding our customers, tailoring our services, and providing relevant information such as water efficiency advice and products. Wherever possible, this will be aggregated, pseudonymised, or anonymised data.

We may also be required to share Personal Data under a court order or other legal obligation.

Third Party processing and marketing, including HomeServe and WaterAid

For some of our back-office functions, we use third party processors. We carry out Data Privacy Impact Assessments (DPIA) before engaging with the third party and ensure that we have suitable contracts in place with them to protect individuals’ Personal Data. The relationships with third parties include:

Our Regulators and other agencies

We work closely with our Regulators and other agencies to enable them to fulfil their (and our) legal obligations and as such, in some circumstances we are required to provide them with Personal information. This information could be, for example

• information in relation to a water quality incident, which is provided to the Drinking Water Inspectorate (DWI) and or Health Security Agency (HSA)
• information relating to a data protection matter, provided to the Information Commissioner’s Office (ICO)
• customer complaint information and company performance information provided to Ofwat, Consumer Council for Water or WATRS
• postcode data relating to flooding in relevant areas provided to the Environment Agency
• customer satisfaction and survey data provided to Ofwat.

Sharing with Ofwat

We share your Personal Data, by statutory requirement, with Ofwat to help them regulate customer service and so they can measure and score our (and other water companies) performance in specific areas, namely, Customer Measure of Experience (C-MeX) and Developer Services Measure of Experience (D-MeX). Using the information we provide, Ofwat conduct their own surveys with customers who have contacted us for any reason. These calls are not marketing calls, but if you would prefer that we do not share your details with Ofwat please let us know by contacting us using the contact details provided below.

Ofwat are a Data Controller for the information we provide to them as they require this information using their statutory powers and they choose how to use this data; they are not acting on our instruction. Please contact Ofwat directly if you have any queries relating to these surveys.

Transfer of data outside of the UK and EEA

In processing Personal Data to carry out our activities, we will in some circumstances transfer Personal Data to third party processors located outside the United Kingdom or the European Economic Area ("EEA") or allow Personal Data to be accessed by processors outside the UK or EEA. For these data transfers we ensure that the relevant safeguards, as required in Article 46, are implemented and transfer impact assessments are conducted (as appropriate).

As an example, SWW use the services of TATA consultancy services in India and Manilla to assist with SWW Customer Service administration work, using a secure link to our protected system. Certain software providers and support services located in India and other third countries may need to access Personal Data records to fix faults in that software used. We ensure that we act in compliance with UK data protection law and that our third-party processors operate to very high standards and are bound by the relevant transfer and contractual agreements to maintain data security and confidentiality.

Security and storage of Personal Data

All information you provide to us - whether on paper, verbally or electronically - is stored securely. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your internet connection when you send us your data; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to help prevent unauthorised access.

Processing of information about children

We take the privacy of children very seriously. We do not expect to routinely process information about children, nor would we expect to have interactions with children in the course of our usual business, save for assessment of applicable social or other tariffs or in relation to our priority services register. Should we need to process data about children (those under 13), we will seek appropriate consent from an adult with parental responsibility or appointed guardian.   Any child's personal details you provide us will only be used for that purpose, for example for the use in an application for an assisted tariff or the provision or priority services.

Keeping information accurate and up to date

We will check the accuracy of any Personal Data at the point of collection and keep the Personal Data accurate and up to date on advice from yourselves. If your personal details change (for example your name or household status), please let us know either by updating your MyAccount details or by letting us know at customerservices@soutwestwater.co.uk.

We will take reasonable steps to destroy or amend inaccurate or out-of-date data. The law and our regulatory requirements determine the length of time information must be kept. We will not keep your Personal Data longer than is necessary.

How you can access and update your information: Exercising your Rights

If you have an account with “MyAccount”, you can check that the information that we hold about you as an account holder is up to date.  If you do not have a “MyAccount” account, you may contact us using contact details below to enquire.

As a Data Subject, you have a number of rights in relation to your data under UK data protection law. For full information on your Rights, you can read the guidance from the Information Commissioner's Office at www.ico.org.uk/. A summary of these rights is provided below:

Individual Rights	What this means
Access	You can ask us to confirm whether we are processing your data and request a copy of that data in a commonly used, machine-readable format - see below on Subject Access Requests.
Rectification	You can ask that your Personal Data be corrected if you believe it is inaccurate or incomplete.
Erasure	You can ask us to erase your Personal Data, if – -          It is no longer needed for the purposes for which it was collected -          You have withdrawn your consent (Where the data processing was based on Consent) Please note: there is not an absolute right to erasure as there are some circumstances where we will be unable to erase Personal Data – such as where we are obliged by law to retain data so that we can fulfil our legal obligations, or if we need to retain data to protect our own legal rights or to defend claims made against us.
Restriction	You can ask us to restrict your Personal Data (keep but not use). However, in some circumstances this right may not apply, for example, where we have a legal obligation to use the data.
Objection	You can object to any processing of your Personal Data for some specific purposes, such as marketing. Please note, this right does not apply in all circumstances and you can only object to processing when we are using your data for a task carried out in the public interest, for the exercise of official authority, for legitimate interests, for scientific or historical research, or statistical purposes, or for direct marketing purposes. If you would prefer not to receive marketing information from us, please contact us using the details below.

If you would like to exercise any of these rights, please fill out our easy to use webform, which is accessible by clicking this link.

Please note that these rights should not be confused with those under the Freedom of Information Act 2000 and Freedom of Information Requests (also known as FOI or FOIA requests). As we are not a public authority and, as such, we are not subject to the Freedom of Information Act or Freedom of Information Requests; if you are seeking a copy of your Personal Data this will fall under the Right of Access (Subject Access Request) as described below.

Subject Access Requests: Exercising your rights

As an individual (Data Subject), you can make a formal request for information we hold about you. Please note, this Right of Access does not extend to or entitle you to have any access to someone else’s Personal Data. For example, you cannot use this right to request information about your neighbours’ or previous occupants of your property; you are only entitled to copies of your Personal Data.

However, you can make requests on behalf of someone else, either where you have legal authority to do so or where the individual have given their permission for you to access their data on their behalf. In these situations, we will always ask for proof of legal authority, or permission from the individual for which you are seeking Personal Data, before we will provide you with any Personal Data.

There are a number of companies (third parties) offering on-line services to help you to exercise your rights under the UK GDPR. Where we receive Rights requests via these third-party providers, we will contact you directly, using the information you have provided via the third-party, to confirm your identity and the nature of your request; we will deal directly with you from this point on to action your request.  

Please note, where we receive Rights requests from third-party providers and there is insufficient information for us to verify the requester’s identity or authority, or that of the data subject, it will not be possible for us to respond to the request.

If you would like to submit a Subject Access Request, please fill out our easy to use webform, which is accessible by clicking this link.

When receiving telephone enquiries, we will only disclose Personal Data we hold on our systems if the following conditions are met:

• We will check and confirm the caller's identity to make sure that information is only given to a person who is entitled to it
• Where a request is made on behalf of another person (or asking for that person’s Personal Data) we will need to speak to them first to confirm their identity and that they are happy for us to disclose their Personal Data to the caller
• We will suggest that the caller completes our easy to use webform or put their request in writing if we are not sure about the caller's identity (or the person on behalf of whom they are making the request) and where their identity cannot be checked.

Where a request is made electronically, either via our easy to use webform or via email, data will be provided electronically by our secure data privacy portal (OneTrust).

Links to other websites

Our website may contain links to other websites run by other organisations.

This Privacy Notice applies only to SWW and Pennon’s group companies‚ so we encourage you to read the privacy statements on the other companies’ websites you visit.

We cannot be responsible for the privacy policies and practices of other sites even if you access those using links from our website. In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the notice of that third-party site.

Cookies

For information about how we use Cookies for electronic communications or on our website, please see our separate Cookies Policies for SWW and for BRL.

Who can I contact about my Personal Data?

SWW's details are:

South West Water Limited, Company Number 2366665, of Peninsula House, Rydon Lane, Exeter, EX2 7HR, Data Protection Public Registration number Z4569683. Our nominated representative for the purpose of the Regulation is the Data Protection Officer of Pennon Group PLC.

Should you need to contact us to discuss the handling of your Personal Data or to submit a request to exercise one of your Data Protection Rights, please contact our customer service team:

Or you may chat with us on WhatsApp, send us a Private Message using Facebook and Direct message us on Twitter.

If you wish to raise a complaint on how we have handled your Personal Data, in the first instance please telephone us on 0344 346 1010 and we will try to resolve you query over the phone. We may refer the matter to our Data Protection Officer who will investigate further.

Our Data Protection Officer can be contacted via email:

Email - dataprotection@pennon-group.co.uk

Or write to - Pennon Data Protection Officer, Peninsula House, Rydon Lane, Exeter, EX2 7HR.

If you are not satisfied with our response or believe we are not processing your Personal Data in accordance with the law, you can refer your concerns to the Information Commissioner's Office (ICO).

How can I contact the Information Commissioner's Office?

Whilst we hope that we can address any questions or concerns you might have, should you need to contact the Information Commissioner's Office you can do so using one of the following methods:

 

Write to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113 or 01625 545 745

Website: www.ico.org.uk 

Download a PDF version of our Privacy Policy. 

Updated: [23 August 2024]