1. How do we collect personal data? We may collect your personal data in a number of ways, for example:

Transcription

1 Data Privacy Notice We are Thames Water; officially known as Thames Water Utilities Ltd ( TWUL ), the largest Water and Wastewater Services Provider in the UK. We are wholly owned by Kemble Water Holdings Limited. The EU General Data Protection Regulation; commonly referred to as GDPR comes into force from May 25th At Thames Water we will sometimes need to use personal data about you. Where Thames Water controls the use of your personal data, it is responsible for its use under data protection law. In legal terms, this is referred to as being the data. We wanted to let you know that because of the GDPR, we have created this Data Privacy Notice to make it easier for You our Customers; to understand how TWUL look after and protect your personal data. We take your personal data privacy very seriously. Thames Water is committed to protecting your personal data. This Privacy Notice outlines how and what personal data we collect, how that data is used and stored. We encourage you to read the 6 sections below thoroughly. This Privacy Notice sets out the basis on which we collect, retain, use and disclose your personal data (this means any information or data about you which identifies you or allows identify you as a customer), as well as your rights in respect of such personal data. If we make any significant changes impacting your privacy, we will make this clear on our website. Please remember to check back from time to time. Updated on May 2018

2 Contents Data Privacy Notice How do we collect personal data? a) Cookies What personal data do we collect? a) Smart Metering - Why do we use smart meters? b) Customer Surveys c) Property Searches d) Developer Services Keeping your Personal Data safe a) Security b) How long do we keep your information? Using the Personal Data we collect a) Third Parties b) Water Efficiency c) Credit Reference Agencies Your Data Privacy rights a) Subject Access Request - SAR Contact... 13

3 1. How do we collect personal data? We may collect your personal data in a number of ways, for example: when you register with us and set up an account to receive our services; when you contact us through our websites, by telephone, post, or through any other means; when you have a smart meter; when you complete surveys that we use for research purposes (although you are not obliged to respond to them); when you enter a competition or promotion; when you make payments to us, through this website or otherwise; when you use our services; when we receive your personal data from third parties, for example credit reference agencies or fraud prevention organisations; and when we collect publicly available information about you. Information collected automatically statistical information: We automatically collect some information about your visit to our websites but this does not record personally identifiable information. This is technical information about how your browser and the device you are using interacts with our website and does not reveal personal details like your name, address and payment information. Personal data does not include information where your identity has been removed or is unknown. We group together the technical information we collect about all our website users and aggregate it for analysis to understand how users prefer to use our website and where we should make changes to make it work more efficiently and better for you. The sort of information recorded includes how many people visit our website, which pages and items are the most popular and about how you use and interact with our website. 1. a) Cookies Our websites use cookies. Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the website. Cookies do not record name, address or payment details for instance. If you would like further information about our use of cookies please read our cookie policy here.

4 2. What personal data do we collect? We may collect the following types of your personal data: Your name, address, address, telephone (landline) number, and mobile telephone number; Information about your billing and payment history, and information we learn from the way you manage your account; Information about your credit history with other credit providers which we obtain from credit reference agencies; Some of the information we collect about you may include sensitive personal data; If you have provided us with details of your health, we will use that information where you need to be treated as a Vulnerable or Priority Customer for water needs. If you volunteer other relevant information about your circumstances which affect your ability to pay your bills, we will take account of those details Information about your use of our services, including information about your water usage which we collect from meters; 2. a) Smart Metering - Why do we use smart meters? Managing water supplies will only get more difficult as our population grows and our climate changes. As a result, we need to modernise the way we manage supplies by fitting meters across our region, helping to protect supplies for future generations. Smart meters send us regular meter reads (hourly/daily/monthly), so we can: Give you frequent information so that you can be in control of your water use and your bill. Let you know if you have a leak on your external pipe. Give you accurate bills based on what you have used. Help you with any queries quickly. Measure the amount of water that is used by our customers so we can maintain our network more efficiently. Identify leaks on our network and act quickly to fix them. Find more information about how we use your data for the smart metering programme here. 2. b) Customer Surveys We are committed to improving the service we provide to our customers. Essential to this is the need to understand, directly from our customers, how well we are currently doing. We use this information to create and monitor change. Gathering this feedback also provides us with an opportunity to reconnect with our customers and put things right should they be less than happy with our service.

5 We use a variety of methods to gather feedback from our customers. We may do this ourselves, but equally we also rely on a small number of partner organisations. We have Data Sharing Agreements in place with these agencies and all conform to Market Research Society Codes of Conduct. The following agencies undertake the most work for us: Rant & Rave carry out the bulk of our customer surveys. You may get a text, or landline voic , asking a number of different questions, including your satisfaction with the service and whether you would recommend Thames Water. This will most often happen after interactions on the phone, website or after a visit from one of our technicians or contractors. Occasionally, and in particular during service failures, we may use Rant & Rave to proactively keep you updated; and to help us gather information to best service your needs in the moment. If you are dissatisfied with our service, we may look to reconnect with you to put things right. BMG (Bostock Marketing Group) work on behalf of our Regulator (Ofwat) and ourselves. Every three months, Ofwat commissions BMG to phone a number of our customers who have recently made contact with us to ask them for their view on the service we provided. They may also ask some demographic questions to enable Ofwat to understand whether we are treating all our customers fairly. BMG also carry out the same survey on behalf of Thames Water, however this is done on a weekly basis. Allto Consulting also work on behalf of our Regulator. Ofwat are in the process of piloting a new way of measuring the service Water companies provide. Allto Consulting may contact our customers through a number of different ways, including telephone, text, and online. Surveys will be conducted on any customers within the Thames Water area, regardless of whether they have made contact with the water company. Populus are employed by us to conduct quarterly surveys on customers within our area (contactors and non-contactors). They recruit and utilise their own online panel of customers, asking them specifically about whether they would recommend Thames Water and further questions to understand reasoning behind their scores. Other companies that we partner with include: BritainThinks, Verve, eftec and Community Research. All companies undertake various forms of research on our behalf, including focus groups, online surveys and panels, telephone, face-to-face and in the street surveying. Customers may opt out or stop any service improvement surveying at any point in time whether that s stopping any further surveys or withdrawing partway through the activity. Other than the Rant & Rave survey, customers will always be asked whether they wish to remain anonymous to Thames Water. Customer data generated through these routes will only be used for the purpose of gaining a better understanding of the service we provide, how we can improve it and with the intention of helping customers during incidents if required. (This is not used for any Marketing activity).

6 2. c) Property Searches We collect and store the following information (which may include personal data) that you and/or your agent provide: Personal details you and/or your agent submit to us via this website: (the "Website"), such as name, address, and address. This includes information provided at the time of registering with our site or when requesting services from us. Details you and/or your agent submit which relate to the property on which searches are to be carried out, including the address, current registered proprietor, current use and future use. Details of any contact you and/or your agent make to us, we may keep a record of that correspondence (including ). Details of the transactions you and/or your agent carry out through the Website and of the fulfilment of your orders. Details of your, and/or your agent, visits to the Website and the resources that you and/or your agent access. For more information about property searches please visit the website here. 2. d) Developer Services Developer Services offers a wide range of products and services, with expert advice and assistance for all of our customers. We are responsible for providing new assets, adoption of new and existing assets and ensuring they meet our standards. We will use the information you provide on Developer Services application forms to provide the service you ve requested. We potentially share it with our delivery partners, to provide the service you ve requested. This could include contacting you to discuss your application and/or provide more details, visiting the site where work needs to be carried out, and invoicing you when appropriate. We won t use this information for marketing purposes without contacting you to seek your consent. For more information about Developer Services please visit the website here.

7 3. Keeping your Personal Data safe 3. a) Security The security of your personal data is very important to us. We will ensure that the personal information that you provide us via this website is held on secure servers, find out more here. We will take appropriate technical and organisational measures to prevent unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to personal data. Details of payments that you make to us, Payment card details and other transaction details are held by a third party payment provider who must comply with strict security and confidentiality rules and comply with data protection legislation. 3. b) How long do we keep your information? We have a retention policy in place and will store your personal data as long as necessary for the provision of our services. We take all reasonable steps to retain your information for as long as is necessary to fulfil our contractual and legal obligations to you. If you would like more information on our data retention policy, please contact our Data Protection Team: sm-dataprotectionattw@thameswater.co.uk

8 4. Using the Personal Data we collect We may use your personal data in the following ways: To provide you with our services, and to develop and improve those services; To protect, manage and administer your account and provide you with bills and statements; To deal with any problems or complaints that arise in relation to your account; For assessment and analysis purposes to help improve the operation of our business; To prevent, detect and prosecute fraud and other crime; To make sure we can supply you with water or/and wastewater services at your property and obtain payment for that service. We use your details for these purposes to take steps at your request to provide you to supply water, Wastewater services, to comply with our legal obligations, such as under water legislation; and for our legitimate interests in running our organisation efficiently. Sharing your personal data We may share your personal data: with our employees, agents and/or professional advisors; with other companies within the Thames Group, and with successors-in-title to our business; with other third party contractors who provide services to us which require the processing of personal data; This means external to TWUL whether intra group or external; with third party payment providers who process payments made over our website; where we are under a legal obligation to do so, for example where we are required to share information under statute or because of a Court Order; to relevant authorities in order to prevent fraud and other criminal offences; and with credit reference agencies. with non-household market system that manages all electronic transactions involved in switching customers from current retailers and wholesalers to their chosen provider and provides usage and settlement data to such trading parties which is used in the billing process, maintained by the Market Operator Services Limited (MOSL). with, Homeserve Membership Limited our insurance partner. Homeserve might contact you to support with ongoing customer journey with cover for areas of the home not currently covered by Thames Water. We offer our customers an introductory rate to Plumbing & Drainage Plus cover, an insurance product to offer assistance. You can withdraw consent by either phoning us on or ing customerservices@thameswater.co.uk If you wish to be contacted by our selected partners, to introduce you to water related news and services which may interest you, please let us know by ing us at customerservices@thameswater.co.uk

9 Transferring personal data outside the EEA In some cases we may transfer your personal data to countries outside the European Economic Area. Where we do so we will ensure that such transfers are compliant with any current General Data Protection Regulation and that appropriate measures are put in place to keep your personal data secure. 4. a) Third Parties We have contractual arrangements in place with third party partners and agents who perform services on our behalf. These partners may include printers, IT specialists, research firms and credit card processors. We only choose third party service partners that we can trust and when we use them, we disclose on the personal information that is necessary to deliver the service provided. We have contracts in place that require them to keep your information secure and process it in accordance with our instructions 4. b) Water Efficiency On average, Thames Water customers use almost a third more water than we did 30 years ago. The Thames Water supply region is classed as water stressed by the Government. That means we must conserve our water now, so there's enough to go around in the future. Our forecasts show that, if we do nothing, by 2020, there'll be a shortfall in the available water putting business continuity and quality of life of our customers at risk. Through various services including water efficiency analysis we can rapidly respond to natural disasters as well as individual leaks, targeting water network improvements where they will make the greatest impact. Tackling water efficiency will help save on water and energy bills, and protect the local environment. 4. c) Credit Reference Agencies How do we use the information we receive? We share your personal data with, and receive your personal data from, credit reference agencies in order to help us maintain up-to-date customer records, manage our customer debt risk, and feed information into our debt collection process. The information we receive from credit reference agencies may be used in the following ways: to assess your account and decide what payment terms are appropriate to verify your identity to manage your personal account to maintain up-to-date customer records to manage our customer debt risk and our debt collection process

10 to undertake periodic statistical analysis or testing to ensure the accuracy of existing and future products and services. If you owe us money and do not repay in accordance with our payment terms, we will notify you of our intention to file a default. If your bill remains unpaid then we will notify our credit reference agency. This could result in your credit rating being negatively impacted. Information that we give and receive from credit reference agencies includes: information about your personal accounts with us and about your accounts with other organisations such as other utility companies; information about your spouses or partners with whom you are jointly liable for credit payments; and where you are the owner, director or partner in a small business, information about your business. In addition, credit reference agencies may provide us with public information about you such as County Court Judgments, bankruptcies and Electoral Register Information.

11 5. Your Data Privacy rights At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights, although they are all affected by different conditions and limitations: Right of access you have the right to request a copy of the information that we hold about you. Right of rectification you have a right to correct data that we hold about you that is inaccurate or incomplete. Right to erasure in certain circumstances you can ask for the data we hold about you to be erased from our records. Right to restriction of processing where certain conditions apply to have a right to restrict the processing. Right of portability you have the right to have the data we hold about you transferred to another organisation. Right to object you have the right to object to certain types of processing such as direct marketing. Right to object to automated processing, including profiling you also have the right to be subject to the legal effects of automated processing or profiling. Please let us know if the personal data that we hold about you needs to be updated by ing us using our online form. If you provide us with sensitive personal information, we will process this information for the purposes which you have provided it.

12 5. a) Subject Access Request - SAR You can request a copy of the information that we hold about you at any time, Subject Access Request (SAR) by contacting us by phone, or letter at the address in section 6 of this document. You will be required to prove your identity and then we will provide the information to you free of charge within a month as per current regulation GDPR. In some cases, we may need time extension due to the length of the request, in such cases we will agree with you an appropriate time.

13 6. Contact Communicating with us: If you have any questions related to this Privacy Notice or access to any personal information you have provided to us please get in touch. If you contact us by , or provide your address for us to contact you, we may use the details provided to contact you about anything to do with your query, or managing your account. If you no longer wish us to contact you by , please let us know and, if necessary, provide alternative contact details. If you contact us by telephone, your call may be recorded for training and servicerelated purposes. Communicating with you: From time to time we, and other companies in the Thames Group, may tell you about waterrelated goods or services that we believe may be of benefit to you. When we contact you for this purpose we will give you an opportunity to opt-out from receiving such communications in future if you so wish. By post If you would like to write to us please send your letter to: Thames Water Data Protection Officer Clearwater Court Vastern Road Reading Berkshire RG1 8DB By Please let us know if the personal data that we hold about you needs to be updated by ing us using our online form here.