Privacy Notice

This Privacy Notice is designed to explain how we collect and use our customer’s and other individual’s personal data. We are committed to protecting this data, to uphold their data rights, and to meet expectations for handling personal data.

We are a registered data controller, registration number: Z6707640. This means it is our responsibility to maintain and protect all personal data that we collect and ensure that anyone we share personal data with will also adequately protect that data.

This Notice relates to Portsmouth Water Limited (Company Number 2536455) as the principal subsidiary in the South Downs Group, but will also apply to other subsidiaries.

We will always endeavour to make it clear why we are collecting your personal data.

Information we collect from you and what we do with it

We collect and process your personal data in a number of ways from the information you give to us. You may provide information to us about you by filling in a form on our website or by contacting us by telephone, email or otherwise. This includes information you provide when registering for our online customer portal, when you search for or request a service from us, enter a competition or survey or when you report a leak, problem or provide feedback regarding our website or the services we provide.

The information you provide us with will vary, but will include:

• Personal details: title, name, date of birth, disability;
• Bank account and card details: account number and sort code, accounts holders name, direct debit details;
• Contact details: postal address, email address, mobile and/or landline numbers;
• Financial details: household income, benefits;
• Household information: age and number of children;
• Documentation: bank statements, passports etc.

We will keep scanned copies of any documents for validation and audit purposes, this evidence will be deleted in line with our retention policy.

If an individual is registered on our Priority Services Register, we will collect information to allow us to provide additional assistance and support to that individual when required. For more information, please see the ‘Priority Services Register – Helping Our Vulnerable Customers’ section of this Notice.

We also collect information about you from other sources, examples being:

• If you are a tenant, your Landlord or letting agent may provide us with personal data in order to set up or close down your water account at their property.
• A new resident at a former supply address, estate/letting agent or solicitor acting on behalf of you or a new resident of a former supply address (e.g. where you are moving home and the third party is providing a forwarding address – with or without your consent).
• Your sewerage company to ensure accurate billing.
• Debt Management and Tracing Agencies will provide us with contact information (emails and telephone numbers) to allow us to contact and locate individuals for debt collection purposes.

We record all phone calls, incoming and out-going, made by departments that deal directly with customers, including Customer Services, Networks, Water Quality and Wholesale Services. Call recordings are held for 2 years before being securely deleted. While providing services we will collect data about you and when reading your water meter we will collect water usage information including, where applicable, information from SMART meters.

Whenever you visit our website or online portal we use cookies – these cookies do not collect personal information. For more information, please see the ‘Visiting Our Website, Using Our Online Customer Portal and Our Cookie Policy’ section of this Notice. We also collect data from publicly available sources (such as the electoral roll and Land Registry) where the information is made public as a matter of law.

Contacting us via social media

It is never a good idea to post your personal contact information on a public social media site. If you contact us using social media to report an issue and we need more information, we will ask you to private message us with suitable communication information which we will use to contact you in order to resolve your concern or gather additional information for our investigation.

Contacting us by telephone

When you contact us by telephone, your telephone number will be added to your account so that contact with you in relation to your water account can be made more convenient.

We will use a telephone number listed on your account to call or text you to provide you with essential service messages.

When contacting us outside of our normal working hours, (between 5pm-8am Monday to Friday and over the weekend), your call will be dealt with by our ‘out-of-hours’ partner, CallCare, who are working with us to ensure our customers can contact us 24 hours a day, 7 days a week. CallCare will collect information from you to allow us to deal with your call efficiently.

Emailing us

If you email us, we will respond to you using the email address you gave us. Your email address will be added to your account and will be used by us to provide you with essential service messages. Please try to avoid sending personal data by email as this is not considered to be a secure communication method.

Any email sent to Portsmouth Water, including any attachments, will be monitored and assessed by our security partners for reasons of security and to check compliance. Emails are also backed up by our data processor Mimecast.

Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.

Contacting us via WebChat

We use a third party provider, currently LiveChat, to supply and support our Webchat service, which we use to handle customer enquires in real time.

If you use the WebChat service we will collect your name, postal address, account number (optional) and email address (optional) as well as the contents of your WebChat session. The information provided will be added to your account.

You can request a transcript of your WebChat session once completed. This is sent to the email address you have the option to provide when logging in to the service.

Visiting our Offices

Our premises are monitored by CCTV so your image will be captured whenever you enter our site boundary. There are signs to show you when you are entering an area monitored by CCTV. CCTV images are held for 30 days and then deleted. In the case of suspected criminal activity CCTV images will be held for longer and will be shared with the relevant local authority (e.g. the Police), as appropriate.

Our Priority Services Register is a free service for customers who may need additional assistance either in communicating with us or in the event of a water supply interruption/emergency. Priority Services customers include those with physical or mental impairments, medical conditions, the elderly or those with young families. These customers may not be able to easily leave their home to collect bottled water in a water emergency.

The PSR allows us to quickly and efficiently identify those customers who require support in water events, and also allows support to be identified when planning work that may impact the water supply, as well as how we communicate with our customers.

The data is processed following individuals themselves, or third parties acting on their behalf (e.g. a family member, a charity, a support worker, a carer etc) signing up to the PSR by completing a hard-copy or online form or by calling our Customer Services Team. The individual provides the required information which, as well as that already described, will also include contact details (name, address, email, telephone number). On receiving this information, the relevant ‘Needs Code(s)’ and/or updates will be made on to the relevant customer account. ‘Needs Codes’ are entries that can be searched to identify the support that is needed through reports that we can run when we are required to do so.

We share PSR data with the energy sector, and other trusted third parties, to ensure that the assistance and support required by individuals can also be provided quickly and efficiently by these third parties. The support provided by these third parties may differ from that of Portsmouth Water’s support.

Individuals can request to be removed from the PSR at any time, but we will first review the request and may then discuss this with the individual to make sure it is in their best interest.

If you live close to the location of our proposed new Havant Thicket Reservoir, you’ll receive communications from us to keep you up to date with the project and/or to inform you of planned works that may require some form of action from yourself (e.g. to move your car to allow surveys to be completed). We may need to seek assistance from mail printing companies to issue these communications to you and if this is required we will share your name and address. The data will only be shared when necessary and will be deleted within 4 weeks of a communication campaign ending.

We have a separate website for the Havant Thicket Reservoir project at https://havant-thicket-reservoir.uk.engagementhq.com/. The Privacy Notice on that website details how your data will be used if you decide to register. If you register, and ask a question or provide comments and ask for contact to follow up on this, your contact details will be shared with the relevant consultant to allow a response to be provided. Drones may be used on the Havant Thicket Reservoir site and clear signage will be in place to ensure visitors are aware.

In respect to a customer’s responsibility for paying their bills, Portsmouth Water has a regulatory requirement to provide a safe, maintained supply of fresh water to your property. In section 5 of our Water Charges Scheme we explain that water charges are payable by the occupier of the premises, or the person who uses the supply, except where the owner of the premises is liable by enactment or by agreement with Portsmouth Water. Our Water Charges Scheme is further supported by the Water Industry Act 1991, which gives Water Companies the powers to charge and recover charges. This is referred to in Section 142 of the Water Industry Act 1991.

The information that we hold about customers will be used to recover arrears in line with our regulatory obligations and in doing so we use third party debt collection / management companies and credit reference agencies to assist us, this may include third parties undertaking Court Action on our behalf.

We use elements of automated decision making and profiling to identify appropriate debt recovery strategies.

Non-household customers are non-incorporated businesses whose retail services (e.g. customer services, billing) are provided by a separate water retail company, but whose premises are physically connected to our water network. We provide these customers with a wholesale service.

Insofar as limited personal information is collected in relation to non-incorporated businesses, both Portsmouth Water and the relevant water retailer are each separate Controllers of the personal data of the non-household customers in our service areas.

Information we collect from you and what we do with it

Our purpose is to use this data to provide a wholesale water service to our non-household customers and their retailers by carrying out activities such as:

• Supplying non-household customers with water in line with our legal and regulatory obligations;
• Recording and fixing service problems e.g. water pressure issues and burst water pipes;
• Maintaining our pipes and other assets;
• Dealing with emergency events;
• Maintaining, monitoring and reporting drinking water quality;
• Supporting non-household customers in improving water efficiency;
• Metering – making appointments, meter fitting and repairing;
• Collecting, analysing and sharing meter data from smart meter and data loggers to monitor consumption and leakage and enable accurate billing;
• Making payments – for example Guaranteed Service Standards (GSS);
• Working with farmers in our area on catchment studies to reduce pollution;
• Non-household customer communications around street works and incidents;
• Dealing with claims after service incidents;
• Managing enquiries and complaints;
• Assessing allowances and abatements;
• Carrying out vacant property checks and site visits to check meter and supply details, and;
• Demonstrating compliance with our legal obligations to our regulators.

More information on the wholesale services we provide to non-household customers can be found on our website at www.portsmouthwater.co.uk/business/.

What type of personal information do we process?

The information processed includes:

• Non-household customer contact and supply address details.
• Asset and incident information linked to the service that may identify the non-household customer for example, but not limited to, meter serial number, business meter readings, including 15 minute meter readings where data loggers have been fitted and are enabled.
• Information required to process insurance claims, for example, but not limited to, damage to a property due to flooding from our asset.
• Information required to produce regulatory reports, for example, reporting the number of customer complaints.

Our legal basis for processing personal data for these activities is Article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulated business in line with the rules and requirements set out by our regulators, such as Ofwat.

Sharing data with third parties

To provide our services in an efficient and effective way, your personal data may be provided to us by your retailer and we’ll share this with our service providers, for example, sharing Developer details with Retailers when a supply point is created in the market to enable the Retailer to produce bills. We’ll share with the Market Operator Services Limited (MOSL) as required, for example, in registering and de-registering supply points (please see MOSL’s Summary of Agreements for more information https://mosl.co.uk/documents-publications/1427-summary-of-arrangements/file).

This section of our Privacy Notice explains how we use personal data in relation to the development of a site or property. This could be relevant for homeowners, developers, self-lay providers and/or newly appointed water companies (NAVs).

Purpose (lawful basis for processing)

Our purpose is to provide a service to our customers in this context, including land/property owners, developers, self-lay providers and NAVs, by carrying out activities such as:

• Handling applications from customers for the provision of our services.
• Dealing with enquiries and complaints from customers who contact us for this purpose.
• Issuing invoices to and taking payments from our customers.
• Carrying out necessary work (e.g. new water mains and service connections, adoptions and requisitions, build over agreements, providing bulk water to NAVs).
• Customer relationship management (customer surveys, newsletters, open days).

More information on the services we provide to our customers in this context can be found on our website https://developers.portsmouthwater.co.uk/.

Our legal basis for processing your data for most of these activities is:

• Article 6(1)(c) which allows us to process personal data when processing is necessary for compliance with a legal obligation to which we are subject (Water Industry Act 1991 and associated regulations).
• Article 6(1)(b) which allows us to process personal data when processing is necessary for a contract, we have with you or because you have asked us to take specific steps before entering into a contract.
• Article 6(1)(f) which allows us to process personal data when processing is necessary for our legitimate interests or the legitimate interests of a third party, unless, on balance, these are outweighed by the need to protect your individual rights.

What type of personal information do we process for this purpose?

We use the information you’ve provided us to help us deliver the service you requested.

This could include contacting you to discuss the application/work, visiting the site where work needs to be carried out, and invoicing when appropriate. We may also arrange video calls to see the pipework.

Customer feedback is important to us, so we may also use the information to ask for feedback on how we can improve our performance.

We’ll use your business contact details to keep in touch and maintain strong working relationships with you.

Sharing data with third parties

Some of our services are carried out by our partner organisations. Where this is the case, we may transfer your personal data to them to allow them to complete the work.

We’re also required to share details with our regulator Ofwat, and its authorised agents, to enable them to conduct customer feedback surveys about our developer services performance.

For new properties around our border where we provide water supply services, we must share new connection information including address and postcode with companies providing the wastewater services for these properties.

Developer Portal

You may opt to register as a user of our Developer Portal, which will allow you to submit new service, self-lay or NAV applications electronically. You can also opt to make payment of the application fees via the portal. To register for the portal, we will require your Company name, correspondence address, email address, name, and telephone number.

We have a data retention policy and data will be retained as long as it serves a useful and legitimate purpose, taking into account all legal and regulatory obligations.

We will only collect data where we have a clear and legal basis to do so. The table below explains each legal basis we use, with a more detailed description of the purpose alongside it:

We have a legal obligation to confirm your identity, to keep records required by law or to evidence our compliance with laws, including tax laws, consumer protection laws and data protection laws. Where we are required to do so, we have to provide information to law enforcement agencies or other authorities.

We share personal data with multiple parties for legal, regulatory, and operational purposes. Other than where the exchange of data is required by law, we have contracts in place with third parties with whom we share data. These contracts detail how personal data should be handled and protected while being processed by any third party. We conduct due diligence checks on third party processors to ensure they comply with their obligations to us.

We have legal requirements for sharing data with your Sewerage Provider – this will usually be Southern Water Services Limited however, other companies may be operating in our area of supply and provide your waste water services.

We may use carefully selected third parties to help process your data and provide you with excellent customer service. We use software providers for different systems like our billing system and job management system to support us with the large amount of data that

we need to manage. We use third parties to assist us with printing bills and customer communications and to provide you with online customer accounts. We use companies to help us process payments including card payments, payment cards and to process cheques.

We share data with external agencies, such as local authorities, Police, Fire and/or Ambulance services, e.g. in the event of an emergency (this may include special category data, such as medical conditions if you have signed up to our Priority Services Register).

We share data with Government bodies for the detection and prevention of fraud.

We use third party organisations to help us provide our services to you and we share data with these parties. We have contracts in place and this means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any other organisation unless they are instructed by us to do so. They will hold it securely and retain it for the period we instruct.

Some of the third parties with whom we share your data are based outside of the United Kingdom and, in some cases, outside the European Economic Area. In these cases, your data is protected by the special safeguarding measures set out by the data protection legislation i.e.

• our contracts with these third parties incorporate the standard contractual clauses adopted by the European Commission and UK authorities for this purpose; or,
• the transfer is protected by the recipient’s binding corporate rule arrangements; or
• the recipient is in a country whose data protection laws are deemed by UK/EU authorities to provide adequate safeguard for transferred personal data without the need for additional safeguarding measures to be put in place.

We work closely with a number of Contractors, our primary contractor being Cappagh, for mains replacement, pipe repairs and meter options, and these Contractors will have access to customer information relevant to their work. We also use trusted Contractors to make leak repairs at customer properties. If you contact us about a leak in your home and are eligible for a visit, your data will be shared with our Contractors in order for them to provide this function on our behalf.

We share data with selected third parties for marketing purposes in circumstances where we have a legitimate interest in promoting their services and where we feel you would benefit from their products or services. In particular, we share data with HomeServe, who will use the information we provide to them to send dual branded marketing information on our behalf in relation to their Plumbing and Drainage Plus Insurance. You can opt-out of receiving direct marketing at any time by email, phone or in writing. To opt out of this plumbing and drainage insurance marketing you can also complete an online form. Please see the Direct Marketing section of this Notice for more details.

From time to time we require legal advice and may need to share your personal data with our legal advisers, our insurance company or other professional advisors in order to obtain advice or to make a claim.

The types of Organisations we share data with are as follows:-

To comply with our legal and regulatory obligations we provide personal data to the following Authorities:

• Defra
• Ofwat
• Drinking Water Inspectorate
• Environment Agency
• Public Health England
• Environmental Health Authorities
• Institute of Customer Service
• Consumer Council for Water (CCW)
• The Water Redress Scheme (WATRS)
• Market Operator Services Limited (MOSL).

Ofwat surveys (customer service – “C-MeX, D-MeX and B-MeX”)

All household customers and developers who contact us may have their contact information passed to a third party processor acting on behalf of our water regulator Ofwat for the purposes of regulating customer service in the water industry in England and Wales. You may be contacted by this third party about the service you received from Portsmouth Water and asked to score our performance. Your response is very important as it allows Ofwat to regulate the performance of companies and the service they provide their customers. This is not a marketing call or a call used for market research purposes. As Ofwat are our water regulator we are  obliged to share certain details with them, however, if you would rather we did not do this then please let us know by emailing us at: [email protected]. For more information please visit the Ofwat website at www.ofwat.gov.uk/regulated-companies/company-obligations/customer-experience/data-protection/.

Our surveys

We use third parties, or our own employees, to help contact our various types of customers to undertake water consumption surveys to inform our water resource management plan or for customer satisfaction or customer engagement processes. These are not marketing calls and your response is very important to us. If you would prefer not to participate you can register yourself as ‘no contact for surveys’ with our Customer Services Team at any time or by emailing us at [email protected]. Please note this will not stop general communications in relation to your account or water supply. The results of these surveys are not stored on your water account but are instead used by our Customer Engagement and Water Resources Team to look at improving engagement or planning resources in the area.

We may also contact you to undertake a survey after you have been in touch with us so that we can find out how satisfied you were with the service you received. We may contact you after this to see if we can improve our service to you.

Direct marketing

We do not use direct marketing to sell our core services, however, we may want to contact you in relation to additional services, such as water efficiency services. We may also want to provide you with marketing information from carefully selected third parties which relate to the services we provide.

Non-personalised bill inserts will be included with your water – to opt out of receiving these bill inserts, please complete the form at www.portsmouthwater.co.uk/opt-out.

If you contact our call centre, we may offer you the opportunity to talk to HomeServe about their Plumbing and Drainage Plus Insurance, unless you already have a policy with them or have indicated the product is not suitable for you. To opt-out of HomeServe marketing, in addition to the options below, you can also complete our online form which can be found under the ‘Cover Through HomeServe’ section at www.portsmouthwater.co.uk/opt-out.

If you decide to purchase Plumbing and Drainage insurance with HomeServe they will process your data as a Data Controller. To view a copy of HomeServe’s Privacy Policy please visit: www.homeserve.com/uk/about/privacy-policy.

You have the right to stop the use of your personal data for direct marketing activities and we must and will comply with your request.

If you would like to stop any other direct marketing communications from us:

• Call us on 023 9249 9666 and tell us you no longer wish to receive direct marketing;
• Email us at [email protected];
• Write to us at – Portsmouth Water, PO Box 8, West Street, Havant PO9 1LG.

Please note: You may continue to receive communications for a short period after changing your preferences whilst our systems are fully updated. If a third party marketing campaign is in the process of being issued at the time of your opt-out request, it may not be possible to remove your data from that campaign, therefore, you may receive this marketing communication.

Automated Decision Making and Profiling

Automated decision making involves making decisions using your personal data by automated means without any human involvement. We use automated decision making for decisions on how we recover debts. This is based on a profiled risk score provided by Credit Reference Agencies. We use the score to assess the likelihood of a customer being able to repay their debt. Risk scores are also used to determine which payment terms are most appropriate to any particular situation, as well as the appropriate way to support a customer if they fail to make payment or engage with us.

Whenever we use automated decision making that is likely to have a significant effect on someone, we ensure that there is a process for review by a human being.

Profiling is analysing information in a way that classifies individuals into different groups using algorithms or machine-learning. We may undertake profiling to analyse and predict behaviour in order to improve our services to our customers.

If you are an e-billing customer

In the interest of reducing paper and protecting the environment, and for your convenience, you may be an e-billing customer and hold an online customer account with us.

Shortly the current customer portal will close, and customers will be invited to sign up for our new online portal. Correspondence will be sent to you by email or letter with a secure QR Code/link to allow you to sign up. Your new online customer portal will allow you to manage your account, view recent bills and will also allow you to update your communication and marketing preferences. Both portals will run for a period of time before the older portal is closed down.

Using Social Media to Login

Using your social media account (Google or Facebook) to login will provide you with a more efficient way for you to access your account by enabling a quicker login. No data from your Portsmouth Water MyAccount is shared with Facebook or Google when logging in using these services. Using a social media login will open a session with either Facebook or Google and therefore once you have finished using MyAccount, you may wish to open a further browser to logout of your social media account, especially if you are using a shared or public computer.

Please note, this process will no longer apply when our current portal is closed, and individuals move to our new online customer portal.

Cookies

We use a cookies tool on our website and online customer portal to gain consent for the optional cookies we use. Cookies that are necessary for functionality, security and accessibility are set and are not deleted by the tool. Individuals visiting our website have the ability to turn off or ‘opt out’ of non-essential/optional cookies. You can read more about how we use cookies, and how to change your cookies preferences, in our Cookies Policy. Most web browsers allow some control of cookies through browser settings. More information about cookies, including how to block and/or delete them, via a range of common browsers, can be found at www.allaboutcookies.org.

• Right to be informed
  You can ask for details of how we process your personal data, as covered by this Privacy Notice.
• Right to Access
  You can ask for a copy of the information we hold about you. If possible, you should specify the type of information you’d like to see to ensure that our response meets your expectations. We must be able to verify your identify and your request may not impact the rights and freedoms of other people, e.g. privacy and confidentiality rights of other customers or our employees. Other exemptions may apply and this will be dependent on the information and context.
• Right to Rectification
  You can ask that your personal data be corrected or updated if you believe it is inaccurate or incomplete. This right only applies to your own personal data and when exercising this right, please be as specific as possible.
• Right to Erasure
  You may, in certain circumstances, be entitled to ask to have your personal data erased (this is also known as the ‘right to be forgotten’). We may not be able to erase your personal data if, for example, we need it to comply with a legal obligation or exercise or defend legal claims.
• Right to Restriction on Processing
  You can ask us to stop using your personal data, however, in some circumstances this right may not apply, for example, if we have a legal obligation to use the data.
• Right to Data Portability
  We do not currently carry out any such processing. If we do in the future, you can make a request and this data can be exported from our systems.
• Right to Object
  You can request that your personal data is not processed for specific purposes such as profiling. This right applies where our processing of your personal data is necessary for us to perform a task in the public interest or for our functions or for our legitimate purposes. You can also object to our processing of your personal data for direct marketing purposes. If you would like to opt out of receiving any marketing communications from us, please contact us using the details within this Notice.
• Rights Related to Automated Decision-making, including Profiling
  You have the right to not be subject to a decision based solely on automated processing of your personal data (i.e. no human intervention), including profiling, where the decision affects your legal status or rights of where the decision has a similarly significant effect, e.g. affecting your financial circumstances or employment opportunities.

The applicability of some of these rights depends on the legal basis of processing of the data concerned. Some of these rights only apply in specific circumstances and we may not need to fully comply with your request in all cases.

You may exercise any of these rights free of charge, by contacting us. We may need to check your identity and may need to ask for more information – it’ll help us if you’re as specific in your request as possible.

We’ll comply with your request within one calendar month (from the time we receive your request, or any additional information we asked for) unless:

• It’s a complex request – in such cases, we’ll respond within the month to inform you of the appropriate response period that will apply to your request (which may be a period of up to three months); or
• in exceptional circumstances, we would not be able to carry out your request. In these cases, we’ll inform you of the reason within one calendar month.

If you would like to request further information about our Privacy Notice, or exercise any of your rights, you can email us at [email protected] or write us at:

Data Protection Officer
Portsmouth Water
PO Box 8
West Street
Havant
PO9 1LG

You can also contact the Information Commissioner’s Office at http://ico.org.uk/ or write to Wycliffe House Water Lane, Wilmslow, Cheshire SK9 5AF or 0303 123 1113 for information, advice or to make a complaint.

Portsmouth Water tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.