We take the security and use of your personal data very seriously and are committed to complying with data protection legislation.

This notice outlines your rights and our responsibilities regarding your personal information.  It covers how and why we collect, use and share your information, the legal bases for doing so and how you can exercise your rights as a data subject. 

1. Who we are

We are Yorkshire Water Services Ltd trading as SafeMove. We provide conveyancing related searches and asset record maps in Yorkshire. We also facilitate the provision of Yorkshire Water’s asset records as part of their statutory duty. We are part of the Kelda Group.

For the purposes of Privacy Law, the data controller is:

Yorkshire Water Services Ltd (company number 2366682) registered at Western House, Halifax Road, Bradford BD6 2SZ.

Privacy Law means the Data Protection Act 1998 (as amended by the Data Protection Act 2018), the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation (from 25 May 2018) and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority.

2. Changes to Our Privacy Notice

We review this notice regularly as part of our internal processes or as our services, activities, or regulatory requirements change. It’s subject to change at any time, but the most up to date version is published here.

This notice is dated [November 2023].

3. Contacting Us

If you’d like to request further information about our privacy policy or exercise any of your rights you can contact us:

By email to Dataprotectionofficer@yorkshirewater.co.uk

By post to Data Protection Officer, Kelda Group, Western House, Halifax Road, Bradford BD6 2SZ   

We take any concerns we receive very seriously. If you think our collection or use of your personal information is unfair, misleading or inappropriate, please bring it to our attention. We’ll investigate and respond to your concerns including any additional information or explanations needed We also welcome suggestions for improving our procedures.  If you are unhappy with our response you can request our Data Protection Officer to review the case.

The Information Commissioner’s Office (ICO) regulates adherence to Privacy Law. For information, advice or to make a complaint you can:

• go to the ICO website
• write to The Information Commissioner's Office, Wycliffe House Water Lane, Wilmslow, Cheshire SK9 5AF; or
• call them on 0303 123 1113

4. Your Privacy Rights

You have rights relating to your personal information. You can find more information about your privacy rights on the Information Commissioner’s Office website.

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

1. The right to be informed

You have the right to be informed about how and why we process your personal information

Any time you give us personal information you have the right to be informed about why we need it and how we’ll use it.

You can find most of the information you need in this Privacy Notice.

If you have any questions please contact us.

2. The right of access

You have the right to access your personal information

You can request a copy of information we hold about you at any time.

We’ll try to deal with your request informally, for example by providing you with the specific information you need over the telephone providing we have the satisfactory evidence of your identity and the information you are requesting.

You can however formally request access to the personal information we hold about you by getting in touch through any of our customer service channels, but we’ll ask you to provide evidence of your identity before we process your request. We may also contact you to clarify your request or to ensure we have all the information we need to fully meet your request.

Privacy Law requires us to respond to your request within 30 calendar days of verifying your identity (or within three months for more complex cases).  You’ll receive a full response as soon as we can reasonably provide one and we aim to resolve all subject access requests within 30 calendar days from confirming your identity.  In more complex cases where we cannot provide a full substantive response within that time frame, we’ll write to you within 30 calendar days to explain why an extension is needed.

We don’t charge for subject access requests.

3. The right to rectification

You have the right to ask us to correct inaccurate personal information we hold about you

If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time, through any of our customer service channels.  Wherever possible, we’ll correct inaccurate or incomplete information immediately.

In more complex cases we’ll take reasonable steps to confirm the accuracy of the information we hold.  Whilst we investigate the accuracy of the information, we’ll restrict the processing of the information in question.

We’ll let you know the outcome of our investigation as soon as we can.  Any information we can verify as inaccurate will be corrected within one month of receiving your request.

4. The right to erasure

You have the right to ask us to delete your personal information

In some circumstances you have the right to ask us to delete information we hold about you.  For example, if we have asked for your consent to process the information, and you withdraw that consent.

We’ll respond to your request as soon as we can and we’ll act on any requests granted within one month of your request.

We can’t delete any information where we have a legal or regulatory obligation to keep it. This applies to all outstanding debts or anything in connection with our Water Supply License (e.g. water quality concerns related to the water supply for your property.  We may also refuse your request if we believe it to be excessive. If your request for deletion is refused, we’ll explain the reasons for refusal.

5. The right to restrict processing

You have the right to ask us to restrict the use of your personal information

In some instances, you have the right to ask us to restrict the use of your personal information (for example if you’ve challenged the accuracy of the information we hold, or have objected to our processing).  We’ll restrict our use of your information whilst we investigate your objection or request to correct your information.

We’ll respond to your request as soon as we can and we’ll act on any requests within one month of your request.

If your objection is unsuccessful, we’ll only continue processing once we’ve let you know the outcome of the investigation.

When processing is restricted, we are still permitted to store your personal data, but not use it. Information related to these requests will not be automatically deleted unless you expressly ask us to.

6. The right to data portability

You have the right to data portability

You have the right to move, transfer or copy data to another system for your own purposes. However, this right only applies where processing is automated and consent based. 

7. The right to object

You have the right to ask us not to process your personal information.

We process most of the information we collect about you under the lawful basis of ‘Public Task’ or ‘Consent’. You have the right to object to our processing your personal information under these lawful bases (including for marketing purposes and profiling). 

We will respond to your objection as soon as we can, detailing any actions we can reasonably make. If we believe there is an overriding compelling reason to continue the processing, we will explain why we think this is.

We’ll action any requests to stop direct marketing as soon as we receive your objection.

You can object to us using your data at any time through any of our contact channels.

8. Rights in relation to automated decision making and profiling

You have the right to request not to be subject to a decision based solely on automated processing, including profiling, which has an adverse effect on you.

We will consider any requests regarding automated decision making, including profiling, as soon as we receive your request.

5. Lawful basis for processing

Privacy Law states we must have a lawful basis for processing your information.  We have identified the legal bases on which we process your information, and this varies depending on how and why we have your information.  The legal bases we use are:

• Public Task: if the processing is necessary for the performance of our public tasks as a water company (e.g. arranging and maintaining your water supply and waste water services, billing and account management, collecting debt, maintaining our infrastructure);
• Consent: if you’ve given consent for us to process your personal information.
• Legitimate interest: if the activities are for our business purposes and do not impede your rights as data subjects (e.g. carrying out market research or customer satisfaction surveys to improve our service to you, complaints that have been made to CCWater, communications around your water usage, certain marketing activity such as WaterAid or other promotional material in your billing envelopes, data sharing with credit reference agencies, fraud prevention and detection, ensuring network information and public security etc.)
• Contracts: where our processing is necessary for the performance of a contract where you are a party to the contract.
• Legal obligations: if the processing is necessary for compliance with one of our legal obligations (e.g. we’re required to provide certain contact information and other details about our services to Ofwat, the Consumer Council for Water and the Water Redress Scheme (WATRS)); and
• Vital interests: we may need to process your personal information to protect your vital interests (e.g. because there is a risk to you and your household due to water quality issues or where the water supply has been disrupted).

If we process any special category information i.e. information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, health data, or data concerning your sex life or sexual orientation, we must have a further lawful basis for the processing. These further legal bases include where:

• you give us your explicit consent to process your special category information (e.g. in relation to a support scheme);
• the processing is necessary to protect your vital interests or someone else's vital interests;
• you make the information public;
• the processing is necessary for a legal claim (e.g. because you’ve failed to pay your bill);
• the processing is necessary for reasons of substantial public interest (e.g. where we suspect fraud on the part of a customer); or
• the processing is necessary for reasons of public interests in the area of public health (e.g. to manage a water quality incident or contamination).

6. Information we collect from you and what we do with it

To provide our services to you, we need to collect, process and store information about you that may be personal or sensitive in nature.  If we intend to use your information for a different purpose, we’ll do so in ways consistent with Privacy Law or, wherever possible, by notifying you in advance.

We’ll only use your information for the specific purpose(s) for which it has been provided to us or collected by us.

We collect and process a variety of information from you and about you.  In most cases, the information we collect about you is provided by you directly. This is one of the ways we can ensure the information we collect is as accurate and up to date as possible. We’ll usually do this when you first contact us, and we may ask you to confirm your details on subsequent contacts from time to time. We use your information to manage your account, improve and develop our business generally and to enforce our legal rights.  If we intend to use your information for a different purpose, we’ll do so in ways consistent with Privacy Law or, wherever possible, by notifying you in advance.

We’ll only use your information for the specific purpose(s) for which it has been provided to us or collected by us.

The type of information collected from you and obtained about you will vary depending on your relationship with us, the service you are requesting and your chosen method of contacting us.

For billing and account management purposes we are likely to ask you to provide:

• Name and address – to verify your identity and help us prevent fraud;
• Contact details (including phone number, e-mail address or social media identifiers) – to contact you about your account, update you about the services you’ve requested or receive from us, inform you about service interruptions, or contact you with other information related to our business;
• Financial information (including method of payment and bank account details) – to bill you for the services you receive from us and manage your payment arrangements.

7. Information we collect or obtain from others about you

We prefer to collect information directly from you so we can ensure it’s as up to date and as accurate as possible. However, we may also collect information about you from other sources.

8. What to expect when you contact us

• assist our response to any account/supply queries you may have;
• ensure we continue to offer you the best possible service;
• maintain standards and help train our customer relationship managers;
• demonstrate our compliance with regulatory obligations; and
• keep our records up to date so that we don’t offer you services that you don’t need.

9. Visiting our website

Each time you visit our website we’ll automatically collect the following information:

• technical information – This includes the Internet protocol (IP) address used to connect your device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;

• Session information - information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

We use website analytical tools on our site for anonymous reporting of site usage.

Third-party links

Our website may also contain links to and from other websites including our partner networks and affiliates. If you follow a link to any of these websites, please note that we do not have control over these websites or their content. These websites have their own privacy policies and we’ll not accept any responsibility or liability for these.  We recommend that you review the website terms and conditions that are applicable to the third-party website.

Information about cookies we use

We use cookies to make our services websites work, or work more efficiently, as well as to collect information.  We may obtain information about your general internet usage by using a cookie file which is stored on your browser, your mobile device or the hard drive of your computer. Cookies contain information that is transferred to your computer's hard drive. They help us to improve our systems site and to deliver a better and more personalised service. Some of the cookies we use are essential for the services site to operate. We’ll not use the data to identify you personally or to make any decisions about you.

10. Capturing images (including CCTV)

We comply with the Home Office Surveillance Camera Code of Practice for all our CCTV usage.  If you have any privacy related concerns about our use of CCTV please contact us by email at Dataprotectionofficer@yorkshirewater.co.uk or by post to Western House, Western Way, Bradford BD6 2SZ.

Visiting our offices

When you sign in to our visitor system at any of our sites your name and other information will be collected.  In certain circumstances (e.g. if you intend to regularly visit our premises, or multiple premises) a photograph may be taken and added to our picture archiving and communication system for identity verification purposes.

Our premises are monitored by CCTV so your image may be captured whenever you enter our site boundary. Where the CCTV is located on our premises but near a public space, it may also record these images.

There are signs to show you when you are entering an area monitored by CCTV. CCTV Images are stored in line with our data retention policy.

If you have an accident or incident involving any Health & Safety matters while you are on any of our premises and this is recorded, it may be kept for the purposes of Health and Safety and insurance requirements.

CCTV on commercial vehicles

Some of our commercial large goods vehicles are fitted with CCTV cameras to improve our drivers’ safety and standards, for improved efficiency, and to help us reduce the risk of fraudulent claims for damages or injury in respect of accidents and incidents.

All the vehicles are fitted with clear signs that CCTV is in operation.

Our use of Unmanned Aerial Vehicles (UAVs or Drones)

We use UAVs on our land, sites and assets throughout the Yorkshire region for a wide range of applications. The use of UAVs helps realise multiple benefits for our business and our customers. Yorkshire Water has its own Civil Aviation Authority (CAA) qualified UAV team and an established framework of fully approved external UAV operators. Most of our UAV operations undertaken for, or on behalf, of Yorkshire Water operate within CAA Visual Line of Sight rules, however, some of our operators have additional permissions granted by the CAA due to their experience and expertise. All of our UAV operations are undertaken in accordance with our data protection policies. In addition, our approved external UAV operators are subject to contractual confidentially agreements as part of the Yorkshire Water operator approval process.

 11. Information we share with others

There may be some circumstances where we need to share some of your information as part of our day to day management of your account and services, to meet our compliance obligations or where we are permitted to under Privacy Law.

Group companies

We may share your personal information with other members of the Kelda Group. We do this to ensure we offer you a comprehensive service across our departments. We may share your personal information with Kelda Group employees and access is controlled in accordance with our Information Security Policies.

The obligations that we have to our Regulators

Sometimes we are contacted by HMRC, the Department for Work and Pensions DWP, the police, local council authorities, fraud agencies or UK Visas and Immigration asking for information about individual customers. Under Privacy Law, we are permitted to share this data with them without your consent and you’ll not be notified that this has been done. This is in the support of the prevention and detection of crime.

Agreements we have with other organisations for sharing information

We share:

•  your payment information (bank account; sort code; direct debit mandates etc) with banking institutions to process your payments;
• (occasionally) your personal data with our legal advisers or our insurance company or other professional advisors to obtain legal advice or make/defend a claim

If we sell or buy any business or assets, or merge with another business entity or carry out internal corporate restructuring, your information may be disclosed to new or prospective business partners or owners or the new corporate entities.

12. Affiliated Partners we use who may have access to your data

We use trusted partners to help us process your personal information and provide services to you including to:

•  process information and provide statistical analysis, management information and IT support. This requires them to process your personal information, and this may happen outside the EEA
• help us process card payments, payment card transactions and to process cheques
•  print customer communications

 13. Where we store your information and how we keep it safe

All customer personal information stored on our corporate systems is kept on secure IT servers. We operate a suite of IT and security policies to ensure your information is kept secure, including appropriate access and auditing controls. 

We use anti-virus software and fire walls to protect against cyber-attack. Unfortunately, the transmission of information via the internet isn’t completely secure. Although we’ll do our best to protect your personal information, we cannot guarantee the security of information you send to us that is outside of our security arrangements; any transmission is at your own risk.

We also operate strict physical security at all our sites and employees all receive security and data protection awareness training.

We may store your personal information on your local device, such as your computer or mobile phone to assist you in your repeated use of our services. We have no control over inappropriate access to this information. You can delete this information at any time using the facilities of your Internet browser

Where we transfer information to third parties to enable them to process it on our behalf (see the information about affiliated partners above), we seek confirmation of their compliance with security industry standards, legal and regulatory requirements.

14. Storing or transferring your information outside the European Economic Area (“EEA”)

We may transfer or store your personal information outside the EEA.  It may be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the provision of support services and management information reporting. Where information is transferred to a country or international organisation outside of the UK / EEA, we’ll comply with the relevant legal rules governing such transfers.

15. How long we’ll keep your information for

We only keep your information for as long as we need it.  We’ll retain certain information (e.g. contact information and bank details) for as long as you have a relationship with us.  Our data retention policy and rules outline these time frames but the length of time depends on the purpose of the processing.

Generally, we’ll keep your account information for up to seven years from account closure (e.g. if you move out of the Yorkshire Water supply area), after which time your personal information will be either deleted or anonymised from closed and finalised accounts.

Retention periods may be extended in certain limited cases as prescribed or permitted by law – e.g. because of an accident or to bring or defend a legal claim.