We take the security and use of your personal data very seriously and are committed to complying with data protection legislation. This notice outlines your rights and our responsibilities regarding your personal information. It covers how and why we collect, use and share your information, the legal bases for doing so and how you can exercise your rights as a data subject.
1. Who we are
We are Yorkshire Water Services Ltd trading as SafeMove. We provide conveyancing related searches and asset record maps in Yorkshire. We also facilitate the provision of Yorkshire Water’s asset records as part of their statutory duty. We are part of the Kelda Group.
For the purposes of Privacy Law, the data controller is Yorkshire Water Services Ltd (company number 2366682) registered at Western House, Halifax Road, Bradford BD6 2SZ.
Privacy Law means the Data Protection Act 1998 ([as amended by the Data Protection Act 2018]), the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation (from 25 May 2018) and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority.
We review this notice regularly as part of our internal processes or as our services, activities, or regulatory requirements change. It’s subject to change at any time, but the most up to date version is published here.
This notice is dated [24 May 2018].
3. Contacting Us
By email to Dataprotectionofficer@yorkshirewater.co.uk
By post to Data Protection Officer, Kelda Group, Western House, Halifax Road, Bradford BD6 2SZ
We take any concerns we receive very seriously. If you think our collection or use of your personal information is unfair, misleading or inappropriate, please bring it to our attention. We’ll investigate and respond to your concerns including any additional information or explanations needed We also welcome suggestions for improving our procedures. If you are unhappy with our response you can request our Data Protection Officer to review the case.
The Information Commissioner’s Office (ICO) regulates adherence to Privacy Law. For information, advice or to make a complaint you can:
You have rights relating to your personal information. You can find more information about your privacy rights on the Information Commissioner’s Office website [https://ico.org.uk/].
1.The right to be informed.
You have the right to be informed about how and why we process your personal information
Any time you give us personal information you have the right to be informed about why we need it and how we’ll use it.
You can find most of the information you need in this Privacy Notice.
If you have any questions please contact us.
You have the right to access your personal information
You can request a copy of information we hold about you at any time.
We’ll try to deal with your request informally, for example by providing you with the specific information you need over the telephone providing we have the satisfactory evidence of your identity and the information you are requesting.
You can however formally request access to the personal information we hold about you by getting in touch through any of our customer service channels, but we’ll ask you to provide evidence of your identity before we process your request. We may also contact you to clarify your request or to ensure we have all the information we need to fully meet your request.
Privacy Law requires us to respond to your request within 30 calendar days of verifying your identity (or within three months for more complex cases). You’ll receive a full response as soon as we can reasonably provide one and we aim to resolve all subject access requests within 30 calendar days from confirming your identity. In more complex cases where we cannot provide a full substantive response within that time frame, we’ll write to you within 30 calendar days to explain why an extension is needed.
We don’t charge for subject access requests.
You have the right to ask us to correct inaccurate personal information we hold about you
If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time, through any of our customer service channels. Wherever possible, we’ll correct inaccurate or incomplete information immediately.
In more complex cases we’ll take reasonable steps to confirm the accuracy of the information we hold. Whilst we investigate the accuracy of the information, we’ll restrict the processing of the information in question.
We’ll let you know the outcome of our investigation as soon as we can. Any information we can verify as inaccurate will be corrected within one month of receiving your request.
You have the right to ask us to delete your personal information
In some circumstances you have the right to ask us to delete information we hold about you. For example, if we have asked for your consent to process the information, and you withdraw that consent.
We’ll respond to your request as soon as we can and we’ll act on any requests granted within one month of your request.
We can’t delete any information where we have a legal or regulatory obligation to keep it. This applies to all outstanding debts or anything in connection with our Water Supply Licence (e.g. water quality concerns related to the water supply for your property. We may also refuse your request if we believe it to be excessive. If your request for deletion is refused, we’ll explain the reasons for refusal.
You have the right to ask us to restrict the use of your personal information
In some instances, you have the right to ask us to restrict the use of your personal information (for example if you’ve challenged the accuracy of the information we hold, or have objected to our processing). We’ll restrict our use of your information whilst we investigate your objection or request to correct your information.
We’ll respond to your request as soon as we can and we’ll act on any requests within one month of your request.
If your objection is unsuccessful, we’ll only continue processing once we’ve let you know the outcome of the investigation.
When processing is restricted, we are still permitted to store your personal data, but not use it. Information related to these requests will not be automatically deleted unless you expressly ask us to.
You have the right to data portability
You have the right to move, transfer or copy data to another system for your own purposes. However, this right only applies where processing is automated and consent based.
7. The right to object
You have the right to ask us not to process your personal information.
We process most of the information we collect about you under the lawful basis of ‘Public Task’ or ‘Consent’. You have the right to object to our processing your personal information under these lawful bases (including for marketing purposes and profiling).
We will respond to your objection as soon as we can, detailing any actions we can reasonably make. If we believe there is an overriding compelling reason to continue the processing, we will explain why we think this is.
We’ll action any requests to stop direct marketing as soon as we receive your objection.
You can object to us using your data at any time through any of our contact channels.
In most cases, you have the right not to be subject to a decision based solely on automated processing, including profiling, which has an adverse effect on you.
We will consider any requests regarding automated decision making, including profiling, as soon as we receive your request.
Privacy Law states we must have a lawful basis for processing your information. We have identified the legal bases on which we process your information, and this varies depending on how and why we have your information. The legal bases we use are:
To provide our services to you, we need to collect, process and store information about you that may be personal or sensitive in nature. If we intend to use your information for a different purpose, we’ll do so in ways consistent with Privacy Law or, wherever possible, by notifying you in advance.
We’ll only use your information for the specific purpose(s) for which it has been provided to us or collected by us.
We collect and process a variety of information from you and about you. In most cases, the information we collect about you is provided by you directly. This is one of the ways we can ensure the information we collect is as accurate and up to date as possible. We’ll usually do this when you first contact us, and we may ask you to confirm your details on subsequent contacts from time to time. We use your information to manage your account, improve and develop our business generally and to enforce our legal rights. If we intend to use your information for a different purpose, we’ll do so in ways consistent with Privacy Law or, wherever possible, by notifying you in advance.
We’ll only use your information for the specific purpose(s) for which it has been provided to us or collected by us.
The type of information collected from you and obtained about you will vary depending on your relationship with us, the service you are requesting and your chosen method of contacting us.
For billing and account management purposes we are likely to ask you to provide:
7. Information we collect or obtain from others about you
We prefer to collect information directly from you so we can ensure it’s as up to date and as accurate as possible. However, we may also collect information about you from other sources.
8. What to expect when you contact us
If you contact us in writing (including e-mail, social media or via our website) we’ll record, monitor or keep copies of the correspondence. We keep this information for a number of reasons (including fraud prevention and crime recording/investigation) but the main reasons are to:
Making a complaint
If you make a complaint to us, we’ll follow our complaints process https://www.safe-move.co.uk/faqs/ . We may need to share details about your complaint internally to fully investigate.
If the complaint relates to a service provided by a third party, we’ll share information with them in order to resolve your complaint. If you don’t want information identifying you to be disclosed, we’ll try not to disclose this. However, it may not be possible to handle a complaint on an anonymous basis.
We’ll only use the personal information we collect to process the complaint and to check on the level of service we provide.
We’ll keep complaints in line with our data retention policy.
Each time you visit our website we’ll automatically collect the following information:
We use website analytical tools on our site for anonymous reporting of site usage.
Our website may also contain links to and from other websites including our partner networks and affiliates. If you follow a link to any of these websites, please note that we do not have control over these websites or their content. These websites have their own privacy policies and we’ll not accept any responsibility or liability for these. We recommend that you review the website terms and conditions that are applicable to the third-party website.
Information about cookies we use
10. Capturing images (including CCTV)
We comply with the Home Office Surveillance Camera Code of Practice for all our CCTV usage. If you have any privacy related concerns about our use of CCTV please contact us by email at Dataprotectionofficer@yorkshirewater.co.uk or by post to Western House, Western Way, Bradford BD6 2SZ.
Visiting our offices
When you sign in to our visitor system at any of our sites your name and other information will be collected. In certain circumstances (e.g. if you intend to regularly visit our premises, or multiple premises) a photograph may be taken and added to our picture archiving and communication system for identity verification purposes.
Our premises are monitored by CCTV so your image may be captured whenever you enter our site boundary. Where the CCTV is located on our premises but near a public space, it may also record these images.
There are signs to show you when you are entering an area monitored by CCTV. CCTV Images are stored in line with our data retention policy.
If you have an accident or incident involving any Health & Safety matters while you are on any of our premises and this is recorded, it may be kept for the purposes of Health and Safety and insurance requirements.
CCTV on commercial vehicles
Some of our commercial large goods vehicles are fitted with CCTV cameras to improve our drivers’ safety and standards, for improved efficiency, and to help us reduce the risk of fraudulent claims for damages or injury in respect of accidents and incidents.
All the vehicles are fitted with clear signs that CCTV is in operation.
Our use of Unmanned Aerial Vehicles (UAVs or Drones)
We use UAVs on our land, sites and assets throughout the Yorkshire region for a wide range of applications. The use of UAVs helps realise multiple benefits for our business and our customers. Yorkshire Water has its own Civil Aviation Authority (CAA) qualified UAV team and an established framework of fully approved external UAV operators. Most of our UAV operations undertaken for, or on behalf, of Yorkshire Water operate within CAA Visual Line of Sight rules, however, some of our operators have additional permissions granted by the CAA due to their experience and expertise. All of our UAV operations are undertaken in accordance with our data protection policies. In addition, our approved external UAV operators are subject to contractual confidentially agreements as part of the Yorkshire Water operator approval process.
11. Information we share with others
There may be some circumstances where we need to share some of your information as part of our day to day management of your account and services, to meet our compliance obligations or where we are permitted to under Privacy Law.
We may share your personal information with other members of the Kelda Group. We do this to ensure we offer you a comprehensive service across our departments. We may share your personal information with Kelda Group employees and access is controlled in accordance with our Information Security Policies.
The obligations that we have to our Regulators
Sometimes we are contacted by HMRC, the Department for Work and Pensions DWP, the police, local council authorities, fraud agencies or UK Visas and Immigration asking for information about individual customers. Under Privacy Law, we are permitted to share this data with them without your consent and you’ll not be notified that this has been done. This is in the support of the prevention and detection of crime.
Agreements we have with other organisations for sharing information
If we sell or buy any business or assets, or merge with another business entity or carry out internal corporate restructuring, your information may be disclosed to new or prospective business partners or owners or the new corporate entities.
12. Affiliated Partners we use who may have access to your data
We use trusted partners to help us process your personal information and provide services to you including to:
13. Where we store your information and how we keep it safe
All customer personal information stored on our corporate systems is kept on secure IT servers. We operate a suite of IT and security policies to ensure your information is kept secure, including appropriate access and auditing controls.
We use anti-virus software and fire walls to protect against cyber-attack. Unfortunately, the transmission of information via the internet isn’t completely secure. Although we’ll do our best to protect your personal information, we cannot guarantee the security of information you send to us that is outside of our security arrangements; any transmission is at your own risk.
We also operate strict physical security at all our sites and employees all receive security and data protection awareness training.
We may store your personal information on your local device, such as your computer or mobile phone to assist you in your repeated use of our services. We have no control over inappropriate access to this information. You can delete this information at any time using the facilities of your Internet browser
Where we transfer information to third parties to enable them to process it on our behalf (see the information about affiliated partners above), we seek confirmation of their compliance with security industry standards, legal and regulatory requirements.
14. Storing or transferring your information outside the European Economic Area (“EEA”)
We may transfer or store your personal information outside the EEA. It may be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the provision of support services and management information reporting. Where information is transferred to a country or international organisation outside of the UK / EEA, we’ll comply with the relevant legal rules governing such transfers.
15. How long we’ll keep your information for
We only keep your information for as long as we need it. We’ll retain certain information (e.g. contact information and bank details) for as long as you have a relationship with us. Our data retention policy and rules outline these time frames but the length of time depends on the purpose of the processing.
Generally, we’ll keep your account information for up to seven years from account closure (e.g. if you move out of the Yorkshire Water supply area), after which time your personal information will be either deleted or anonymised from closed and finalised accounts.
Retention periods may be extended in certain limited cases as prescribed or permitted by law – e.g. because of an accident or to bring or defend a legal claim.