Issue date 26 July 2023, version 4.1
Who we are
We are South Staffordshire Water Plc, registered in England & Wales with company number 02662742 with our registered office at Green Lane, Walsall, WS2 7PD. We are registered as a Data Controller (registration number Z6670622) with the Information Commissioner’s Office.
We provide our customers with clean water services. To our customers in the West Midlands, South Staffordshire and South Derbyshire we are known as South Staffs Water and to our customers in the Cambridge region we are known as Cambridge Water.
We are part of the South Staffordshire Plc group of companies (“Group”). You can find details about the other companies in our Group here.
Any reference in this privacy notice to “we”, “us” or “our” is a reference to South Staffordshire Water Plc.
This privacy notice applies to any person who provides personal data to us when making contact with us or a third party who shares personal data with us, or when using any of our services.
Please take some time to read this privacy notice which applies to the personal data we collect about you. It explains how we collect and process your personal data and tells you about the rights you have.
If we change our privacy notice we will post an up-to-date version on our website so we encourage you to visit this page this page on a regular basis. and We will let you know about any important changes.
For our cookie notice click here.
This privacy notice contains information on:
- Personal data we collect about you
- How we collect your personal data
- Why we collect your personal data and our lawful basis for processing
- Information we share with others
- Credit Reference Agencies
- Automated Decision Making and Profiling
- CCTV and mobile recording devices
- Use of our company drones
- Call recording
- How we look after your personal information
- Use of our website and mobile applications
- Where your personal data may be processed
- How long we keep your information for
- Your Rights
- Contact Us
Please click on any link to move to a specific section below.
Personal data we collect about you
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity of an individual has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together and have provided examples as follows:
- Identity Information: includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, national insurance number, video images (including CCTV and other mobile device footage);
- Contact Information: includes billing address, home address, email address and mobile and landline telephone numbers, landlord contacts details (if applicable);
- Financial Information: includes bank account and payment card details (payment card details are not recorded once the payment has been completed);your credit history which we obtain from Credit Reference Agencies, fraud checks and CCJs;
- Account Information: includes details about your billing and payment history, other details of services we provide to you, the way you manage your account with us, income, and expenditure details, benefit information, complaints, job details, household details, property type, operational investigations, repairs, interruptions to supply, planned maintenance, meter details, claims, incident details, tariff details;
- Technical Information: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website. Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); and any phone number used to call our customer service number;
- Device Information: includes the type of device you use, a unique device identifier (for example: your device’s IMEI number, the MAC address of the device’s wireless network interface, or the mobile phone number used by the device), the type of mobile browser you use, and time zone setting. We collect this information via the Microsoft App Centre.
- Location Information: includes your current location disclosed by GPS or other technology to enable you to use location-enable services on our website and mobile application. You can withdraw your consent at any time by disabling the location data in your device settings.
- Transactional Information: includes details about payments made from you to us through our website, mobile application, your bank, PayPoint, by telephone call to our contact centre or in person.
- Profile Information: includes your username and password, purchases or orders made by you, your interests, preferences, feedback, comments, survey responses and responses to competitions you may enter;
- Usage Information: includes information about how you use our website and mobile application, products and services, information about your water consumption and usage which we collect from our meters, current and historical water data usage;
- Marketing and Communications Information: includes your preferences in receiving marketing from us and our the third parties we refer to below, and your communication preferences; and
- Vulnerability Information: includes information about you or a member of your household’s physical or mental health conditions, or disabilities where you have applied for specific tariffs or schemes such as WaterSure and our Assure Tariff, or to register you on our Priority Services Register.
We also collect, use and share aggregated data such as statistical or demographic data. Aggregated data may be derived from your personal data but is not considered personal data as it does not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be processed in accordance with this privacy notice.
We collect personal data in a number of different ways and from a variety of sources.
We will collect information directly from you when you:
- contact us through our website or mobile application, by telephone, post or email or fill in forms we provide to you and when we visit your home or premises;
- register with us and set up an account to receive our services;
- access or use our services on our website or mobile application;
- use our services or communicate with us about our services;
- sign up to participate in our information sharing community online forums such as H2Online;
- visit our premises or receive services where we use recording devices such as CCTV and mobile cameras;
- use our voice activated application Alexa Skill or mobile applications or our social media platforms such as Twitter, Instagram and Facebook;
- or enter a competition, promotion or survey.
We may receive or collect information about you from third parties such as:
- other members of your family or persons authorised to act on your behalf;
- landlords (including Landlord Tap) where you are a tenant;
- landowners, estate agents and property developers;
- social services and medical professionals in relation to customers who are registered on our Priority Services Register or apply to receive our social tariffs;
- housing associations and local authorities who assist us in providing our social tariffs and provide us with information to help us to keep your account details accurate and up to date;
- other utilities such as Anglian Water Limited and Severn Trent Services Limited who provide sewerage and waste services to you;
- our business partners, subcontractors and suppliers in connection with the delivery of services such as fixing leaks;
- service partners who provide or help us to provide you with water efficient products and services, such as Homeserve Membership Limited;
- if someone makes a complaint about a water leak or notifies us that a property is empty;
- from other members of our Group who assist us in managing your account and providing services to you;
- from benefits agencies to assist us in assessing applications for social tariffs, our Watersure scheme, debt management and recovery;
- the Consumer Council for Water, Ofwat and WATRS where we are dealing with complaints or queries raised with them;
- priority services information provided by other utility companies;
- law enforcement agencies, the Police, the Department for Work and Pensions, HM Revenue & Customs, fraud prevention agencies and credit reference agencies; and
- third party data and insight providers who provide us with relevant information about you, which we use to ensure that your personal data is accurate and up to date, to help us operate our business and deliver services to you.
We may also collect information from publicly available sources such as:
- the electoral roll;
- Companies House;
- the Register of county court judgments;
- the Register of bankruptcies; and
- the Land Registry.
Why we collect your personal data and our lawful basis for processing
We collect, use, store and transfer your personal data for a number of different purposes and the law requires us to have a lawful basis for processing your personal data. Primarily as a water business we have a legal obligation to supply water, maintain our networks, maintain water quality and charge for our services. We are required to keep reliable and accurate records of all of our communications with our customers. Our activities are also in the public interest and sometimes we process personal data where it is in our legitimate interest. The table below sets out the lawful basis that we use.
Lawful basis for processing
We may need to share your personal data with other third parties as follows:
Types of third parties
Our Group & Employees
We share your personal data with our employees and other companies within our Group, so that we can manage your account and provide you with services.
We have legal and regulatory obligations to share personal data with our regulators, such as, Ofwat, the Department for Environment, Food and Rural Affairs, the Drinking Water Inspectorate, the Consumer Council for Water, the Water Redress Scheme and the Environment Agency.
All of our customers may have their contact information shared with Ofwat and third parties working on their behalf for the purpose of the following customer surveys: Service Incentive Mechanism (SIM), Customer Measure of Experience (C-Mex) and Developer Services measure of Experience – for developers only (D-Mex). You may be contacted by third parties on Ofwat’s behalf about the service you receive from us. This is not a direct marketing call and we have a statutory obligation to share your personal data.
Law Enforcement Agencies
Where we are contacted by HM Revenue & Customs, the Department for Work and Pensions, the police and other similar agencies, we may be required to process personal data for the purposes of law enforcement.
MOSL & Retailers
If you are a non-household customer (businesses, charities or public sector) we will share information with your retailer and with Market Operator Services Limited (“MOSL”) who operate the Central Marketing Systems for the non-household retail market as part of OpenWater. In so far as this comprises personal data we have a legal obligation to share this information.
Pennon Water Services Limited (“PWSL”) is a joint venture between South Staffordshire Plc and Pennon Group Limited and operates as a retailer. We share information with PWSL on the same basis as with any other retailer.
Water & sewerage companies
Customers in our supply area receive sewerage services from Severn Trent Water Limited or Anglian Water Limited. We share personal data with these companies for billing purposes and to manage sewerage services under a legal obligation. We also provide both companies with billing services and act as data processors on their behalf.
Credit Reference Agencies
We may share your personal data with and receive personal data from Credit Reference Agencies (“CRAs”) as part of our legitimate interest in managing our business and preventing fraud. More information is available in the section “Credit Reference Agencies” below.
We use carefully selected third parties to help us process your personal data and provide services to you. When we work with third parties they are required to comply with our instructions and provide us with enforceable assurances that they comply with data protection laws. We work with the following categories of service partners:
Other third parties
We may also share your personal data with:
We will share your Identity, Contact, Financial and Transactional Information with CRA’s and they will share this data with us under the terms of their own privacy policies.
We will also share details of your settled accounts and any debts not fully repaid on time.
We will use this personal data to assess your account, inform us in deciding what payment terms are most appropriate to you, make sure the information we hold about you is up to date and accurate, verify your identity, manage your account with us, trace and recover debts and to help detect and prevent criminal activity and fraud.
When CRAs receive a search request from us they may place a search footprint on your credit file that may be seen by other lenders. They provide us with public and shared credit and fraud information, including:
- in relation to your personal accounts with us and your accounts with other organisations such as other utility companies;
- information about a spouse or partner whom you have advised is jointly liable for account payments and;
- where you are the owner, director or partner in a small business, information about your business.
Because we will link your record with that of a spouse or partner you advise us about you must ensure that you have their permission to disclose information about them.
If you owe us money and do not repay in accordance with our terms we will notify our credit reference agency. This could result in your credit rating being negatively impacted.
Further information about the CRAs and the way in which they process and share personal data can be found in the Credit Reference Agency Information Notice here.
The main CRAs that we use are listed below together with links to their privacy notices:
We have a statutory duty to promote water efficiency and use a number of methods to do this, including direct marketing. This may include products and services that we provide or that are provided by a third party such as Homeserve Membership Limited and Save Water Save Money Limited. From time to time we may also tell you about products, services or offers which we provide that we think may interest you. We rely on our legitimate interests to do this. We will never sell your personal data to marketing companies.
Our communications regarding market research are not direct marketing, and do not require your consent.
If at any time you wish to stop receiving marketing or communications regarding market research from us please contact us using any of the methods described in our Contact Us section below, or use the link or contact details referred to in the communication that you receive from us. Please also refer to Your Rights below.
Please note you may still receive general non-personalised marketing material and information which we are required to provide to you by our regulator Ofwat which will be included with your bill.
We do not carry out any automated decision making.
We carry out limited profiling activities in order to communicate with you better, and in relation to, for example, understanding water consumption, demographic data and ability to pay. This helps us to improve the customer experience and provide you with information that may assist you, for example, whether you would benefit from a water meter. If you object to such profiling activities please inform us using any of the methods described in our Contact Us section below.
CCTV and mobile recording devices
Our sites (including car parks) may be monitored by CCTV and personal data (for example your image and vehicle registration) may be recorded. We record this data for the safety of our personnel and visitors and for the prevention and detection of crime
Our employees and our service provider’s employees may be equipped with and operate “body cameras” and “dash cams” may be located in their vehicles, so that work can be recorded for the security and safety of those employees and for the prevention and detection of crime.
Further information on our CCTV and recording devices policy is available from us through any of the methods described in our Contact Us section below.
We operate drones fitted with cameras that can be switched on remotely to record images of our sites and assets. The images are processed for the inspection of apparatus, and for mapping and managing our network and infrastructure.
We rely on our legitimate interests to capture these images. We retain the images for no longer than is required for the purpose for which the images are being recorded, we may keep inspection images indefinitely.
The drones are operated by a licensed and qualified drone pilot. When a drone is used we ensure that the appropriate signage is displayed to advise visitors to the site. The drone is always kept within the pilot’s visual line of sight. Drones are operated on land owned by us or our Group or where we have the express permission of the landowner and in accordance with all drone regulations.
If you have any concerns relating to privacy and the use of our drones please contact us using any of the methods described in the Contact Us section below.
We, our Group and the service provider managing our customer contact centre may monitor and record calls for quality, security and training purposes.
When we collect information about you we ensure that we minimise what we collect, but we also try to collect enough accurate and up-to-date personal information to ensure that you can receive our products and services.
We take appropriate care to secure the information we hold about you. We have implemented appropriate organisational and technical security measures to protect your information, such as passwords and information encryption. We also have policies and procedures in place to ensure that there is no unauthorised access to your personal data.
We take seriously our obligations towards your privacy and the protection of information we may hold about you. Whenever we share your personal information we work to ensure it is protected from misuse or loss in accordance with data protection law.Use of our website and mobile applications
Although we will do our best to protect your personal information once it is within our control, we cannot guarantee the security of your data transmitted to our website or mobile application; any transmission is at your own risk.
Our website and mobile application contains links to third party websites. If you follow a link to any of the websites provided by a third party, we will not be responsible for the content and privacy practices of that third party and we accept no liability for those third party websites. Please note that your use of a third party website will be subject to the terms and conditions and privacy notices of that third party.
Sometimes we will need to share your personal data with third party data processors in countries that are outside of the European Economic Area (EEA). Where this happens we put adequate safeguards in place to ensure that your data receives the same level of protection as if it were being processed inside the EEA. Please contact us if you would like further information on the specific mechanism we apply when transferring your personal data out of the EEA.
We will retain your information for as long as we need it depending on the purpose for which your personal data has been processed.
Generally we will keep your information for as long as you are a customer and for a period of 6 years after your account has been closed. Your personal information will then either be deleted or anonymised.
In certain circumstances, we may be required to retain your personal information for longer where such retention is required by law or record keeping requirements, including managing our relationship with you, defending any claims, or for tax purposes.
Access: You always have the right to access your personal data and to be provided with copies of it. You may not always receive copies of all of your personal data, for example where requests are excessive, or where it would require disclosure of someone else’s personal data that we do not have their consent to disclose.
Your request is known as a data subject access request (“SAR”) and we have a standard form which you can complete to make it easier for you to make a SAR request. You do not have to use this form but you may find it convenient to.
Rectification: You always have the right to request that we correct any inaccuracies, or complete any gaps, in your personal data.
Erasure: In certain circumstances you may request that we erase your personal data, for example where we no longer need to hold it. The right is not absolute and we can continue to hold your data where, for example, we are legally obliged to retain it
Restriction: In certain circumstances you may request that we restrict the processing of your personal data, for example where you have made, but we have not yet actioned, a request to correct an inaccuracy. However we may continue to use data if, for example, its use it is to protect another person’s rights, or there are public interest reasons for doing so.
Portability: In certain circumstances you have the right to receive the personal data which you have provided to us, including data we collect from your interactions with us and our services, and which we process by automated means. You can also request that this data is transferred to another organisation. This right applies where we are processing data on the basis of your consent or because it is necessary for a contract you have with us.
Objection: Where our processing of your personal data is based on legitimate interests you can object to this processing at any time. However you should be aware that we may still be entitled to continue to process the data where this does not override your interests, rights and freedoms or if the processing is necessary for us to establish, exercise or defend a legal claim.
Where we are processing your personal data (including profiling) for direct marketing purposes, you have the right to object to that processing and if you do we will not process your data any further for those purposes.You may also choose how we contact you for direct marketing – we will only contact you by electronic means where we have your consent, and you can change your preferences for electronic marketing at any time by contacting us or following the link in the communication you receive.
Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know.
Where you exercise any of these rights we will respond to you, in most cases, within one month of your request and you will not be required to pay a fee. However, if there are circumstances where we are unable to complete your request within one month (where this is a legal obligation), or at all, or a fee is payable, we will inform you of the reasons and provide details of how you can register a complaint with the Information Commissioners Office.
To exercise any of your rights or request a SAR form please contact us using any of the methods referred to in the Contact Us section below.
You can contact us by:
Calling us: 0345 60 70 456 and asking for the Data Protection Officer.
We take our responsibilities in relation to personal data very seriously, so please contact us if you have any concerns about how we are processing your personal data.
You can also contact the Information Commissioners Office at www.ico.org.uk, by writing to them at Wycliffe House Water Lane, Wilmslow, Cheshire, SK9 5AF or by phone on 0303 123 1113 for further information or advice, or if we have not addressed your concerns and you would like to make a complaint.
A cookie is a small text file that are placed on your computer or mobile device when you visit our website.
We use the following cookies
- Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
- Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
- Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
You can find more information about the individual cookies we use and the purposes for which we use them in the table below:
This cookie enables the user to use the functionality on the website
At the end of the session
Strictly necessary cookie
A strictly necessary cookie which ensures that the user's session is secure.
At the end of the session
Oracle strictly necessary cookie.
At the end of the session
An analytical cookie used to distinguish users from each other.
Google analytical cookie
These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. Click here for an overview of privacy at Google
Click here to opt out of being tracked by Google Analytics across all websites.
MyAccount notification cookie
This cookie enables notifications to appear in MyAccount to display necessary information relating to online services.
It will be deleted when browser is closed.
Third party cookies
How do I change my cookie settings?
You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies.
However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site and you will not be able to purchase products.
Find out how to manage cookies on popular browsers:
To find information relating to other browsers, visit the browser developer's website.