Privacy

We are United Utilities Group PLC (the Group) which is a group of companies which includes United Utilities Water Limited, the water and wastewater undertaker for the North West of England.

The Group owns and operates a number of companies that look after and are separately responsible for your data (the Data Controllers). Which company or companies are relevant to you will depend on which part of the Group you deal with. If you are a residential customer, then most likely the activities of United Utilities Water Limited will apply to you.

The following is a list of all the Data Controllers within the Group

• United Utilities Utility Solutions Limited 
• United Utilities Utility Solutions (Industrial) Limited 
• United Utilities International Limited
• United Utilities Pensions Trustee Limited
• United Utilities PLC 
• United Utilities Property Services Limited
• United Utilities Healthcare Trustee Limited
• United Utilities Water Limited 
• UU (ESPS) Pensions Trustee Limited
• United Utilities Total Solutions Limited 
• United Utilities Group PLC

All of the above companies have their registered offices at Haweswater House, Lingley Mere Business Park, Lingley Green Avenue, Great Sankey, Warrington, WA5 3LP.

Any reference to “we” or “us” in this notice means any one of the above listed Data Controllers within the Group as relevant to the circumstances.

We may use a number of external third parties who might process your personal data on our behalf, these companies are referred to as ‘Data Processors’. Any Data Processors we use also have their own legal responsibility for handling your data.

This notice relates to the collection and use of the personal data of individuals, sole traders and individuals who are in business partnerships. It does not apply to information we collect or use in relation to companies or other organisations.

It is intended that this Privacy Notice covers:

• Existing, potential and previous customers and those acting on their behalf
• Business Customers whose retail services are provided by a separate water retail company, but whose premises are physically connected to our water and/ or wastewater network
• Suppliers
• Contractors
• Members of Customer Challenge Groups
• Members of Parliament and Members of the European Parliament
• Members of Regional Action Groups
• Members of Environmental Action Groups
• Journalists
• Developers
• Motorists encountered by our staff
• Visitors to our sites (including in vehicles)
• Visitors to our websites
• Shareholders
• Individuals interacting with our Legal Departments
• Individuals who make general enquires about our services
• Any member of the public we deal with whilst exercising our statutory powers/functions'
• Advisors to all of the above or other people providing assistance to them. Our full Employee Privacy Notice can be accessed by our employees via our internal intranet.

We will process the personal data you provide in a manner that accords with current UK data protection laws. We will endeavour to keep your information accurate and up to date, not keep it for longer than is necessary and keep it safe, only permitting access to those who need to use it.

Personal Data which you supply to us may be used in a number of ways. For example, if you are a customer:

• We need to keep records of information such as your name and address so we can contact you to advise of works being carried out or to send bills and other communications
• We may share your information with and obtain information about you from credit reference agencies

We may collect your personal data from anything you have provided us with in “My Account” on our website www.unitedutilities.com or provided over the telephone, in a letter, in any formal process form submitted, e-mail, facsimile, Webchat service, Mobile Application (App), our Contact Us forms and via social media like Twitter and Facebook. We may also access information about you that is already publicly available.

Please note that outbound and inbound calls may be recorded for training and quality purposes.

We also use CCTV cameras on our sites to capture images of people and vehicle identification information such as number plates.

We may also collect personal data given to us if we meet in person for example whilst visiting your home, worksite or business premises.

We also use a number of external companies who act on our behalf to collect your personal data for the purposes identified in this privacy notice.

Pursuant to Section 144 of the Water Industry Act 1991, all occupiers of a property are jointly and severally liable for water charges. To fulfil our obligations under this legislation and in accordance with the Data Protection Act 2018, we engage with named account holders whose details have been supplied to us. In cases where an occupier not named on the water account may also be liable for charges, we may contact them if we can to establish their residency at the property.

Periodically we receive requests for personal data from external Law Enforcement agencies such as the Police and the Department for Work and Pensions which we will use to assist in the prevention, detection, apprehension and prosecution of criminal activity.

Collected personal data will be stored securely on our computer systems, digital voice recordings and, if applicable, on paper files.

To protect the health and safety of field agents and provide an evidential record, in certain circumstances we may record footage of customer interactions via body worn video footage – video images and audio recordings. Our lawful basis for processing your personal data is legitimate interest.

The personal data we process may include:

• Identification data including: - your name, age, contact details (including internet IP address in any communications), date of birth and National Insurance number
• Details of land ownership, or occupancy of any property
• Financial performance data: - data to and from Credit Reference Agencies and bank details
• Services Information: - water usage information, payment details, order history, data to establish your current address
• Video Images: - CCTV footage
• Data about personal circumstances: - in order to safeguard from harm, for example if you are considered to be vulnerable or at risk from harm in any way. This could also include vulnerability data for customers and other members of their household on their behalf. This typically details physical or mental health conditions (see under “Other Processing activities you need to know about” below)
• How your property is connected: - data about how your property is connected to mains water supply, drainage and sewerage networks and performance of those networks such as pressure and flooding history
• Personal information relating to claims: - such as debt, claims or medical history for legal purposes
• Behavioural data: - if there have been incidents of threatening or abusive behaviour
• Data received from and provided to law enforcement agencies: - such as the Police, Department for Work and Pensions, HM Revenues and Customs (HMRC), UK Visas and Immigration
• Environment Agency which we will use to assist in the prevention, detection, apprehension and prosecution of criminal activity

As a water and wastewater business, we have a legal obligation to supply water, maintain water quality, and promote water efficiency in order to maintain adequate drainage and charge by reference to a charges scheme.

These activities are regulated by OFWAT who require us to keep reliable, accurate and up-to-date records of customers’ details as well as any interactions with them related to these regulated services. This also includes taking surveys to improve customer satisfaction.

In order to support the delivery of these services, which are in the public interest, as well as being a legal obligation, we need to process personal data for the following purposes:

• Receiving payment
• Debt recovery (including high court enforcement) 
• Metering
• Dealing with billing enquiries
• Dealing with network enquiries
• Managing network operations (water supply and blockage issues)
• Communication of services
• Fraud prevention and detection of Criminal Activity
• Training
• Listening and addressing concerns to improve services
• Managing legal claims
• Providing requests for information
• Assessing your ability to pay
• In order to exercise any legal powers as a water and wastewater company

We may also need to process your personal data where it is in our or your legitimate interests.

When we need your consent to process your data, we will ask for it and explain why we are processing your data.

You can withdraw your consent at any time. If you do so, we will stop processing your data for the purpose that required your consent. However, this does not mean we will stop processing your data entirely; we may still process it for other purposes that are based on a different legal basis.

Who sees or has access to your personal data will depend on why we need to process it. For example:

Our Customer Services Teams for billing enquiries, operational repairs and complaints

• Our Legal Team for any disputes, complaints and requests for information
• United Utilities Property Services Team and its contractors may require your information for any works which may affect your property in any way
• Our Accounts Payable Team for issuing compensation payments
• Our Developer Services Team and their contractors in relation to connections to your property and our network
• To help manage our functions, our relationships and improve our services, we may also share your personal data as well as receive personal data from third parties associated with the above teams, such as:
• Software providers for our IT systems
• Credit Reference Agencies. Before giving you credit, lenders such as banks, loan companies and shops want to be confident that you can repay the money they lend. To help them do this, they may look at the information held by companies called Credit Reference Agencies. Equifax, Experian and TransUnion, the ICO and major financial services trade associations have developed a common statement, Credit Reference Agency Information Notice (CRAIN), defining the standards that all three major Credit Reference Agencies will apply across all products and services in relation to processing consumer data. Further details can be found about CRAIN at https://www.equifax.co.uk/crain.html and https://www.transunion.co.uk/legal/privacy-centre?#pc-credit-reference
• When we supply your personal information to credit reference agencies they will give us information about you, for example your financial circumstances and financial history. The purpose of this activity may be to check your identity, assess creditworthiness, prevent criminal activity, trace and recover debts and to ensure we make responsible, reliable and fair decisions about our customers. 
• We may share or receive information with the Cabinet Office under the Government Fraud Initiative for the purpose to identifying residents at an address if occupancy hasn’t been disclosed. Click here for more information and the fair processing notice. 
• Regulators such as the Environment Agency, DWI and OFWAT
• We may share information with other Water companies or Utilities which supply services to you (refer to other processing activities below).
• Law enforcement agencies such as the Police or the Department for Work and Pensions
• Lead Local Flood Authorities
• Other third parties providing assistance to our customers, such as translation services and bottled water suppliers for vulnerable customers
• Anyone who carries out work or activities on our behalf, such as providing water saving solutions, a works contractor doing repairs or implementing a construction project and anyone providing business services under contract. 
• If you are a 'non-household customer' (businesses, charities or public sector), your retail services are provided by a separate retailer but we may receive your information from the Market Operator Services Ltd ('MOSL'). Please see the summary of arrangements on the MOSL website for information about how we receive and use information about you. You may find out more about the non-household retail market at http://www.open-water.org.uk/.
• The Department of Work and Pensions (DWP). To proactively support customers and reduce levels of water poverty, we may share your personal data with the DWP to determine if you are eligible for one of our affordability tariffs. We are permitted to do so under the Digital Economy Act 2017.

We strongly advise that you read the contents of our Guide to Data Sharing and Trace Searches with Credit Reference Agencies (PDF 119 KB opens in a new window) and also Your personal data - what you need to know (PDF 268 KB opens in a new window).

We will only ever share your personal data in line with current UK data protection laws.

We will not keep your personal data longer than is necessary. The law and our regulatory requirements determine the length of time information has to be kept. More specific details can be provided on request, refer to the section ‘Your Data Protection Rights’ below.

Although we are a UK company, we may sometimes use organisations outside of the UK where we have contractors working on our behalf, and as part of this they may process your personal data. When this is necessary, we will make sure there are adequate security measures in place to protect your personal data through strict contractual arrangements.

In order to carry out our Priority Service well, United Utilities needs personal information, often sensitive information, about our customers in order to plan and deliver our services.

At United Utilities, we are proud of our strong commitment to having high moral standards in the way that we work. We take our Data Protection duties very seriously and follow strict guidelines to protect your personal information, which is why we created this document to give you the comfort that your information is safe in our hands when you are added to our Priority Services Register (PSR). Click the link below to read our Priority Services Register Privacy Policy.

Priority Services Register Privacy Policy

The information below tells you what data we collect when you have a smart meter installed at your home or business premises, and details of how we keep your smart meter data secure as well as how we use it. This policy should be read in conjunction with United Utilities’ Data Protection and Privacy Policy.

Smart Metering Policy

We take comprehensive organisational and technical security measures to prevent unauthorised access to your personal data. Our security policies and procedures include advanced encryption technologies, regular security audits, and robust firewalls. We also conduct employee training to ensure that our staff is well-versed in the latest data protection practices. Additionally, we have stringent access controls in place, allowing only authorised personnel to handle your information.

When we work with third-party organisations, we require them to comply with our high data protection and security standards. This means they must demonstrate their ability to protect personal data through detailed assessments and adhere to the same security policies and procedures we follow. These requirements are detailed in our contractual agreements with them, ensuring a consistent level of protection across all parties involved in handling your data.

If we need to transfer information outside of the UK or to a country without an adequacy decision from the Information Commissioner, we ensure compliance with relevant laws. This includes adhering to the UK General Data Protection Regulation (UKGDPR). We implement appropriate safeguards, such as international transfer data agreements, transfer risk assessments or binding corporate rules, to ensure that your data receives the same level of protection as it would within the UK and the EU.

We are commitment to maintaining the highest standards of data protection and the serious consequences of failing to uphold these standards. In the event of a data protection breach resulting from non-compliance with our processes or misconduct, we will initiate the appropriate disciplinary action.
We also conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to your rights and freedoms. DPIAs help us identify and mitigate potential risks to your personal data, ensuring that we maintain the highest level of data protection.

New technologies are emerging on the internet that assist us to deliver customised visitor experiences. In particular there is a technology called “cookies” which may be used by us to provide you with customised information from our website. A cookie is an element of data that a website can send to your browser, which may then be stored on your system. Find out more about cookies

Vulnerable persons

In order to provide specific services to vulnerable people we may need to process personal data about you or members of your household with organisations such as Social Services, Housing Associations,  Social Landlords, Public Health England, Law Enforcement Agencies, Local healthcare providers, the Drinking Water Inspectorate, other utility companies and our internal Priority Services teams.

This may include data of a sensitive nature, such as health information (which is known as Special Category or Sensitive Personal Data). We may also share data about your personal circumstances, for example any frailties or relating to a risk of violence. If we need to do this, we will always ensure it is in your vital interests for us to do so or there is a substantial public interest or safeguarding issue.

We will only share limited personal data which is proportionate to the need for sharing it.

Should we need to process data about children (those under 16), we will seek consent from an adult with parental responsibility or any appointed guardian.

Profiling

We may use certain types of personal data collected to help us understand how we can focus on sending you information which is relevant to you or to your circumstances. For example whether you could benefit from having a water meter or a more manageable payment scheme.

Examples of data we use for profiling include, water consumption, ability to pay and demographic data.

We will only use this data to improve your situation and will not pass on your “profile” to any third parties for the purposes of marketing.

Marketing

On occasions we may wish to tell you about products or services we feel would be of benefit or interest to you. These products or services may be provided by us or carefully selected third parties. We may need to share some of your personal data with others in order to do this.

We may need to ask for your consent to share such offers and each time you are contacted with such offers you will be given the opportunity not to receive any more. If you don’t want to be contacted about any offers at all, please contact us by writing to United Utilities, Haweswater House, Lingley Mere Business Park, Lingley Green Avenue, Warrington, WA5 3LP  or please let us know by calling 0345 075 0715.

Please be aware that each year when we issue bills, we are required by our regulators to supply certain information which will be included with your bill.

If you have agreed to receive marketing, products or services from another company and later decide you no longer want these, please contact that company directly to let them know.

Surveys

If you participate in any surveys such as the Water Talk forum, this is used purely for the purposes of feedback to assist us in improving our services. No personal data provided will be used for marketing purposes.

Website

In order for us to monitor and improve our website (www.unitedutilities.com) we may gather information about your use, including details of your domain name and IP address, operating system and browser type for system administration.

Open Banking

If you apply for financial support with payment of your water bill, we undertake an affordability assessment which includes capturing information on your household income and expenditure. Open Banking is completely optional  for affordability assessments and if you choose to provide this information via Open Banking this means we can use your banking data to populate the income and expenditure element of your application.

The provider of the Open Banking Service is ohhMoolah. We will have access to limited transaction information in your current account for the last 30 days. This data will be used to determine your income and support our assessment of your eligibility for different tariffs. We will only use your open banking data with your informed consent, which will be sought from you via a link sent to your mobile phone, or to your email address. This consent is valid for one-time access only. Only the minimum data required to complete the eligibility assessment will be processed and stored for audit purposes.

We do not give your open banking data to any third parties to use for their own purposes. Please refer to the “Who sees your personal data?” section of this Privacy Notice for further details of the categories of organisations your data may be shared with and for what purposes. We will keep the open banking data provided throughout your contract period and for a reasonable period thereafter. After this time, we will delete your open banking data.

Your rights in relation to your open banking data are the same as for any of your data that we collect, store and use. Please refer to the “Your Data Protection Rights” section of this Privacy Notice for further details of your rights.

If you are unhappy with the way we intend to use your open banking data, you can withhold your consent, and we cannot access your data. If you provide consent and are subsequently unhappy with the way we use your open banking data, please refer to the “Who can I contact about my personal data?” section of this Privacy Notice for details of how to contact us.

Social Media

We have pages on social media sites like Twitter, Instagram, Facebook and LinkedIn. 

When you interact with our social media pages, we will collect personal data such as your profile information and user name.  If you choose to communicate or direct message United Utilities any personal data you provide will be stored and processed in line with this privacy policy.

Data Sharing for Joint Water and Sewerage Services

United Utilities may share customer data with other water suppliers to support the accurate delivery of water and/or sewerage services where responsibilities are split between the two providers. This data sharing ensures that customers receive correct billing and uninterrupted service. The legal basis for this data sharing is Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) – processing necessary for the performance of a task carried out in the public interest. In this case, that task is the provision of essential public utility services.

In accordance with current UK data protection law, you have a number of rights relating to the processing of your personal data. These rights include:

• Right of Access – this right entitles you to request a copy of any of the information we hold about you
• Right to be Informed – this right entitles you to request to be provided with details of how we process your personal data, which is covered by this Privacy Notice
• Right to Rectification – this right entitles you to request the correction of any personal data you believe is inaccurate or incomplete
• Right of Erasure - this right entitles you to request the deletion or removal of personal data where there is no reason for its continued processing. This right is also known as the “Right to be Forgotten”
• Right to Restrict Processing – this right entitles you to request no further processing of the personal data that we have previously collected
• Right to Object – this right entitles you to request that your personal data is not processed for specific purposes such as marketing or to challenge the basis of processing your data
• Right to data portability – you have a right to ask for any personal data we hold on you electronically to be sent to another Data Controller of your choice
• Right to withdraw consent – where we have obtained your data with your consent, for example registering for priority services, you have the right to withdraw that consent at any time. However this will not have affected our legal ability to do this before you withdraw your consent

To exercise your rights please see the “Who can I contact about my personal data” section below.

Please be aware that there may be circumstances when we are unable to complete your request to exercise your rights. If this is ever the case, we will inform you of the reason and provide details of how you can register a complaint with the Information Commissioners Office if you believe we have got this wrong.

Should you need to contact us to discuss the handling of your personal data or to submit a request to exercise one of your Data Protection Rights, please contact our Data Protection Team using one of the following methods:

Post: Data Protection Team, United Utilities, Legal Department, Grasmere House, Lingley Mere Business Park, Lingley Green Avenue, Warrington, WA5 3LP

Email: DataProtectionandFraud@uuplc.co.uk

Telephone: 0345 075 0715 and ask to be put through to the Data Protection Team in the Legal Department

If you do need to contact the United Utilities Data Protection Team please email DataProtectionandFraud@uuplc.co.uk.

Should you need to contact the Information Commissioner’s Office please click here to contact us.

Whilst we hope that we can address any questions or concerns you might have, should you need to contact the Information Commissioner’s Office you can do so using one of the following methods:

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113 or 01625 545 745

Website: www.ico.org.