Pennon Water Services Ltd Privacy Notice

At Source for Business (SfB) a trading brand of Pennon Water Services Limited (PWS), we are committed to protecting and respecting your privacy. This notice, together with our websites’ terms of use and any other documents referred to therein, sets out how we use and protect your Personal Data. 

This Privacy Notice will help you understand your privacy rights, how and why we need to process your Personal Data, and how you can get in touch with us if you need to. Processing Personal Data involves any activity to do with that data, for example collection, storage, editing and deletion.

We have presented this information in different sections so you can access the information you need more easily. You will find our general privacy information under the headings below to cover the different types of individuals whose data we use.  We encourage you to read each section thoroughly.

We take your Personal Data privacy very seriously and we are committed to protecting your Personal Data by complying with the relevant privacy legislation (including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018).

We also endeavour to follow relevant industry Best Practice, Codes of Practice and Guidance, such as ICO’s Data Sharing Code of Practice.  

We frequently review and update this Privacy Notice to reflect changes in our services, as well as to comply with changes in Data Protection Laws and Legislation. We would, therefore, encourage you to review this Notice on a regular basis and if we make any significant changes impacting your privacy, we will make this clear on our website; please remember to check back from time to time.

We use some formal terms in this Notice, such as Data Subject, Personal Data and Data Controller.  For an explanation of these terms, please see 3. Definitions and phrases used in this Notice below. 

We are Source for Business (SfB) a trading brand of Pennon Water Services Limited (PWS) and may describe ourselves as “We” & “PWS” in this notice.  We are business water specialists providing exceptional customer service and reliable water and wastewater services across the UK for all business customers’ water management needs.

We are a company registered in England and Wales under number 09902835 with our registered office at Peninsula House, Rydon Lane, Exeter, Devon, EX2 7HR.  PWS is part of a group of companies owned by Pennon Group Plc. In addition to PWS, some of the other companies in the Pennon Group will look after and process your Personal Data. Some of these companies are separately responsible for your data (referred to as Data Controllers) and some carry out processing on our behalf (referred to as Data Processors).

For the purposes of Data Protection laws, PWS is the Data Controller of Personal Data. This means that we make decisions about how and why we process your Personal Data, and, because of this, we are responsible for making sure your Personal Data is only used in accordance with those Data Protection laws.  When we work with third-party companies, like Paragon, our print and post providers, they will process your Personal Data on our behalf. These companies are referred to as ‘data processors’. When we use data processors, they will use your Personal Data on our behalf but only for the services and limited purpose that we instruct them to use it. When we use data processors, we remain responsible, as a controller, for compliance with all data protection legislation. 

More detail about our working with third parties is detailed in 10. Who will see your personal data below. 

If you would like more information about this Privacy Notice, have any comments or observations about it (or about the way that we handle your Personal Data), or if you would like to exercise any of your Data Subject Rights, or want to contact us about how we process your Personal Data, please see the section 18. Who can I contact about my personal data below. 

Whilst we would prefer you to contact us first, you can also contact the Information Commissioner’s Office via ico.org.uk or 0303 123 1113 for information, advice or to make a complaint.

As mentioned above, we use various formal expressions or phrases in this Privacy Notice.  Below is an explanation of these and what they mean within this Notice:

Data Controller - The data controller determines the purposes for which and the means by which Personal Data is processed. PWS is considered to be a data controller for most of the Personal Data it holds.  There are some circumstances where we might be a” joint controller” with another party, Ofwat or other regulated bodies, but PWS will remain liable to you in how we use your Personal Data.

Data Subject - A Data Subject is an individual - any person whose Personal Data is being collected, held, or processed. For example, Sole Trade customers will be a Data Subject.

Data Processor - A data processor is responsible for processing Personal Data on behalf of a controller.  For example, where we have used a third-party as a data processor to provide us with bill processing services, PWS would be the controller and the third-party would be our data processor.

Personal Data - Personal Data is any information which is related to an identified or identifiable natural person.  (Full definition provided in Article 4 of the UK GDPR).

Processing - Any operation or set of operations which is performed on Personal Data or on sets of Personal Data (whether or not by automated means, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction).

This notice relates to the collection and use (Processing) of the Personal Data of sole traders and individuals who are in business partnerships. It does not apply to commercial information we collect or use in relation to companies or other organisations.

It is intended that this Notice covers:

• Existing, potential, and previous customers and those acting on their behalf.
• Suppliers and contractors.
• Members of Customer Challenge Groups.
• Members of Parliament and Members of the European Parliament.
• Members of Regional Action Groups.
• Members of Environmental Action Groups.
• Motorists encountered by our staff.
• Visitors to our sites (including in vehicles).
• Visitors to our websites.
• Individuals interacting with our legal department.
• Individuals who make general enquiries about our services.
• Advisors to all of the above or other people providing assistance to them.
• Other individuals not listed above who interact with us or our sites.

This Notice does not apply to how we process Personal Data relating to our employees, former employees, pensioners, agency staff or contractors (or their employees).

We collect Personal Data in a number of direct and indirect ways.  These for example include:

• Anything you have provided us within "MyAccount", on our website, provided over the telephone, in a letter, e-mail, via social media like Twitter and Facebook, or any other communications channel. We may also access information about you that is already publicly available.
• Outbound and inbound calls through our customer services lines, which are recorded for training and quality purposes (subject to available recording capacity).
• CCTV cameras on our sites.
• All visitors, who may be subject to surveillance for the purposes of safety and crime prevention. Recorded material may be used in the monitoring, prevention and investigation of Health & Safety incidents and crimes and bringing crimes to justice.
• The collection of Personal Data given to us if we meet in person for example whilst visiting your worksite, business premises; or if you come to one of our sites, we will collect visitor signing-in data for Health and Safety purposes.
• From time to time, customers provide us with photographs or videos they have taken to assist in reporting concerns they might have and have requested that we follow up.

In addition, we collect your Personal Data from third parties, for example, from:

• Individuals that have permission to contact us on your behalf.
• New residents of a former supply address, estate/letting agents or solicitors acting on behalf of you or a new resident of a former supply address, for example, where you are moving premises and the third-party is providing a forwarding address (with or without your consent).
• The landlord of your supply address.
• Our regulators OFWAT, Water Industry Commission for Scotland (WICS), the Drinking Water Inspectorate, the Environment Agency and the Information Commissioner’s Office.
• Other bodies – The Consumer Council for Water (CCW), Central Market Agency Scotland (CMA) & the Market Operator Services Limited (MOSL)
• Law enforcement agencies.
• Other water and sewerage companies where required for the supply of water or sewerage services to your supply address.
• Credit reference and tracing agencies, for example, where it has not been possible to identify the person responsible for payment of water or services charges.
• Other organisations or individuals not listed above who interact with us and provide us with data.

The Personal Data that we process about you will depend on the type of relationship that we have with you (for example, if you are a customer, this will be different from Personal Data we hold about visitors to our sites).

However, generally for customers and others, we collect and process the following data about you:

• Identification and contact data: this would include your title, name, and contact details such as your email address and mobile telephone number.
• Information about your customer account: this would include your supply address, correspondence address, billing address, water meter serial number and water usage, information required to estimate water usage and customer contact/complaints history.
• Payment information: this would include transaction records of payments made in connection with your PWS customer account and details of your bank account for set up of direct debits. 
• Delegated Authority: including powers of attorney or people you have authorised to discuss your account, for example. partner, adult children, solicitor etc.
• Supply network information: this means information relating to the supply address that is necessary for the supply of water and sewerage services such as location of network infrastructure present on or near to the supply address and the maintenance and repair history.
• Financial performance data means information received from and provided to credit reference agencies.
• Behavioural information: if there has been any vexatious or abusive behaviour made towards PWS staff, contractors, or agents.
• Data received from and provided to law enforcement agencies: this means information to assist in the prevention, detection, apprehension, and prosecution of criminal activity from agencies such as the Police, Department for Work and Pensions, HM Revenues and Customs (HMRC), UK Visas and Immigration and the Environment Agency.
• Websites tracking information: this means details of transactions you carry out through our websites and details of your visits to our websites.
• Preference information: this means any opt in or opt out preferences that you have provided us with, confirming whether you wish to receive information regarding marketing and information that may be of interest to you.
• Photographic and video data: this means all data collected through our interactions with you, through site visits, from CCTV cameras and or signing-in when you visit our sites, when you contact our retail service centres and provide us with data.
• Survey Information: this means information you provide as part of customer or stakeholder surveys.

We are required by law to always have a permitted reason or justification (called a “lawful basis”) for processing your Personal Data.  We only process your Personal Data if we have a lawful basis to do so, if the processing is necessary, reasonable, and proportionate, and in accordance with the way in which we describe in this Privacy Notice. 

Depending on the processing activity, we may use one or more of the following lawful bases for processing your data:

• Consent: where you have given consent for the processing, e.g. to receive direct marketing communications.
• Contract: where processing is necessary for the performance of a contract, e.g. our contract with you.
• Legal obligation: where processing is necessary to comply with our legal obligations.
• Vital interests: where processing is needed to protect your vital interests or those of another person.
• Public tasks: where processing is needed for PWS to perform a task in the public interest or for our official functions.
• Legitimate interests: where processing is needed for our legitimate interests or those of a third party unless on balance, these are outweighed by the need to protect your individual rights.

As your water and/or sewerage retailer, the legal basis for processing the majority of your data is to provide you with and bill you for our services under our contract with you or to meet the legal obligations we are under, for example, providing your information to our regulators.

So that we can provide the services that we are obliged to provide we need to process Personal Data for the following purposes:

• to process and respond to requests, enquiries and complaints we receive from you;
• to provide services you want from us;
• to manage and administer your account;
• to carry out Credit Checks where appropriate;
• to communicate with you about services provided to you;
• to process payments;
• to make sure our records are accurate and up to date;
• to analyse trends and profiles;
• to ensure good governance; such as internal reporting and compliance obligations for legal and market requirements
• to carry out customer satisfaction and market research;
• to improve our products and services;
• to stop someone committing fraud or to help authorities investigate fraud;
• to resolve unpaid bills;
• to comply with something the law says we must do;
• where you have said that we may do so: to recommend services that we believe will be of value to you or to contact you about how we can help you make savings on your water and sewerage supply costs;
• to contact you (including by SMS texts): to advise about disruptions to service or planned events which may affect service, emergency events, water quality issues or major works that could require road closures;
• to help third parties we appoint to carry out any of the purposes above on our behalf; and
• to process applications for roles and positions we advertise as current vacancies.

In order to carry out these activities, we need to keep reliable, accurate and up to date records of customers’ (and others) details as well as any interactions with them related to these services.

We use certain types of Personal Data collected to help us understand how we can improve our services or focus on sending you information which is relevant to you or to your circumstances. This is usually because we have a legitimate interest in processing information required to help us become more effective and efficient, or because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. For example, to promote water efficiencies.

We do not make choices based solely on automated decision-making or profiling.

Where our processing is not necessary for compliance with a legal obligation or a contract (as described above), we generally rely on our legitimate interests to run our business efficiently and improve our services (e.g. assisting our billing and collection activities; carrying out customer satisfaction surveys or market research;

Before rolling out any new campaign or business initiative, we carry out an internal review (known as a Data Privacy Impact Assessment or DPIA) to check that our legitimate interests are not overridden by your rights, and to check that we will only process your Personal Data in a way that we think you would reasonably expect (such as set out in this Notice).

We will use electronic messaging to communicate with you whenever possible and where you have provided us with those contact details.  Our electronic messaging will fall into one of four categories. These categories are:

• essential service messages and messages relating to billing, account updates, disconnection notices etc
• messages relating to accounts or service, e.g. how you manage your account like direct debits, signing up to MyAccount etc
• market research and educational messaging, and
• direct marketing messaging

Essential service messages are used to send you urgent information about your services, e.g., we need to contact you about your bills or if there are unforeseen events and emergencies within the area of supply, such as pipe bursts; these messages cannot be opted out of. 

For messaging relating to accounts or services, we will inform you via text message that a bill has been generated and payment is due within our 14-day standard business terms.  Should the water and/or sewerage bills go overdue, text message reminders will continue until the account is brought up to date or an agreed payment plan is put in place.

We may also send existing customers information in the form of letters and emails regarding other services, for example we may approach our water only customers, to offer sewerage billing as dual tariff bills. 

For messaging, other than essential service messages, you can opt out by using the contact details in 18. Who can I contact about my personal data below or by using the unsubscribe option. However, by opting out you might miss out on useful information that is of benefit to you.

You may request that you do not receive direct marketing communications by contacting us using the details in 18. Who can I contact about my personal data below.

Who sees or has access to your Personal Data within PWS will depend on why we need to process the data. The following functions, for example, will have access to your Personal Data (only the Personal Data that is necessary for their functions):

• Our Retail Service Centre Teams for billing enquiries, complaints and for all other enquiries
• Our Legal Team for dealing with any debt complaints or disputes, Data Subject Access Requests (DSARs) or other rights requests and advice.
• Our Billing Team for all billing requirements including meter reads and wholesale queries.
• Our Debt Team for managing collection of debt or setting up of payment plans.
• Our Commercial Teams for tenders, sales, new contracts, and continued services.
• Our IT Services to assist with software and application support and data security.
• Our Key Account Teams for billing enquiries, complaints and for all other enquiries
• Our internal audit team to provide assurance for business processes and decisions.
• Our Sales Team who will use this information to onboard you as a new customer, or to offer dual tariff contracts.

We will also share your personal data with third parties in order to meet our legal obligations or to fulfil our or your legitimate interests, such as:

• Market Operator Services Limited (MOSL).
• Water Industry Commission for Scotland (WICS).
• Consumer Council for Water (CCW).
• Water Services Regulation Authority (Ofwat).
• Central Marketing Agency – Scotland (CMA).
• Law enforcement agencies.
• Public authorities and agencies with whom we work in connection with the provision of water and sewerage services.
• Other water and sewerage companies where required for the supply of water or sewerage services to your supply address.
• Our external legal, auditors and professional advisors.
• Software providers for our IT support providers (and their sub-contractors) for our IT Systems.
• Partner Contractors and third-party contractors (and their sub-contractors) who carry out work on our behalf, such as a works contractors undertaking repairs.
• Credit reference agencies and debt collection services.
• Contractors for collecting meter readings.

We may also be required to share Personal Data under a court order or other legal obligation.

Third party processing and marketing

For some of our back-office functions, we use third-party processors.  We carry out Data Privacy Impact Assessments (DPIAs) before engaging with the third-party and ensure that we have suitable contracts in place with them to protect individuals’ Personal Data.  The relationships with third parties include:

Sharing with Ofwat, Consumer Council for Water (CCW), Market Operator Systems Limited (MOSL), Central Market Agency Scotland (CMA), Water Industry Commission for Scotland (WICS)

We will share your Personal Data, by statutory requirement, with Ofwat, CCW, MOSL, CMA & WICS to help them regulate the non-household retail market so they can measure and score our (and other water retailers) performance in specific areas.  Using the information we provide, Ofwat & CCW conduct their own surveys with customers who have contacted us for any reason.  These calls are not marketing calls, but if you would prefer that we do not share your details with Ofwat or CCW please let us know by contacting us using the contact details provided in 18. Who can I contact about my personal data.

Ofwat & CCW are a Data Controller for the information we provide to them as they require this information using their statutory powers and they choose how to use this data; they are not acting on our instruction.  Please contact them directly if you have any queries relating to these surveys.

In processing Personal Data to carry out our activities, we will in some circumstances transfer Personal Data to third party processors located outside of the United Kingdom or the European Economic Area ("EEA") or allow Personal Data to be accessed by processors outside the UK or EEA.  For those data transfers we ensure that the relevant safeguards, as required in Article 46, are implemented and transfer impact assessments are conducted (as appropriate).

As an example, PWS use the services of Echo Managed Services Limited (EMS) in India to assist with administration work using a secure link to our protected system. Certain software providers located in India and other countries may need to access Personal Data records to fix faults in the software used.  We ensure that we act in compliance with UK data protection law and that our third-party processors operate to very high standards and are bound by the relevant transfer and contractual agreements to maintain data security and confidentiality.

All information you provide to us – whether on paper, verbally or electronically – is stored securely. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your internet connection when you send us your data; any transmission is at your own risk.  Once we have received your information, we will use strict procedures and security features to help prevent unauthorised access.

We will check the accuracy of any Personal Data at the point of collection and keep the Personal Data on advice from yourselves. If your personal details change (for example your name), please let us know either by updating your MyAccount details or by letting us know via the methods below.

We will take all reasonable steps to destroy or amend inaccurate or out-of-date data. The law and our regulatory requirements determine the length of time information has to be kept.  We will not keep your Personal Data longer than is necessary.

If you have an account with “MyAccount,” you can check that the information that we hold about you as an account holder is up to date.  If you do not have a “MyAccount” account, you may contact via the details provided in 18. Who can I contact about my personal data to enquire. 

As a data subject, you have a number of rights in relation to your data under UK data protection law.  For full information on your Rights you can read the guidance from the Information Commissioner’s Office at www.ico.org.uk. A summary of these rights is provided below:

If you would like to exercise any of these rights, please contact our Retail Service Centre using the contact details below or by clicking here to complete our request web-form.

Please note that these rights should not be confused with those under the Freedom of Information Act 2000, and Freedom of Information Requests (also known as FOI or FOIA requests).  We are not a public authority and, as such, we are not subject to the Freedom of Information Act or Freedom of Information Requests; if you are seeking a copy of your Personal Data this will fall under the Right of Access (Subject Access Request) as described below.

As an individual (Data Subject), you can make a formal request for information we hold about you.  Please note, this Right of Access does not extend to or entitle you to have any access to someone else’s Personal Data.  For example, you cannot use this right to request information about your neighbours or previous occupants of your property; you are only entitled to copies of your Personal Data.

However, you can make requests on behalf of someone else, either where you have legal authority to do so or where the individual has given their permission for you to access their data on their behalf. In these situations, we will always ask for proof of legal authority or permission from the individual for which you are seeking Personal Data before we will provide you with any Personal Data.

There are a number of companies (third parties) offering online services to help you to exercise your rights under the UK GDPR.  Where we receive Rights requests via these third-party providers, we will contact you directly, using the information you have provided via the third-party, to confirm your identity and the nature of your request; we will deal directly with you from this point on to action your request.

Please note, where we receive Rights requests from third-party providers and there is insufficient information for us to verify the requester’s identity or authority, or that of the data subject, it will not be possible for us to respond to the request.

If you would like to submit a Subject Access Request, please contact the Retail Service Centre Team using the contact details below or by clicking here to complete our web-form. 

When receiving telephone enquiries, we will only disclose Personal Data we hold on our systems if the following conditions are met:

• We will check the caller’s identity to make sure that information is only given to a person who is entitled to it.
• Where a request is made on behalf of another person (or asking for that person’s Personal Data) we will need to speak to them first to confirm their identity and that they are happy for us to disclose their Personal Data to the caller.
• We will suggest that the caller put their request in writing if we are not sure about the caller’s identity (or the person on behalf of whom they are making the request) and where their identity cannot be checked.

Where a request is made electronically, data will be provided electronically where possible.

Our websites may contain links to other websites run by other organisations.

This Privacy Notice applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit.

We cannot be responsible for the privacy policies and practices of other sites even if you access those using links from our website. In addition, if you linked to our websites from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the notice of that third-party site.

For information about how we use Cookies for electronic communications or on our website, please see our separate Cookie Policy.

PWS’s details for Data Protection purposes are:

Pennon Water Services Limited, Company Number 09902835, of Peninsula House, Rydon Lane, Exeter, EX2 7HR, Data Protection Public Registration number ZA229851.  Our nominated representative for the purpose of the Regulation is the Group Data Protection Officer of Pennon Group PLC.

Should you need to contact us to discuss the handling of your Personal Data, submit a request to exercise one of your Data Protection Rights or to raise a complaint, please contact your retail customer services team below or complete our webform,

Telephone: 0800 042 0347
Email: customerservices@source4b.co.uk
Write to: Source for Business, PO Box 9136, Bournemouth BH11 0GF.

Our Data Protection Officer can be contacted by:

Email: dataprotection@pennon-group.co.uk  
Or write to: Pennon Data Protection Officer, Peninsula House, Rydon Lane, Exeter, EX2 7HR.

If you are not satisfied with our response or believe we are processing your Personal Data not in accordance with the law, you can refer your concerns to the Information Commissioner's Office (ICO).

Whilst we hope that we can address any questions or concerns you might have, should you need to contact the Information Commissioner’s Office you can do so using one of the following methods:

Write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Telephone: 0303 123 1113 or 01625 545 745

Website: www.ico.org.uk