Welsh Water’s Privacy Notice

Welsh Water’s Privacy Notice – How we use your Personal Information (Visitor Attraction Centres) (July 2021)

We know how important it is to you that we look after your Personal Information. To be trusted to do the right thing is one of our core values.  This Privacy Notice explains how we collect, use, share and protect your Personal Information in a way which respects your Data Protection rights and complies with UK Data Protection laws (including the General Data Protection Regulation (GDPR) and Data Protection Act 2018).

About us

Welsh Water is a not for profit water and sewerage company supplying over three million people with a continuous high quality supply of drinking water and taking away, treating and properly disposing of wastewater in our supply area which covers most of Wales and parts of Deeside and Herefordshire.  Welsh Water is a trading name for Dŵr Cymru Cyfyngedig.  For the purposes of Data Protection laws, Dŵr Cymru Cyfyngedig is the Data Controller (registered office Linea, Fortran Road, St Mellons, Cardiff CF3 0LT and company number 02366777).

The company operates 91 reservoirs varying in size from 2 to 1,026 acres. These include a national portfolio of Visitor Attractions: Llyn Brenig, Elan Valley, Llandegfedd Lake, Llys-y-Fran and Lisvane and Llanishen Reservoir (in development) under its ‘Welsh Water Adventures’ brand. They are hubs for health, wellbeing and recreation with the aim of reconnecting people with water and the environment, whilst maintaining, protecting and enhancing the ecological value of each site.

How to contact us

If you want more information about our Privacy Notice, or have any comments or observations about it or about the way that we handle your Personal Information please:

Email our Data Protection Officer at: DataProtectionOfficer@dwrcymru.com; or

Write to our Data Protection Officer at: Data Protection Officer, Dŵr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff CF3 0LT.

If you would like to exercise any of your Data Subject rights (see below for more information) please:

Email us at: DataSubjectRightsRequests@dwrcymru.com; or

Write to us at: Customer Services, Data Subject Rights Request Team, Dŵr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff CF3 0LT.

You can also contact the Information Commissioner’s Office via https://ico.org.uk/ or 0303 123 1113 for information, advice or to make a complaint.

Our lawful basis for processing your Personal Information

We only process your Personal Information if we: have a lawful basis to do so; the processing is necessary, reasonable and proportionate; and in accordance with the way in which we describe in this Privacy Notice. 

Legal obligation

Some of the processing we carry out in relation to your Personal Information is necessary for the performance of our legal obligations such as our duty to protect the health, safety and wellbeing of our visitors, employees and volunteers.  In particular, we have a duty of care to ensure our visitors are safe when on our sites and that we take precautions to ensure the safety of our Visitor Attraction Centres. This includes making our visitors aware of our health and safety procedures (eg. briefings from our staff before taking part in activities).

Legitimate Interests

We rely on our legitimate interests to carry out the majority of our processing of your Personal Information to enable you to take part in activities and events at our Visitor Attraction Centres. 

We always check that our legitimate interests are not overridden by your rights, and process your Personal Information in a way that we think you would reasonably expect (ie. as set out in this Privacy Notice).

Consent

In limited circumstances we require consent from you to process your Personal Information – for example to send you marketing materials such as newsletters or where you provide us with Sensitive Personal Information such as medical or health information when booking activities or events.  We also require the consent of parents or guardians to process the personal data of children (including their name and age to enable us to identify them and make sure we have the correct equipment available for them).  When we collect Personal Information for these purposes we will ensure that we get your explicit consent to collect and record it, and let you know how you can withdraw your consent if you change your mind.

What Personal Information we collect about you and what we use it for

The only personal data we will collect from you is the information you choose to provide.

We may collect Personal Information from you in the following ways:

• Information you provide to us when booking an event at one of our Visitor Attraction Centres (including payment details);
• Information that you provide to us for the purpose of subscribing to our newsletters (eg. email address, name, postal address and/or post code);
• Information you provide to us when purchasing vouchers for events or activities;
• Information you provide to us when applying for a fishing permit;
• Information about your computer and about your visits to and use of our website.  Please see our Visitor Attraction Centre website Cookies Policy at this link https://elan-valley.co.uk/cookie-policy/ for more information;
• Public WiFi System (email and postcode);
• Information that you provide to us for accommodation and camping bookings (eg name, postal address, phone number, email address and accessibility information).
• We sometimes use unmanned aerial systems (drones) in order to monitor, maintain and/or enhance our land, assets and our processes.  The drones will be flown by CAA authorised pilots either employed by Welsh Water or third party contractors.  We aim to avoid flying drones directly overhead or within 50 metres of persons, vehicles, vessels or properties.  We will limit the amount of Personal Data captured when using drones as much as is reasonably practicable by only capturing recordings/images on a strictly necessary basis (by only starting to record when the drone is in place and not during take-off and landing unless necessary), and keep them for as long as is necessary, and also notify the individuals that the recording is taking place using a notice.

The Personal Information we may collect from you includes:

• The name, address, postcode, email address and telephone number you provide to us
• Information about your visits to, and use of, our website. Please see our Visitor Attraction Centre website Cookies Policy at this link https://elan-valley.co.uk/cookie-policy/ for more information
• Details of accessibility, dietary and any other requirements when booking activities, events  or accommodation;
• Payment details.
• Physical attributes such as your appearance and gait, and vehicle registration numbers, captured through CCTV and drones. Any Personal Data captured will be anonymised during data processing.

We will use this personal information for:

• Confirming and securing your bookings for events;
• Sending you vouchers you have purchased  use at our Visitor Attraction Centres;
• Keeping you up to date with activities at your local Visitor Attraction Centre via our newsletters;
• Ensuring we provide visitors with the equipment you need for the activities you take part in;
•  Processing your application for a fishing permit;
• Adapting your accommodation requirements to your needs;
• Monitoring our sites and car parks to keep them safe for our staff, volunteers and visitors.

Volunteers at our Visitor Attraction Centres

If you are a volunteer at our visitor attraction centres, we may collect the following Personal Data:

• Name
• Date of Birth
• Address
• Contact Number
• Email address
• Emergency Contact Name, Number and Relationship
• Clothes Size
• Evidence of Qualification
• Reference Contact details
• Accessibility
• Photo Consent
• Ethnicity
• Gender
• Disability

We use a third party provider called Team Kinetic, who are the hosting provider of the volunteer management solution. The following personal data may be collected from you through the volunteer management solution hosted by Team Kinetic:

• Name
• Address
• Date of Birth
• Contact Number
• Ethnicity
• Gender
• Health information
• Emergency contact information
• Qualifications and training.
• Criminal records information

Your personal information will be collected in the following ways:

• Via an online registration form

This personal information will be used for:

• Name, Date of Birth, Address, email, and phone number is required to process your application and for Welsh Water to contact you to confirm we have received the application, to make arrangements and notify you of any upcoming opportunities
  
• Date of birth and reference contact details required to understand a volunteer’s age group and for safeguarding purposes
  
• Date of birth required to verify your identity
   
• Clothing size required for PPE (which is required to be worn to meet health and safety legislation)
  
• Emergency contact name, number, and relationship required in case of emergency whilst taking part in a volunteer opportunity on a Welsh Water site
  
• Evidence of qualification required for specialist skills and knowledge relevant for certain volunteering roles e.g. conservation management, training and use of tools and machinery
  
• Accessibility information required to make reasonable adjustments for all volunteers prior to them partaking in a volunteering activity

• Photo(s) / video and voice recording(s) consent will be requested in Team Kinetic. Upon consent of photo(s) / video and voice recording(s) will be held by Welsh Water inline with photography and filming consent report. Photo(s) / video and voice recording(s) may be taken for promotional purposes and may be sent out to media, press releases or press relations used for our publications or on our website. The photo(s) / video and voice recording(s) will be deleted after three years, unless we feel the material has historic significance

• Photo consent required for identification badges for all volunteers on Welsh Water sites
  
• Gender, ethnicity, disability is requested by Team Kinetic to support diversity, equality and inclusion. Providing this information is optional to the volunteer.   By monitoring the diversity of those volunteering within Welsh Water we can ensure to provide this level of data we are treating all individuals fairly and offering equal opportunities.  
• Welsh Water will also need to provide monitoring information to funding organisations to demonstrate that we are meeting project outcomes, such as engaging with a wider range of people. The data supplied to the funding organisations will be anonymised and aggregated based on a number of people rather than any individuals. Welsh Water uses this information to understand the demographics of those who volunteer.

Car Parks

We have an automatic number plate recognition system in place at our Visitor Attraction Centre car parks to enable visitors to identify their vehicles when paying for parking.  This service is provided by a third party and signage with further information is in place at our sites.   We collect anonymised and aggregated data via this system to assist us with our service offering, manage footfall and staffing requirements, and manage anti-social behaviour. 

We also have electrical vehicle charges at our Visitor Attraction Centre car parks to enable visitors to charge their electrical vehicles.  This service is also provided by a third party and signage with further information is in place at our sites.

CCTV and Body Worn Videos

We have CCTV at our Visitor Attraction Centres and so you may be recorded if you visit us. There are signs to show you when you are entering an area monitored by CCTV. CCTV images are held for 30 days and then deleted (unless there is a legitimate business reason for us to keep it any longer).

We also use Body Worn Videos at our sites to assist in the prevention, investigation and detection of crime and the identification and prosecution of offenders. 

If you would like more information about our use of CCTV or Body Worn Videos please contact Welsh Water’s Data Protection Officer.

Drones

We sometimes use drones in order to monitor, maintain and/or enhance our land, assets and our processes. The drones will be flown by CAA qualified pilots either employed by Welsh Water or a third party contractor. We aim to avoid flying drones directly overhead or within 50 metres of persons, vehicles, vessels or properties. Some of our Visitor Attraction Centres have SSI sites and there may be specific exclusions to protect wildlife in those areas (eg. the ospreys at Llyn Brenig).

Visitor Surveys

We carry out surveys of our visitors to our Visitor Attraction Centres to help us tailor our events, activities and services to the needs of our visitors, and to improve our offerings. This data is collected upon exit of our attraction sites by a third party company, BDRC Group. The only personal data they will collect from you is your IP Address and email address (where you voluntarily provide your email address, in order for BDRC to send you a copy of the survey data). Your IP Address is used to prevent fraud, this will not be associated with you or the survey data in any way.

We may also use third parties, or our own employees, to help contact our customers to undertake customer satisfaction surveys or engagement processes. We rely on our legitimate interests to do so. If you would prefer not to participate please let us know either by emailing us at: DataProtectionOfficer@dwrcumru.com or writing to us at: Data Protection Officer, Dwr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff, CF3 0LT.

Please note this will not stop communications for the purpose of supplying our water and waste water services or from our regulator.

Cookies

Please see our Cookie Policy on our website for information on our use of cookies https://elan-valley.co.uk/cookie-policy/

Feedback

We welcome your feedback on how we can improve our Visitor Attraction Centre services. You can provide feedback by contacting welshwateradventures@dwrcymru.com

Where we store your Personal Information and how we keep it safe

All access to our systems is strictly controlled. We also operate strict physical security at all our sites and employees all receive security and data protection awareness training.

Where we transfer information to third parties to enable them to process it on our behalf. We ensure that the providers meet or exceed the relevant legal or regulatory requirements for transferring data to them and keeping it secure.

We may need to transfer your Personal Information outside of the European Economic Area (EEA). These countries may not have the same Data Protection laws as the UK and the EEA and so your Personal Information may not be subject to the same protections. However, in such cases, we will make sure that any transfer of your Personal Information to countries outside of the EEA is subject to appropriate safeguards as if it were being processed inside of the EEA and under the guiding principles set out in this Privacy Notice.

How long we will keep your information

We keep your information for no longer than is necessary for the purpose of the processing.  For example, financial information is kept for 6 + 1 years in accordance with the relevant financial regulations.

Any images or data captured on our CCTV will be removed after 30 days unless there is a legitimate business reason to retain it.

Automated decision making and profiling

We do not currently conduct any automated decision making as defined by Data Protection laws.

Your Data Protection Rights

You have certain rights in relation to your Personal Information and can make different types of Data Subject Rights Requests in relation to the Personal Information we hold on you.  Each of these rights may not apply in all circumstances, but we will ensure that we deal with any request we receive in a way which safeguards your rights and freedoms, and in compliance with the Data Protection laws.

If you would like to make a Data Subject Rights Request, please:

Email us at: DataSubjectRightsRequests@dwrcymru.com;

Write to us at: Customer Services, Data Subject Rights Request Team, Dŵr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff CF3 0LT; or

Click here for our Data Subject Rights Request form.

Any individual whose information we hold can make a Data Subject Rights Request. A third party can make a request on behalf of an individual (e.g. a relative, friend, lawyer), but we need the consent of the relevant individual before we provide any of their Personal Information to the third party.

Under certaincircumstances, by law you have the right to:

• Request access to your Personal Information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• Request correction of the Personal Information that we hold about you (also known as “rectification”). This enables you to have any incomplete or inaccurate information we hold about you corrected;
• Request erasure of your Personal Information.  Subject to certain conditions, this enables you to ask us to delete or remove Personal Information (eg. where your Personal Information is no longer needed for the purpose it was collected for, or where the relevant processing is unlawful).  You also have the right to ask us to delete or remove your Personal Information where you have exercised your right to object to processing and there is no overriding legitimate interest to continue that processing (see below);
• Object to processing of your Personal Information where we are relying on a legitimate interest (or those of a third party), where we process personal data for a task carried out in the public interest or when exercising official authority vested in us and there is something about your particular situation which makes you want to object to processing on this ground;
• Request the restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information about you (eg. if you want us to establish its accuracy or the reason for processing it);
• Withdraw your consent to processing.  Where our processing of your Personal Information is based on your consent you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your Personal Information for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point;
• Request the transfer of your Personal Information to another service provider (ie. also known as the Right to Portability in the event that we are relying on your consent to process that Personal Information;
• Not to be subject to a decision based solely on “automated processing”. We do not currently carry out any automated processing.

You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it.

You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website at https://ico.org.uk/.

Updating our Privacy Notice

We will keep our Privacy Notice updated as our business processes and procedures, and/or the Data Protection laws, change.  Our most up to date version will always be on our website.

Customer Privacy Notice

For information on how we handle Welsh Water customer personal data please see our Customer Privacy Notice available at this link: https://corporate.dwrcymru.com/en/legal-privacy/privacy-policy.