Welsh Water’s Privacy Notice
Welsh Water’s Privacy Notice – How we use your Personal Information (Visitor Attraction Centres) (July 2021)
We know how important it is to you that we look after your Personal Information. To be trusted to do the right thing is one of our core values. This Privacy Notice explains how we collect, use, share and protect your Personal Information in a way which respects your Data Protection rights and complies with UK Data Protection laws (including the General Data Protection Regulation (GDPR) and Data Protection Act 2018).
Welsh Water is a not for profit water and sewerage company supplying over three million people with a continuous high quality supply of drinking water and taking away, treating and properly disposing of wastewater in our supply area which covers most of Wales and parts of Deeside and Herefordshire. Welsh Water is a trading name for Dŵr Cymru Cyfyngedig. For the purposes of Data Protection laws, Dŵr Cymru Cyfyngedig is the Data Controller (registered office Linea, Fortran Road, St Mellons, Cardiff CF3 0LT and company number 02366777).
The company operates 91 reservoirs varying in size from 2 to 1,026 acres. These include a national portfolio of Visitor Attractions: Llyn Brenig, Elan Valley, Llandegfedd Lake, Llys-y-Fran and Lisvane and Llanishen Reservoir (in development) under its ‘Welsh Water Adventures’ brand. They are hubs for health, wellbeing and recreation with the aim of reconnecting people with water and the environment, whilst maintaining, protecting and enhancing the ecological value of each site.
How to contact us
If you want more information about our Privacy Notice, or have any comments or observations about it or about the way that we handle your Personal Information please:
Email our Data Protection Officer at: DataProtectionOfficer@dwrcymru.com; or
Write to our Data Protection Officer at: Data Protection Officer, Dŵr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff CF3 0LT.
If you would like to exercise any of your Data Subject rights (see below for more information) please:
Email us at: DataSubjectRightsRequests@dwrcymru.com; or
Write to us at: Customer Services, Data Subject Rights Request Team, Dŵr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff CF3 0LT.
You can also contact the Information Commissioner’s Office via https://ico.org.uk/ or 0303 123 1113 for information, advice or to make a complaint.
Our lawful basis for processing your Personal Information
We only process your Personal Information if we: have a lawful basis to do so; the processing is necessary, reasonable and proportionate; and in accordance with the way in which we describe in this Privacy Notice.
Some of the processing we carry out in relation to your Personal Information is necessary for the performance of our legal obligations such as our duty to protect the health, safety and wellbeing of our visitors, employees and volunteers. In particular, we have a duty of care to ensure our visitors are safe when on our sites and that we take precautions to ensure the safety of our Visitor Attraction Centres. This includes making our visitors aware of our health and safety procedures (eg. briefings from our staff before taking part in activities).
We rely on our legitimate interests to carry out the majority of our processing of your Personal Information to enable you to take part in activities and events at our Visitor Attraction Centres.
We always check that our legitimate interests are not overridden by your rights, and process your Personal Information in a way that we think you would reasonably expect (ie. as set out in this Privacy Notice).
In limited circumstances we require consent from you to process your Personal Information – for example to send you marketing materials such as newsletters or where you provide us with Sensitive Personal Information such as medical or health information when booking activities or events. We also require the consent of parents or guardians to process the personal data of children (including their name and age to enable us to identify them and make sure we have the correct equipment available for them). When we collect Personal Information for these purposes we will ensure that we get your explicit consent to collect and record it, and let you know how you can withdraw your consent if you change your mind.
What Personal Information we collect about you and what we use it for
The only personal data we will collect from you is the information you choose to provide.
We may collect Personal Information from you in the following ways:
The Personal Information we may collect from you includes:
We will use this personal information for:
Volunteers at our Visitor Attraction Centres
If you are a volunteer at our visitor attraction centres, we may collect the following Personal Data:
We use a third party provider called Team Kinetic, who are the hosting provider of the volunteer management solution. The following personal data may be collected from you through the volunteer management solution hosted by Team Kinetic:
Your personal information will be collected in the following ways:
This personal information will be used for:
We have an automatic number plate recognition system in place at our Visitor Attraction Centre car parks to enable visitors to identify their vehicles when paying for parking. This service is provided by a third party and signage with further information is in place at our sites. We collect anonymised and aggregated data via this system to assist us with our service offering, manage footfall and staffing requirements, and manage anti-social behaviour.
We also have electrical vehicle charges at our Visitor Attraction Centre car parks to enable visitors to charge their electrical vehicles. This service is also provided by a third party and signage with further information is in place at our sites.
CCTV and Body Worn Videos
We have CCTV at our Visitor Attraction Centres and so you may be recorded if you visit us. There are signs to show you when you are entering an area monitored by CCTV. CCTV images are held for 30 days and then deleted (unless there is a legitimate business reason for us to keep it any longer).
We also use Body Worn Videos at our sites to assist in the prevention, investigation and detection of crime and the identification and prosecution of offenders.
If you would like more information about our use of CCTV or Body Worn Videos please contact Welsh Water’s Data Protection Officer.
We sometimes use drones in order to monitor, maintain and/or enhance our land, assets and our processes. The drones will be flown by CAA qualified pilots either employed by Welsh Water or a third party contractor. We aim to avoid flying drones directly overhead or within 50 metres of persons, vehicles, vessels or properties. Some of our Visitor Attraction Centres have SSI sites and there may be specific exclusions to protect wildlife in those areas (eg. the ospreys at Llyn Brenig).
We carry out surveys of our visitors to our Visitor Attraction Centres to help us tailor our events, activities and services to the needs of our visitors, and to improve our offerings. This data is collected upon exit of our attraction sites by a third party company, BDRC Group. The only personal data they will collect from you is your IP Address and email address (where you voluntarily provide your email address, in order for BDRC to send you a copy of the survey data). Your IP Address is used to prevent fraud, this will not be associated with you or the survey data in any way.
We may also use third parties, or our own employees, to help contact our customers to undertake customer satisfaction surveys or engagement processes. We rely on our legitimate interests to do so. If you would prefer not to participate please let us know either by emailing us at: DataProtectionOfficer@dwrcumru.com or writing to us at: Data Protection Officer, Dwr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff, CF3 0LT.
Please note this will not stop communications for the purpose of supplying our water and waste water services or from our regulator.
We welcome your feedback on how we can improve our Visitor Attraction Centre services. You can provide feedback by contacting firstname.lastname@example.org
Where we store your Personal Information and how we keep it safe
All access to our systems is strictly controlled. We also operate strict physical security at all our sites and employees all receive security and data protection awareness training.
Where we transfer information to third parties to enable them to process it on our behalf. We ensure that the providers meet or exceed the relevant legal or regulatory requirements for transferring data to them and keeping it secure.
We may need to transfer your Personal Information outside of the European Economic Area (EEA). These countries may not have the same Data Protection laws as the UK and the EEA and so your Personal Information may not be subject to the same protections. However, in such cases, we will make sure that any transfer of your Personal Information to countries outside of the EEA is subject to appropriate safeguards as if it were being processed inside of the EEA and under the guiding principles set out in this Privacy Notice.
How long we will keep your information
We keep your information for no longer than is necessary for the purpose of the processing. For example, financial information is kept for 6 + 1 years in accordance with the relevant financial regulations.
Any images or data captured on our CCTV will be removed after 30 days unless there is a legitimate business reason to retain it.
Automated decision making and profiling
We do not currently conduct any automated decision making as defined by Data Protection laws.
Your Data Protection Rights
You have certain rights in relation to your Personal Information and can make different types of Data Subject Rights Requests in relation to the Personal Information we hold on you. Each of these rights may not apply in all circumstances, but we will ensure that we deal with any request we receive in a way which safeguards your rights and freedoms, and in compliance with the Data Protection laws.
If you would like to make a Data Subject Rights Request, please:
Email us at: DataSubjectRightsRequests@dwrcymru.com;
Write to us at: Customer Services, Data Subject Rights Request Team, Dŵr Cymru Welsh Water, Linea, Fortran Road, St Mellons, Cardiff CF3 0LT; or
Click here for our Data Subject Rights Request form.
Any individual whose information we hold can make a Data Subject Rights Request. A third party can make a request on behalf of an individual (e.g. a relative, friend, lawyer), but we need the consent of the relevant individual before we provide any of their Personal Information to the third party.
Under certaincircumstances, by law you have the right to:
You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it.
You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website at https://ico.org.uk/.
Updating our Privacy Notice
We will keep our Privacy Notice updated as our business processes and procedures, and/or the Data Protection laws, change. Our most up to date version will always be on our website.
Customer Privacy Notice
For information on how we handle Welsh Water customer personal data please see our Customer Privacy Notice available at this link: https://corporate.dwrcymru.com/en/legal-privacy/privacy-policy.