1. Who we are
Three Sixty Water Limited (Three Sixty) holds a Water Supply and Sewerage Services Licence (WSSL) in England and Scotland. Three Sixty procures water and waste water services from the respective incumbent wholesale provider in the relevant area of the NHH customer and provide the customer with billing services, customer services, account management, and certain maintenance services in relation to their water supply.
Three Sixty is part of the Kelda Group and is registered at Western House, Western Way, Bradford BD6 2SZ.
For the purposes of Privacy Law, the data controller in England is: Three Sixty Water Limited (company number 09919590), registered at: Western House, Halifax Road, Bradford, West Yorkshire, United Kingdom, BD6 2SZ; and in Scotland is: Three Sixty Water Services Limited (company number 05612103), registered at Western House, Halifax Road, Bradford, West Yorkshire, BD6 2SZ.
* Privacy Law means the Data Protection Act 1998 (as amended by the Data Protection Act 2018), the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation (from 25 May 2018) and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority;
2. Changes to Our Privacy Notice
We review this notice regularly as part of our internal processes or as our services, activities, or regulatory requirements change. It’s subject to change at any time, but the most up to date version is published on our website www.threesixty.company/privacy-cookie-policy.
This notice is dated 25 May 2018
3. Contacting Us
By post to Data Protection Officer, Kelda Group, Western House, Western Way, Bradford BD6 2SZ
By email at Dataprotectionofficer@yorkshirewater.co.uk
Through our website: www.threesixty.company.co.uk/contact-water-management-services
We take any concerns we receive very seriously. If you think our collection or use of your personal information is unfair, misleading or inappropriate, please bring it to our attention. We’ll investigate and respond to your concerns including any additional information or explanations needed. We also welcome suggestions for improving our procedures. If you are unhappy with our response you can request our Data Protection Officer to review the case.
The Information Commissioner’s Office (ICO) regulates adherence to Privacy Law. For information, advice or to make a complaint you can:
- go to the ICO website https://ico.org.uk/;
- write to The Information Commissioner’s Office, Wycliffe House Water Lane, Wilmslow, Cheshire SK9 5AF; or
- call them on 0303 123 1113
4. Your Privacy Rights
You have rights relating to your personal information. You can find more information about your privacy rights on the Information Commissioner’s Office website: https://ico.org.uk/].
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
- The right to be informed
You have the right to be informed about how and why we process your personal information.
Any time you give us personal information you have the right to be informed about why we need it and how we’ll use it.
You can find most of the information you need in this Privacy Notice. If you have any questions, please contact us: www.threesixty.company.co.uk/contact-water- management-services.
- The right of access
- You have the right to access your personal information.
- You can request a copy of information we hold about you at any time.
- We’ll try to deal with your request informally, for example by providing you with the specific information you need over the telephone providing we have the satisfactory evidence of your identity and the information you are requesting.
You can, however, formally request access to the personal information we hold about you by getting in touch through any of our customer service channels, but we’ll ask you to provide evidence of your identity before we process your request. We may also contact you to clarify your request or to ensure we have all the information we need to fully meet your request.
Privacy Law requires us to respond to your request within 30 calendar days of verifying your identity (or within three months for more complex cases). You’ll receive a full response as soon as we can reasonably provide one and we aim to resolve all subject access requests within 30 calendar days from confirming your identity. In more complex cases where we cannot provide a full substantive response within that time frame, we’ll write to you within 30 calendar days to explain why an extension is needed.
We don’t charge for subject access requests
- The right to rectification
You have the right to ask us to correct inaccurate personal information we hold about you.
If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time, through any of our customer service channels. Wherever possible, we’ll correct inaccurate or incomplete information immediately.
In more complex cases we’ll take reasonable steps to confirm the accuracy of the information we hold. Whilst we investigate the accuracy of the information, we’ll restrict the processing of the information in question.
We’ll let you know the outcome of our investigation as soon as we can. Any information we can verify as inaccurate will be corrected within one month of receiving your request.
- The right to erasure
You have the right to ask us to delete your personal information. In some circumstances you have the right to ask us to delete information we hold about you. For example, if we have asked for your consent to process the information, and you withdraw that consent.
We’ll respond to your request as soon as we can and we’ll act on any requests granted within one month of your request.
We can’t delete any information where we have a legal or regulatory obligation to keep it. This applies to all outstanding debts or anything in connection with our Water Supply Licence (e.g. water quality concerns related to the water supply for your property. We may also refuse your request if we believe it to be excessive. If your request for deletion is refused, we’ll explain the reasons for refusal.
- The right to restrict processing
You have the right to ask us to restrict the use of your personal information
In some instances, you have the right to ask us to restrict the use of your personal information (for example if you’ve challenged the accuracy of the information we hold, or have objected to our processing). We’ll restrict our use of your information whilst we investigate your objection or request to correct your information.
We’ll respond to your request as soon as we can and we’ll act on any requests within one month of your request.
If your objection is unsuccessful, we’ll only continue processing once we’ve let you know the outcome of the investigation.
When processing is restricted, we are still permitted to store your personal data, but not use it. Information related to these requests will not be automatically deleted unless you expressly ask us to.
- The right to data portability
You have the right to data portability. You have the right to move, transfer or copy data to another system for your own purposes. However, this right only applies where processing is automated and consent based.
- The right to object
You have the right to ask us not to process your personal information.
We process most of the information we collect about you under the lawful basis of ‘public task’ or ‘legitimate interest’. You have the right to object to our processing your personal information under these lawful bases (including for marketing purposes and profiling).
We will respond to your objection as soon as we can, detailing any actions we can reasonably make. If we believe there is an overriding compelling reason to continue the processing, we will explain why we think this is.
We’ll action any requests to stop direct marketing as soon as we receive your objection.
You can object to us using your data at any time through any of our contact channels: www.threesixty.company.co.uk/contact-water-management-services.
- Rights in relation to automated decision making and profiling
You have the right to request not to be subject to a decision based solely on automated processing (see paragraph 8 of this Privacy Notice) including profiling, which has an adverse effect on you.
We will consider any requests regarding automated decision making, including profiling, as soon as we receive your request.
5. Lawful basis for processing
Privacy Law states we must have a lawful basis for processing your information. We have identified the legal bases on which we process your information, and this varies depending on how and why we have your information. The legal bases we use are:
- Consent: if you’ve given consent for us to process your personal information (e.g. in relation to certain support schemes or in relation to certain marketing activities);
- Legitimate interest: if the activities are for our business purposes and do not impede your rights as data subjects (e.g. carrying out market research or customer satisfaction surveys to improve our service to you, data sharing with third parties (only in accordance with the service you have requested), fraud prevention and detection, ensuring network information and public security etc.)
- Contracts: where our processing is necessary for the performance of a contract where you are a party to the contract.
- Legal obligations: if the processing is necessary for compliance with one of our legal obligations (e.g. we’re required to provide certain contact information and other details about our services to Ofwat, WICS, Central Market Agency (CMA), the Consumer Council for Water and the Water Redress Scheme (WATRS)); and
- Vital interests: we may need to process your personal information to protect your vital interests (e.g. because there is a risk to you and your business due to water quality issues or where the water supply has been disrupted).
If we process any special category information i.e. information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, health data, or data concerning your sex life or sexual orientation, we must have a further lawful basis for the processing. These further legal bases include where:
- you give us your explicit consent to process your special category information (e.g. in relation to a support scheme);
- the processing is necessary to protect your vital interests or someone else’s vital interests;
- you make the information public;
- the processing is necessary for a legal claim (e.g. because you’ve failed to pay your bill);
- the processing is necessary for reasons of substantial public interest (e.g. where we suspect fraud on the part of a customer); or
- the processing is necessary for reasons of public interests in the area of public health (e.g. to manage a water quality incident or contamination).
6. Information we collect from you and what we do with it
Most of the information we collect from you or about you is to help us manage your account with us and to make account management decisions according to your needs. We’ll use this information to bill you for the water supply and waste water services procured. We may process your information differently if you request other products or services from us (see below).
To provide our services to you, we need to collect, process and store a variety of information about you that may be personal or sensitive in nature. In most cases, the information we collect is provided by you directly. This is one of the ways we can ensure the information we collect is as accurate and up to date as possible. We’ll usually do this when you first contact us, and we may ask you to confirm your details on subsequent contacts from time to time.
We use your information to manage your account and services, improve and develop our business generally, to provide statistical information to meet our regulatory requirements and to enforce our legal rights. If we intend to use your information for a different purpose, we’ll do so in ways consistent with Privacy Law or, wherever possible, by notifying you in advance.
We’ll only use your information for the specific purpose(s) for which it has been provided to us or collected by us.
The type of information collected from you and obtained about you will vary depending on your relationship with us, the service you are requesting and your chosen method of contacting us.
If you contact us to report a leak or any other problem with your water supply or your waste water service, we’ll need to investigate. This means that we may call you and discuss your concern. We’ll keep you informed of planned visits by the relevant wholesaler, or third party, or by us, and of any results we find by letter or by telephone, unless you ask us not to. We may need to share your data with our affiliated partners who may attend the location and will assist us to resolve the matter as soon as possible.
For billing and account management purposes we are likely to ask you to provide:
- name and address of for your business;
- name and address of your home if your business is located at your home address;
- contact details (including phone number, e-mail address or social media identifiers) – to contact you about your account, update you about the services you’ve requested or receive from us, inform you about service interruptions, or contact you with other information related to our business;
- financial information (including method of payment and bank account details) – to bill you for the services you receive from us and manage your payment arrangements; household information – your business address may be the same as your household address and we will therefore collect this information for the purposes of providing the services you require.
Former non-household customers – switching to another retail provider
If you switch to a different retail provider, your account will be closed once any outstanding balance has been paid. The information relating to your water consumption, charges and payments will be kept in line with our data retention policy for financial auditing purposes. If you still have an outstanding balance, we’ll keep information associated with your account until your account is closed. We will share your account information with MOSL/CMA in order for your switch to be processed. This may include your name, address, telephone number, email address.
7. Information we collect or obtain from others about you
We prefer to collect information directly from you so we can ensure it’s as up to date and as accurate as possible. However, we also collect information about you from other sources outside of Three Sixty. These include:
- information collected by our business partners or sub-contractors relating to services they are delivering to you on our behalf, or to respond to a concern you have;
- information about you from members of the public (e.g. if someone reports a leak) or other third parties with an association with your property (e.g. landlords, shared occupiers, previous or future occupiers.);
- information about you or your property from public bodies eg. CMA, Scottish Assessors Association (SAA), Consumer Council for Water (CC Water) (England), MOSL (England), Ofwat (England), and the Water Industry Commission for Scotland (WICS).
- opinion data about your preferences, the level of service we provide or on key industry topics, provided to us by market research agencies. All agencies commissioned to undertake this work are done so following the Market Research Society code of practice;
- demographic data from third party sources with access to publicly available information (e.g. parliamentary constituency information);
- information from relevant wholesale providers in your area to enable us to provide your retail services and manage emergency situations.
We also collect information about you from the Market Operator in England (MOSL) and the Central Market Agency in Scotland (CMA) to ensure that we are compliant with the requirements to ensure we are providing you with the service standards expected. For example: meter reading information and information to enable you to switch retail providers (which can include your name and address information or any sensitive information pertinent to your business or which effects your business premises). We will also share information regarding the business name/SIC code and any other personal data you provide, to these Market Operators.
The MOSL privacy notice can be found here: https://www.mosl.co.uk/search?q=market+privacy+notice
The CMA privacy notice can be found here: http://www.cmascotland.com/about-us/privacy- statement
We also work closely with affiliated partners (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, local authorities, and may receive information about you from them.
In future, we may also receive information about you from public authorities to improve service delivery and ensure that priority customers can access available support.
8. Profiling and automated decision making
We may use your personal information on its own, in an aggregated anonymous form, or mixed with publicly available demographic information to profile you. We do this to:
- ensure we deliver the best possible service to you
- use the right method and right message to communicate with you
- understand how you use water to help our business planning and to keep you informed about your water usage
- identify service disruption that may affect you
9. What to expect when you contact us
If you contact us by phone or in writing (including e-mail, live chat, social media or via our website) we’ll record, monitor or keep copies of the correspondence. We keep this information for a number of reasons (including fraud prevention and crime recording/investigation) but the main reasons are to:
- assist our response to any account/supply queries you may have;
- ensure we continue to offer you the best possible service;
- maintain standards and help train our customer relationship managers;
- demonstrate our compliance with regulatory obligations; and
- keep our records up to date so that we don’t offer you services that you don’t need.
Contacting us by telephone
When you contact us by telephone, your telephone number may be added to your account so that we can contact you in future. We use a telephone number listed on your account to contact you to discuss your account or text you with reminders to pay unpaid water bills or regarding support scheme applications.
We may also use a telephone number listed on your account to contact you if there’s a water supply interruption or a waste water issue, work being conducted near your home, or water quality concern. Apart from calling you relating to account arrears and communicating public health issues, you can opt out of future contact at any time by contacting us.
Contacting us by post
All customer post, including enclosures, received by us is scanned electronically on to our systems. We’ll store the letter and attachments on that account.
Post is stored and processed in a secure area of the building. The retention of hard-copy documents and electronic images of post received is detailed in our data retention policy.
If you email us, we’ll respond to you using the email address you give us. We may add your email address to your account and use it for future communications, but only in line with the relevant legal basis.
Please note that email isn’t considered to be a secure communication method. If you have any concerns over the security of your information in transit, please raise this with our customer service representatives who will suggest alternative methods of contact.
Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Emails are stored, archived and deleted in line with our information security and data retention policies.
Contacting us via social media
We strongly advise not to post your personal contact or other sensitive information on a public social media site. If you contact us using social media to report an issue, we’ll ask you to private message us to gather suitable information. We may suggest an alternative contact method if we think this is more appropriate.
Making a complaint
If you make a complaint to us, we’ll follow our complaints process: www.threesixty.company/faqs We may need to share details about your complaint internally to fully investigate. If you escalate your complaint to The Consumer Council for Water (CCWater) or submit a claim through the Water Redress Scheme (WATRS) and WICS, we’ll share information with them in order to resolve your concern. This exchange of personal data with CCWater, WATRS and WICS is a responsibility under our WSSL.
If the complaint relates to a service provided by a third party, we’ll share information with them in order to resolve your complaint. If you don’t want information identifying you to be disclosed, we’ll try not to disclose this. However, it may not be possible to handle a complaint on an anonymous basis.
We’ll only use the personal information we collect to process your complaint and to check on the level of service we provide (this may include a visit to you at your address by the wholesaler or an affiliated partner). We do compile and publish statistics showing information (for example the number of complaints we receive), but not in a form which identifies any individuals.
We’ll keep complaints in line with our data retention policy.
10. Visiting our website
Each time you visit to our website or mobile application we’ll automatically collect the following information:
- Technical information – This includes the Internet protocol (IP) address used to connect your device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
- Location information – When using one of our location-enabled services on our website or mobile applications, we may collect and process information about your actual location. If you wish to use the feature, you’ll be asked to consent to your data being used for this purpose. You can withdraw your consent at any time either by modifying the geo-location settings of your web browser or the location awareness permissions of your mobile device.
- Session information – information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
- We use website analytical tools on our site for anonymous reporting of site usage and may use this information for advertising on social media sites. All data collected using analytical tools are deleted after 14 months.
Information about cookies we use
Google Analytics – This site uses Google Analytics, a web analytics service provided by Google, Inc. Google Analytics sets number of cookies (default is 4) in order to evaluate your use of the site and compile reports for us on activity on the site.
Google stores the information collected by cookies on servers in the United States (please see paragraph 13 and 15 of this Privacy Notice). Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google.
Google Inc are certified members of the Privacy Shield Framework. Google comply with the EU-US and Swiss-US Privacy Shield Frameworks as set forth by the US Department of Commerce regarding the collection, use and retention of personal information from European Union member countries and Switzerland, respectively. Google, including Google LLC and its wholly-owned US subsidiaries, has certified that it adheres to the Privacy Shield Principles. Google remains responsible for any of your personal information that is shared under the Onward Transfer Principle with third parties for external processing on our behalf, as described in the ‘Sharing your information’ section.
For more information on the cookies set by Google please go to:
Our website may also contain links to and from other websites including our partner networks and affiliates. If you follow a link to any of these websites, please note that we do not have control over these websites or their content. These websites have their own privacy policies and we’ll not accept any responsibility or liability for these. We recommend that you review the website terms and conditions that are applicable to the third-party website.
11. Capturing images (including CCTV)
We comply with the Home Office Surveillance Camera Code of Practice for all our CCTV usage. If you have any privacy related concerns about our use of CCTV please contact us by email at Dataprotectionofficer@yorkshirewater.co.uk or by post to Western House, Western Way, Bradford BD6 2SZ.
12. Information we share with others
There may be some circumstances where we need to share some of your information as part of our day to day management of your account and services, to meet our compliance obligations or where we are permitted to under Privacy Law.
We share your personal information with other members of the Kelda Group. We do this to ensure we offer you a comprehensive service across our departments. We share your personal information such as name, address, telephone number, email address, water consumption, sensitive information we may hold, and bank details with Kelda Group employees and access is controlled in accordance with our Information Security Policies. This information is shared only to fulfil the legitimate services we provide and for accounting purposes.
The obligations that we have to regulatory bodies
We have obligations to share data with regulatory bodies to ensure that you are receiving the services in accordance with the market codes and to improve market industry practice.
We may also disclose your personal information to third parties if we are under a duty to disclose or share your personal information to comply with any market codes. We do not require your consent to process your information in this way.
We are required to share your contact and consumption information with Ofwat, CMA, Scottish Assessors Association (SAA), Consumer Council for Water (CC Water) (England), MOSL (England), and the Water Industry Commission for Scotland (WICS) (and third parties working on their behalf), for the purposes of evidencing and improving market performance. This isn’t for marketing purposes. As this is part of our WSSL obligations, we are required to share your data and are not permitted to remove any contact details. You can’t opt out of this sharing arrangement. However, if you switch to a different retail provider, we will no longer be legally required to provide this information, and we will not share any further information unless necessary to provide a smooth transition to your new retail provider.
Regulatory requirements with wholesale providers
As your retail provider, we may need to share your contact details with the relevant wholesale provider in your area. This is a regulatory requirement, and will be in circumstances where you have a problem with your water supply, or where there is a risk to public health. The relevant wholesale provider may then contact you directly to ensure that all steps taken to resolve the problem are directed to you rather than us, so that you receive the quickest resolution channel.
If you’ve escalated a complaint to The Consumer Council for Water or WICS, we have a regulatory obligation to provide information related to that complaint. This is likely to include your personal information.
Sometimes we are contacted by HMRC, the Department for Work and Pensions, the police, local council authorities, fraud agencies or UK Visas and Immigration asking for information about individual customers. Under Privacy Law, we are permitted to share this data with them without your consent and you’ll not be notified that this has been done. This is in the support of the prevention and detection of crime.
Agreements we have with other organisations for sharing information
- some of your personal information (name, address, contact details) with a third party suppliers of services such as: plumbing, meter reading and other technical services that you have requested;
- your payment information (bank account; sort code; direct debit mandates etc) with banking institutions to process your payments;
- your contact information with selected companies to conduct market research so that we can understand and improve our quality of service. You may receive a call from them following contact with us to ask about your experience and how you would score us. This isn’t a marketing call and your response is very important to us. If you would prefer not to participate in these surveys in future, you can let our customer services team know at any time;
- your contact telephone number, email address and business (or home address where your business is based at home) with wholesaler providers in your relevant area in order to fulfil the services you receive from us and for the wholesale to communicate any unplanned or planned water supply interruptions or public health risk situations.
- (occasionally) your personal data with our legal advisers or our insurance company or other professional advisors to obtain legal advice or make/defend a claim
If we sell or buy any business or assets, or merge with another business entity or carry out internal corporate restructuring, your information may be disclosed to new or prospective business partners or owners or the new corporate entities.
13. Affiliated Partners we use who may have access to your data
We use affiliated partners to help us process your personal information and provide services to you including to:
- manage technical services that you have requested (such as plumbing services, flow monitoring). They, their employees and subcontractors have access to some customer information relevant to their work;
- provide software services, like our social media management.
- process information and provide statistical analysis, management information and IT support. This requires them to process your personal information, and this may happen outside the EEA (see paragraph 10 and of this Privacy Notice).
- help us process card payments, payment card transactions and to process cheques;
- collect information for bills, print bills and customer communications; and
- provide additional support to our customer services teams in busy times. They have access to relevant customer information in our billing system and may use your data to contact you on our behalf.
14. Where we store your information and how we keep it safe
All customer personal information stored on our corporate systems is kept securely. We operate a suite of Information Security Policies to minimise the risk of security breaches, including appropriate access and auditing controls.
We use industry standard protection methods to minimise the risk of cyber-attack. Unfortunately, the transmission of information via the internet may not always be secure. Although we’ll do our best to protect your personal information, we cannot guarantee the security of information you send to us that is outside of our security arrangements; any transmission is at your own risk.
We also operate strict physical security at all our sites and employees all receive security and data protection awareness training.
We may store your personal information on your local device, such as your computer or mobile phone to assist you in your repeated use of our services. We have no control over inappropriate access to this information. You can delete this information at any time using the facilities of your Internet browser or by removing our application from your mobile device.
Where we transfer information to third parties to enable them to process it on our behalf (see the information about affiliated partners above), we seek confirmation of their compliance with security industry standards, legal and regulatory requirements.
15. Storing or transferring your information outside the European Economic Area (“EEA”)
We may transfer or store your personal information outside the EEA (see paragraph 10 of this Privacy Notice). It may be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the provision of support services and management information reporting. Where information is transferred to a country or international organisation outside of the UK / EEA, we’ll comply with the relevant legal rules governing such transfers.
16. How long we’ll keep your information for
We only keep your information for as long as we need it. We’ll retain certain information (e.g. contact information and bank details) for as long as you have a relationship with us. Our data retention policy outlines these time frames but the length of time depends on the purpose of the processing.
Generally, we’ll keep your account information for up to seven years from account closure (e.g. if you move out of the Yorkshire Water supply area), after which time your personal information will be either deleted or anonymised from closed and finalised accounts.
Retention periods may be extended in certain limited cases as prescribed or permitted by law – e.g. because of an accident or to bring or defend a legal claim.