Welcome to the South Staffordshire Water Ltd privacy notice

Issue date: 25 June 2026

Who we are

We are South Staffordshire Water Plc, registered in England & Wales with company number 02662742 with our registered office at Green Lane, Walsall WS2 7PD. We are registered as a Data Controller (registration number Z6670622) with the Information Commissioner’s Office.

We provide our customers with clean water services. To our customers in the West Midlands, South Staffordshire and South Derbyshire we are known as South Staffs Water and to our customers in the Cambridge region we are known as Cambridge Water.

We are part of South Staffordshire Group (“Group”). You can find details about the other companies in our Group here.

Any reference in this privacy notice to “we”, “us” or “our” is a reference to South Staffordshire Water Plc.

About this privacy notice
This notice explains how we collect, use and protect personal data in connection with our services, website, customer interactions and regulatory obligations.

It applies where you:

• are a customer or potential customer
• interact with us
• use our services

Additional, specific privacy information may apply to certain services (for example, smart metering or cookies) which should be read alongside this notice.

Please take some time to read this privacy notice which applies to the personal data we collect about you. It explains how we collect and process your personal data and tells you about the rights you have.

If we change our privacy notice we will post an up-to-date version on our website so we encourage you to visit this page on a regular basis. We will also let you know about any material changes.

This privacy notice contains information on:

• Personal data we collect about you
• How we collect your personal data
• Why we collect your personal data and our lawful basis for processing
• Information we share with others
• Credit Reference Agencies
• Marketing
• Market Research and Surveys
• Automated Decision Making and Profiling
• Monitoring, Recording and Security
• Use of our company drones
• Call recording
• How we protect your personal information
• Use of our website and mobile applications
• Where your personal data may be processed
• How long we keep your information for
• Your Rights
• Contact Us

Please click on any link above to move to a specific section.

Personal data we collect about you
Personal data means any information relating to an identified or identifiable individual. It does not include information where individuals can no longer be identified (anonymous data).

We may collect, use, store and transfer different categories of personal data about you including the following:

• Identity information: This includes your name, title, date of birth and other identifiers used to establish or confirm your identity, as well as visual recordings such as CCTV or other video footage where applicable.
• Contact information: This includes your billing and residential address, email address, telephone numbers and, where relevant, contact details for landlords or other authorised third parties.
• Financial information: This includes payment details, billing records court judgement references and information obtained from credit reference agencies. Payment card details are not retained once a transaction has been completed.
• Account and service information: This includes information relating to your account and the services we provide to you, such as billing and payment history, tariff information, meter details, property information, household details, complaints and interactions, operational activity (including repairs, maintenance and supply interruptions) and any claims or incidents.
• Technical and device information: This includes information about how you access and use our systems, website or mobile applications, such as IP address, login details, browser type, device information and system identifiers. It also includes information about how you navigate and interact with our website or services.
• Location information: This includes location data where you choose to enable location-based services through our website or mobile applications. You can control this through your device settings.
• Transactional information: This includes details of payments made to us, including the method, timing and amount of transactions carried out via our website, mobile applications, telephone, bank, PayPoint or other payment channels.
• Profile and response information: This includes account preferences, login details, feedback, survey responses, participation in competitions and other information you provide through customer engagement activities.
• Usage information: This includes information about how you use our services, including water consumption and meter data (current and historical), as well as interactions with our website and mobile applications.
• Marketing and communication information: This includes your preferences in receiving marketing communications from us and your communication preferences more generally.
• Vulnerability information: This includes information about your health, disabilities or personal circumstances where this is necessary for us to provide appropriate services, such as support schemes, social tariffs or our Priority Services Register.

back to top

How we collect your personal data

We collect personal data in a number of different ways and from a variety of sources.

We will collect information directly from you when you:

• contact or interact with us, including via our website, mobile applications, telephone, post, email or when completing forms and when we visit your home or premises;
• register with us or set up and manage an account for our services;
• access or use our services, including through our website or mobile applications;
• communicate with us about your account or our services;
• participate in customer engagement activities, such as surveys, feedback, competitions or online community forums (including H2Online);
• visit our sites or receive services where recording devices (such as CCTV or mobile cameras) may be in use; or
• interact with us through digital or third-party platforms, including voice-activated services, mobile applications or social media channels (such as Facebook, Instagram or X).
  

Information we receive from third parties

We may receive personal data about you from third parties where this is necessary to provide our services, manage your account, or meet our legal and regulatory obligations. These may include:

• individuals authorised to act on your behalf, or members of your household;
• landlords (including Landlord Tap), landowners, estate agents and property developers;
• social services and medical professionals, particularly in relation to customers registered on the Priority Services Register or applying for social tariffs;
• housing associations and local authorities, including to support social tariff eligibility and maintain accurate account information;
• other utility providers, including sewerage and waste services providers;
• our contractors, suppliers and business partners involved in delivering services, including operational works and repairs;
• service partners providing related products or services, such as water efficiency or insurance products;
• third parties who notify us of issues relating to a property, such as leaks or occupancy status;
• other companies within our Group supporting account management and service delivery;
• government bodies and agencies, including benefits agencies, to support applications for assistance schemes, debt management or verification purposes;
• regulators and dispute resolution bodies (such as the Consumer Council for Water, Ofwat and WATRS) where complaints or queries are raised;
• law enforcement agencies and public authorities, including the Police, HM Revenue and Customs and the Department for Work and Pensions;
• fraud prevention agencies and credit reference agencies;
• market research providers, where you have agreed for your information to be shared with us; and
• data and insight providers who help us verify, update and maintain accurate customer records and support service delivery.

Information from publicly available sources

We may also obtain personal data from publicly available sources, including:

• the electoral roll;
• Companies House;
• registers of county court judgements and bankruptcies; and
• the Land Registry.

back to top

Why we collect your personal data and our lawful basis for processing
We collect, use and store your personal data for a range of purposes connected with providing water services, meeting our legal and regulatory obligations and operating our business.

As a statutory water undertaker, many of our core activities are carried out:

• to comply with legal obligations; and
• in the public interest, including under the Water Industry Act 1991 and related legislation.

In addition, we may process personal data where it is necessary for our legitimate interests, provided those interests are not overriden by your rights, or where you have given your consent.

The table below sets out the main purposes for which we use personal data and the lawful basis we rely on.

1. Providing water services and managing your account

back to top

2. Legal and regulatory compliance

back to top

3. Business operations and service improvement

back to top

4. Special category data

We only process special category data (such as information relating to health or disability) where this is necessary to provide appropriate services, for example in connection with:

• social tariffs or affordability schemes;
• the Priority Services Register; or
• emergency support requirements.

Where we process this type of data, we rely on:

• your explicit consent;
• or, where applicable:
  • protection of vital interests;
  • establishment, exercise or defence of legal claims; or
  • another lawful basis permitted under data protection law.

back to top

Credit Reference Agencies

We share personal data with credit reference agencies (“CRAs”) and they may also provide us with information about you, in accordance with their own privacy policies.
What information we share
We may share identity, contact, financial and transactional information with CRAs. This may include details of your account with us, including where payments have been missed or are outstanding.
We may also report information about settled accounts and any debts that have not been repaid in accordance with our terms.
How we use this information
We use personal data obtained from CRAs, and shared with them, to:

• assess and manage your account;
• determine appropriate payment arrangements;
• verify your identity;
• keep our records accurate and up to date;
• trace and recover outstanding debts; and
• prevent and detect fraud and other criminal activity.

How CRAs use your information
When we carry out a credit search, CRAs may record a “search footprint” on your credit file. This may be visible to other organisations and could be taken into account by lenders.
CRAs may provide us with:

• information about your financial standing and credit history;
• details of accounts you hold with other organisations, including utility providers;
• information about individuals who are financially linked to you (for example, a joint account holder); and
• where relevant, information relating to a business with which you are associated.

Where you tell us that another person is jointly responsible for an account, we may link your records. You should ensure that you have that person’s permission to provide their details to us.
Impact on your credit rating
If you fail to make payments in accordance with our terms, we may notify CRAs. This may have an adverse impact on your credit rating.
Further information
Further details about how CRAs process and share personal data are available in the Credit Reference Agency Information Notice.
You can also access the privacy notices of the main CRAs we use:

Experian - https://www.experian.co.uk/legal/privacy-statement.html

Equifax - https://www.equifax.co.uk/About-us/Privacy_policy.html

Callcredit - https://www.callcredit.co.uk/legal-information/privacy-centre

back to top

Marketing

We have a statutory duty to promote water efficiency and may use a range of methods to do this, including direct marketing.

This may include information about products and services that we provide, or that are provided by selected third parties (such as Homeserve Membership Limited and Save Water Save Money Limited), where these are relevant to our services or support water efficiency.

We rely on our legitimate interests to send these communications where permitted by law. We will never sell your personal data to third-party marketing organisations.

You can opt out of receiving marketing communications at any time by:

• using the opt-out link included in our communications; or
• contacting us using the details provided in the “Contact us” section below.

Please note you may still receive non-personalised communications or information which we are required to issue as part of our regulatory obligations (for example, information included with your bill).

Market research and surveys are not treated as direct marketing and are explained separately below.

Market Research and Surveys

We carry out customer engagement, research and feedback activities to understand how our services are performing and where improvements can be made, including to support our regulatory obligations.

We work with carefully selected research partners to carry out this activity on our behalf. These partners may contact you by telephone, email, SMS, through our website or via social media.

Where personal data is used for research or analytics beyond collecting direct feedback, it will typically be shared in a pseudonymised form so that individuals cannot be directly identified. Our research partners are required to:

• process personal data only on our instructions;
• apply appropriate security measures; and
• not attempt to identify individuals from the data provided.

Where you provide feedback that requires follow-up (for example, where you raise a concern or issue), we or our research partners may contact you to discuss and resolve the matter. Your details will only be shared with us for this purpose where you have agreed.

We may also use research data to analyse trends and improve how we design and deliver our services. This may include grouping customers based on shared characteristics or experiences. This does not involve automated decision-making that produces legal or similarly significant effects.

You can opt out of receiving research or feedback requests at any time by:

• informing the research partner who contacted you; or
• contacting us using the details in the “Contact us” section below.

Once your preference has been recorded, you will no longer receive research requests unless you choose to opt back in.

back to top

Automated Decision Making and Profiling

We do not carry out automated decision-making that produces legal or similarly significant effects.

We may carry out limited profiling to help us understand customer needs and improve how we communicate with and support you, for example in relation to water usage, service needs or affordability.

If you object to this type of processing, you can contact us using the details in the “Contact us” section below.

back to top

Monitoring, Recording and Security
We use a range of monitoring and recording technologies to support the safe, secure and efficient operation of our services.

CCTV and recording devices

Our sites (including offices and car parks) may be monitored by CCTV. Images and vehicle registration data may be recorded for the purposes of safety, security and the prevention and detection of crime.

Our employees and service provider personnel may also use body-worn cameras or vehicle dash cams when carrying out work, including in customer locations, for safety and security purposes.

Call recording

We and our service providers may monitor and record telephone calls for quality assurance, training, security and service improvement purposes.

Use of drones

We may use drones equipped with cameras to inspect and monitor our infrastructure and assets, including for maintenance, mapping and network management.

We rely on our legitimate interests to carry out this processing. Drone operations are conducted by trained and licensed operators and in accordance with applicable regulations. Where appropriate, signage will be displayed, and flights will take place within permitted operational parameters.
Images captured are retained only for as long as necessary for the relevant purpose.

back to top

How we protect your personal information

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss or misuse.

These measures include secure systems, access controls and internal policies designed to ensure personal data is handled lawfully and securely.

Where we share your personal data with third parties, we take steps to ensure it is protected in accordance with data protection law.

back to top

Use of our website and mobile applications

We take reasonable steps to protect personal data provided through our website and mobile applications. However, the transmission of information over the internet is not completely secure, and any data transmitted is at your own risk.

When you use our website, we may collect information through cookies. Further details are set out in our Cookie Notice.

Our website and applications may include links to third-party websites. These sites operate independently and have their own privacy notices. We are not responsible for their content or data processing practices.

back to top

Where your personal data may be processed

We may transfer personal data to service providers located outside the UK or European Economic Area.

Where this occurs, we ensure appropriate safeguards are in place to protect your personal data, in accordance with applicable data protection laws.

You can contact us for further information on the safeguards we use.

back to top

How long we keep your information for

We retain personal data only for as long as necessary for the purposes for which it was collected.

In most cases, we retain your information:

• for the duration of your relationship with us; and
• for up to 6 years after your account has been closed.

In some circumstances, we may retain personal data for longer where this is necessary to:

• comply with legal or regulatory obligations;
• manage our relationship with you;
• establish, exercise or defend legal claims; or
• meet tax, audit or record-keeping requirements.

Retention periods are determined in accordance with our internal data retention policies and governance framework, which reflect legal and regulatory requirements applicable to our business.

Where personal data is no longer required, it will be securely deleted or anonymised.

back to top

Your RightsUnder data protection law, you have a number of rights in relation to your personal data. These rights may vary depending on the lawful basis we rely on for processing your data.

Access

You have the right to access your personal data and to receive a copy of it. This is commonly known as a data subject access request (SAR).

In some circumstances, we may not be able to provide all of the information requested, for example where disclosure would adversely affect the rights of others or where requests are manifestly unfounded or excessive.

We provide a standard form to assist with SARs, although you are not required to use it.

Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Erasure

You have the right to request that we delete your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected.

This right is not absolute and may not apply where we are required to retain your data for legal or regulatory reasons.

Restriction

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have challenged.

We may continue to process your data where necessary, including to protect the rights of others or for reasons of public interest.

Portability

In certain circumstances, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to request that this is transferred to another organisation.

This right applies where processing is based on your consent or is necessary for the performance of a contract.

Objection

Where we process your personal data based on legitimate interests, you have the right to object to that processing. We may continue processing if we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or where processing is required for legal claims.

You also have the absolute right to object to the use of your personal data for direct marketing purposes. If you exercise this right, we will stop processing your data for marketing.

Withdrawal of consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time.

If you do so, we will stop processing your data for that purpose unless another lawful basis applies, in which case we will inform you.

Exercising your rights

You can exercise any of your rights by contacting us using the details set out in the “Contact us” section.

We will normally respond within one month. In some cases, for example where requests are complex or numerous, we may extend this period as permitted by law.

We will not usually charge a fee, but we may do so where requests are manifestly unfounded or excessive.

Complaints

If you have concerns about how we handle your personal data, you can raise a complaint with us using the contact details provided in this notice.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO).

back to top

Contact usWe have appointed a Data Protection Contact who can contact you if you would like any information about our privacy notice or you would like to exercise any of your rights.

You can contact us by:

Emailing: GDPRenquiries@south-staffs-water.co.uk

Writing to: Data Protection Contact at South Staffordshire Water Plc, Green Lane, Walsall WS2 7PD.

We take our responsibilities in relation to personal data very seriously, so please contact us if you have any concerns about how we are processing your personal data.

You can also contact the Information Commissioners Office at www.ico.org.uk, by writing to them at Wycliffe House Water Lane, Wilmslow, Cheshire SK9 5AF or by phone on 0303 123 1113 for further information or advice, or if we have not addressed your concerns and you would like to make a complaint.

back to top

Cookie policy

What are cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently and to provide information to website owners.

How we use cookies

We use cookies to:

• ensure our website functions correctly
• improve performance and user experience
• understand how our website is used
• support security and prevent fraud

Some cookies are essential for our website to operate. Others require your consent.

Types of cookies we use

Strictly necessary cookies

These cookies are essential for the operation of our website and cannot be switched off. They are usually set in response to actions made by you, such as logging in or using secure services.

Performance and analytics cookies

These cookies allow us to recognise and count visitors and understand how users move around our website. This helps us improve how our website works.

Functionality cookies

These cookies enable the website to provide enhanced functionality and personalisation, such as remembering your preferences.

Advertising and third-party cookies

Some cookies may be set by third-party providers (such as Google or YouTube) to support embedded content or measure the effectiveness of communications.

Managing cookies

When you first visit our website, you will be asked to consent to the use of non-essential cookies through our cookie banner.

You can change your cookie preferences at any time by:

• using the cookie settings tool available on our website; or
• adjusting your browser settings.

Please note that blocking certain cookies may affect the functionality of the website.

Third-party cookies

Third-party providers (such as Google, Qualtrics, SurveyMonkey and others) may set cookies on our website. We do not control these cookies and recommend that you review their privacy notices for further information.

You can find more information about the individual cookies we use and the purposes for which we use them in the table below:

Third party cookies

Other third parties, including Google, SurveyMonkey, Qualtrics and Oracle Corporation, may also use cookies, over which we have no control.

How do I change my cookie settings?

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies.

However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site and you will not be able to purchase products.

Find out how to manage cookies on popular browsers:

• Google Chrome
• Microsoft Edge
• Mozilla Firefox
• Microsoft Internet Explorer
• Opera
• Apple Safari

To find information relating to other browsers, visit the browser developer's website.

To find out more about cookies visit www.aboutcookies.org or www.allaboutcookies.org.

back to top