thameswater.co.uk

Thames Water Privacy Notice: Key Points

> Scope: This summary covers the Thames Water privacy notice provided. Thames Water has separate notices for its regulated water services and its Property Searches business, so the applicable notice may depend on your relationship with the company.

1. Data Collection and Use

Information collected

Thames Water may process:

• Identity and contact details, such as name, address, email address and telephone number.
• Account and service information, including billing records, meter details, payments and service usage.
• Communications and interaction data, including correspondence, complaints, survey responses and potentially telephone recordings.
• Information about properties, land interests and site activities, depending on your relationship with Thames Water.
• Online information, such as location data or online identifiers.
• Special-category data, including health or medical information, where necessary—for example, to support public-interest functions or vulnerable customers.
• Criminal-conviction-related information, where legally permitted and necessary.
• Information obtained from credit-reference agencies, fraud-prevention organisations, landlords, managing agents, previous occupiers and publicly available sources.

Purposes and legal bases

Uses may include:

• Providing water, wastewater, drainage, billing and related services.
• Maintaining accurate customer and stakeholder records.
• Meeting regulatory, tax, consumer-protection and other legal obligations.
• Fraud prevention, sanctions screening, law-enforcement cooperation and emergency planning.
• Managing complaints, surveys, consultations, research and customer contact.
• Improving efficiency, including process mining, robotic process automation and analytics.
• Direct marketing, where applicable and subject to your rights.

The stated legal bases include public task, legal obligation, contract, consent, legitimate interests and, in limited cases, vital interests. Importantly, Thames Water says regulated billing is generally carried out under public task, meaning it does not require a contract or consent for the necessary processing.

Telephone recordings may be retained for up to 12 months, depending on the call type. Other retention periods follow Thames Water’s retention schedules and legal or industry requirements.

2. User Rights

Subject to legal exceptions and the applicable legal basis, you may have the right to:

• Receive privacy information.
• Request access to your data.
• Correct inaccurate or incomplete data.
• Request deletion (“erasure”).
• Restrict processing.
• Receive or transfer certain data in a portable format.
• Object to processing, including legitimate-interest/public-task processing and direct marketing.
• Withdraw consent where processing relies on consent.
• Avoid solely automated decisions producing legal or similarly significant effects.

Thames Water states that it currently does not use automated decision-making producing legal or similarly significant effects.

Requests are generally free, but Thames Water may verify identity and ask for clarification. It aims to respond within one calendar month, extendable by up to two further months for complex requests. Rights may be refused or limited where, for example, data must be retained to comply with law or defend legal claims.

3. Third-Party Sharing and International Transfers

Data may be shared where there is a lawful basis, including with:

• Service providers and contractors acting as processors.
• Credit-reference and fraud-prevention organisations.
• Landlords, managing agents or previous occupiers where relevant.
• Regulators, courts, law-enforcement bodies and other authorities.
• Other organisations for public-interest, safety, emergency or legal purposes.

Processors are contractually restricted to Thames Water’s instructions and must apply security and retention controls. Some recipients are outside the UK or European Economic Area. Thames Water says transfers are protected using adequacy decisions, UK/EU-approved standard contractual clauses or binding corporate rules. International transfers can nevertheless involve additional legal and practical risks.

4. AI/ML Training

The notice says Thames Water may use AI to analyse data, such as filtering and routing customer contacts. It also uses robotic process automation and process mining.

However, the notice does not expressly say whether personal data is used to train, fine-tune or improve AI models. It describes operational uses, not a clear prohibition on model training. Users seeking certainty should ask Thames Water specifically whether identifiable or pseudonymised data is used for AI training and whether external AI providers receive it.

5. User Obligations and Restrictions

The notice imposes few direct obligations on users. Practically, users should:

• Provide accurate and up-to-date information.
• Provide identity information when exercising data rights.
• Be specific when making access, correction or deletion requests.
• Recognise that some processing is mandatory and cannot be stopped through consent withdrawal or objection.
• Check whether the separate Property Searches notice applies.

6. Liability and Disputes

The notice does not set out a detailed contractual liability cap, damages exclusion or compensation regime. It instead describes Thames Water’s data-protection responsibilities and security measures.

For disputes, users should first contact:

• General privacy queries: data.protection@thameswater.co.uk
• Rights requests: subject.access@thameswater.co.uk
• Data Protection Officer: Thames Water Utilities Limited, Clearwater Court, Reading

If unresolved, complaints may be escalated to the Information Commissioner’s Office (ICO). The notice asks users to contact Thames Water first.

7. Changes

Thames Water says it will make significant privacy changes clear on its website and encourages users to check the notice periodically. The wording does not promise individual email or postal notification, so continued website monitoring may be necessary.