Privacy Policy

Invenio-Systems

Privacy Policy

14 May 2018

Who we are

This Policy sets out the obligations of Invenio-Systems, a company registered in England under company number 09561817, whose registered office is Portland House, Belmont Business Park, Durham, UK DH1 1TW (“the Company”) regarding the privacy of all personal data collected and defined by EU Regulation 2016/679 General Data Protection Regulation (“GDPR”) enacted as the Data Protection Act 2018.

Our Principles

These 8 principles summarise our commitment to protecting your privacy:

• We only collect and use the personal information we need to provide or improve our products and services
• You can check whatever information we hold about you
• We will keep your personal information safe
• We are fair and open about how we use your details
• We will never sell your details or share it except in the ways mentioned in this policy or unless you ask us
• We will let you know if there are important changes that affect your information or how we use it
• We take responsibility for the information we hold about you
• We only keep your information for as long as necessary.

The Law

The legislation that applies to this privacy policy includes the:

• Data Protection Act 1998 (DPA)
• EU Data Protection Directive 95/46/EC
• Regulation of Investigatory Powers Act 2000
• Electronic Communications Data Protection Directive 2002/58/EC
• Privacy and Electronic Communications (EC Directive) Regulations 2003
• General Data Protection Regulation ((EU) 2016/679) (GDPR) as introduced into national law on 25 May 2018
• All applicable laws, regulations and secondary legislation relating to the processing of personal data and privacy
• Guidance and codes of practice issued by the Information Commissioner
• Any successor legislation to the DPA and GDPR.
• Water Industry Acts of 1991 and 1999.
• Water Industry Act (Scotland), 2002.

How we collect information

You give us information when you use our websites, products and services, including when you:

• Submit one of our forms
• Correspond with us by phone, email or otherwise
• Register with us or subscribe to our services

When conducting our water-throughput monitoring operations, we use postal and geographic address information in order to provide reference for our field-engineering teams to monitor stop-tap and water supply pipes as well as sewerage network asset. When expressed as domestic residences, such address information supplied by your water company is considered personal data.  As a data processor of personal data, we have responsibilities to meet regulatory and best practice protocols concerning data processing – the following protocols demonstrate our commitment to fair and transparent processing in connection with our standard field engineering operations and cover the work we do on behalf of water companies;

• We perform and maintain a Data Protection Impact Assessment concerning the processing protocols relating to field operations
• We purposefully ensure data received from data controller organisations is minimised in scope to exclude all other personal data other than a location address relating to water network assets

We may also get information from other sources including from agencies who refer enquiries to us – e.g.s. including water-supply industry partners, charities, sustainability, not-for-profit or quasi-government agencies.

What information we collect and use

The information we collect could include;

1. If you make an enquiry of our company including using our web-form: your name, your email, your telephone number and any other information you supply in connection with your enquiry.
2. For data we use as part of our water-throughput monitoring, we may use your domestic residence address as supplied to us by your contracted water supplier.

How we use your information

We use your information for many purposes, including to:

• Facilitate the installation of our products and allow fulfilment of our services
• Promote the interests of our company
• Manage our employees
• Manage the work of our field engineering team(s)
• Advertise, promote and market our services
• Notify you about a change to our service
• Fulfil our contractual obligations to identify leaks in supply-side or sewerage to your water company

How long we keep your data;

Subject to the following exceptions, Invenio-Systems adhere to a 3 year standard for retaining all personal data.

a) Unless requested to do so (see ‘Your Rights section below) and we are able to delete your data with no consequence to the delivery of our contracted service to your water company.

b) Unless we decide there is no need to hold your data, we will delete it.

c) Unless by default, other legal processes effectively determine the retention period of data – e.g. if you are a corporate client of Invenio, a supplier or customer of our services, accounting and banking systems retain data for 6 years as standard. Note, accounting and banking retentions operate independently of other deletion protocols.

d) Unless you are a corporate client of ours (i.e. a water company), in which case, your data is required to be processed as part of an on-going account management.

e) If not a customer, an active corporate client, supplier or partner organisation, yet there has been a financial transaction between you and Invenio-Systems, the details of such a financial transaction are held in our accounting systems for a period between 12 months and 24 months.

f) Unless you stop being an active corporate client of Invenio-Systems, we will after 3 years, archive the contractual information contained in the account file between us for a further period of 5 years. Note, any data concerning data surveys will be stripped from all such contractual archive files no longer than 3 years after it was taken.

How we keep your information safe

We use technical measures, such as encryption, and carry out regular security reviews to keep our protections up to date. We also control access and ensure staff who are authorised for access are adequately trained in keeping your information safe.

Our procedures mean that we may ask you to prove your identity before we share your personal information with you.

Third-party websites you access through links on our websites will have their own privacy policies. We do not accept any responsibility or liability for third party web-sites.

Sharing your information

We do not share your information with others unless you have consented, or it is necessary to do so except;

• where the law requires us to or
• where our administrative or operational requirements required us to share your information and you are informed of such processes
• where our agreement with your water supply company means we return data originally sent to us by them and that data may include personal data

When we do have to share information, it is likely to be with:

• your water (supply) company
• third parties who provide ancillary services around the water-supply and sewerage networks – e.g.s. pipe and chamber-cleaning companies.  These include but are not restricted to the following 3^rd parties;

Man Tank; mantank.co.uk

Enviroclean; evcsl.com

Lanes for Drains; lanesfordrains.co.uk

• Third party water and sewerage throughput engineering teams. These include but are not restricted to the following 3^rd parties;

RPS; rpsgroup.com

Hydrosave; hydrosave.co.uk

• Law enforcement agencies.

In addition, Invenio-systems use a number of technology support organisations and software vendors who provide solutions to assist in processing, maintain data and network integrity – i.e. for data back-up.  The following companies have access to personal data collected in the course of our operational business;

• Microsoft OneDrive; One Microsoft Place, South County Business Park, Leopardstown, Dublin18 P521 Ireland
• Amazon; Burlington Plaza, Burlington Road, Dublin 4, Ireland
• Domain host including email; Clear Chaos, 15 Rowen Close, Stockton-on-Tees, TS17 5DX

Wherever personal data is shared between Invenio Systems and third parties, it is done so under purposed processing agreements.

Data Transfer Outside the EEA

Sometimes we may transfer your details to third parties outside of the European Economic Area (EEA). If this happens we will make sure the transfer and storage of your information still complies with UK or EEA laws and this privacy policy.

Cookies

There are no cookies in place for the Invenio-Systems website.

What we do

When you use email or our web-enquiry-form it is likely you know what information you are sharing with us.

How we use and process your information, who accesses it, and how long we keep it, depends on the context in which we collected it, but follows the terms of our privacy policy and UK law.

The information is normally handled by our authorised staff, but if we intend to share it with third parties beyond those that are detailed in this policy, we will make every effort to let you know.

Payments and Receipts

We do not use any financial information for any purpose you have not authorised, or disclose it to third parties without your permission.

In order to process electronic banking transactions between us, we collect sufficient data including bank account detail. In some instances, some of the data we add to our accounting systems is personal data – e.g. where we make or receive payments from sole traders.

When we make or receive payments to or from our trading customers or other parties, an individual’s name or other personal identifying information may be used as a payment source or reference for these transactions.

Where the transaction is either a one-off or infrequent, we do not maintain any data beyond our end-of-year accounting process – i.e. data is retained in our accounting database for 24 months or less.  Note however, our bank account will reference payee and/or receipt data reference for a period up to 7 years.  In both cases, Invenio-Systems use established and secure data systems for financial transaction data processing.

Where there is an on-going relationship between Invenio-Systems and you/your company, we retain your banking detail in our accounting software, together with other personal data such as name (individual) or contact name (corporate).

Who has access to your information

Invenio Systems staff and contracted data processors have access to your payment details to carry out your transaction.
Our contracted data processors are;

• Xero, Bank House, 171 Midsummer Boulevard, Milton Keynes, MK9 1EB
• Simon Alderson Accountancy, 19b Front Street, Sacriston, Co. Durham, DH7 6JS

Children

Our websites, services and products are not aimed at children and we do not knowingly collect any information from them.

We ask children not to register with us or give us any of their information.

Where we have inadvertently collected information from a child, we will delete it as soon as possible.

If you know that a child has given their information to us, please contact us at phillip,clegg@Invenio-Systems.co.uk

Your rights;

 You have the right to:

• Ask for a copy of any information we hold about you (Subject Access Request process now defined)
• Where consent is used as our legal basis for any processing, you may withdraw any consents you have given.

  Note, for our throughput monitoring services, Invenio Systems are a data processor under a contractual relationship with your water company who are the data controller.  The legal basis for data-processing is in the legitimate interests of Invenio-systems to meet our contractual obligation to our client; your water supplier/company.  Also note, you already have a contractual relationship with your water supplier which allows that supplier to procure specialist services to help them manage their network.  The terms of this data share are detailed in your water company’s own privacy statement to you which will also detail the respective procedures for how you clarify and/or raise concerns in respect of data processing. For clarity, you should first contact your water company in connection with any queries concerning data processing – we may direct your query to them if you have not already made such an approach.

• Lodge a complaint with us or the Information Commissioner’s Office or with any other relevant supervisory authority about how we handle your personal data
• Ask us to correct any inaccurate or incomplete information we have about you
• Ask us to delete your information from our records
• Ask us to send a copy of your information to a third party in a data portable format.

Changing your contact preferences

You can change your contact preferences or withdraw your consents at any time by writing to us at phillip.clegg@Invenio-Systems.co.uk or:

Making a request to see your information

To see the information we hold about you, you should make a Subject Access Request (SAR) in writing.  Please contact us by email or post to obtain a SAR request form you may use to request your data.  This form requests the following personal data;

• Full name, including previous or other names, if appropriate together with
• Either your address or your business address if the request relates to individual data captured in the course of our business operations

Email; phillip.clegg@invenio-systems.co.uk

By post; Phillip Clegg, Invenio Systems Ltd, The Hub, Crowther Road, Washington, Tyne and Wear, NE38 0AQ

Questions

If you have any comments or concerns about an aspect of this policy or any privacy or data protection issue, please email our Privacy Team phillip.clegg@Invenio-Systems.co.uk.

We may also be contacted at The Hub, Crowther Road, Washington, Tyne and Wear, NE38 0AQ