Privacy Notice
This Privacy Notice details how Affinity Water, Severn Trent and The Canal & River Trust (“We”, “Our” or “Us”) collectively manages and processes personal data collected or received when users visit our website for the Grand Union Canal Transfer project – www.guctransfer.co.uk (the “Website”) or provide personal data through any means in response to this project.
Affinity Water, Severn Trent and The Canal & River Trust are acting as joint data controllers for the Grand Union Canal Transfer project (the Project). This means that collectively we are responsible for choosing the type of data used, and how such data is going to be used for the Project.
Registered addresses of joint controllers
| Affinity Water Limited | Severn Trent | The Canal & River Trust |
| Affinity Water Ltd, Tamblin Way, Hatfield, Hertfordshire. AL10 9EZ | Severn Trent Centre, 2 St John’s Street, Coventry. CV1 2LZ | National Waterways Museum, South Pier Road, Ellesmere Port, Cheshire. CH65 4FW |
What information do we collect?
We may collect, use, store and transfer different kinds of information about you which we have grouped together as follows:
Identity Data
- Includes first name and surname
- If you represent an organisation relevant to this work
Contact Data
- Email, home or business address, postcode and telephone number
Technical Data
- Internet Protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this Website.
Opinions
- Opinions you provide to us, including questions and comments you may make on the Website or by any other means such as by email or as part of a consultation event.
- Any pertinent information you may wish to provide to us in order that we can consult with you effectively.
Aggregated Data
- Such as statistical or demographic data for any purpose. Aggregated Data is not considered personal data in law as this data does not directly or indirectly reveal your identity. An example of Aggregated Data would be where we use your Usage Data to calculate the percentage of users accessing a specific Website feature. If the Aggregated Data is combined with other personal data to directly or indirectly identify you, we will treat this combined data as personal data and in accordance with this Privacy Notice.
We will never share, trade, or sell your personal data to a third party for marketing purposes.
Cookies and similar technologies
When someone visits this Website, we collect standard internet log information and details of visitor behaviour patterns to find out things such as the number of visitors to various parts of the Website. We do this by using cookies (and similar technologies) and Google Analytics. Cookies are small text files placed on your computer by websites you visit. They are widely used to make websites work, or work more efficiently, as well as provide information to the owners of the website. All website users will be asked to consent to non-essential cookies. More information can be found on our Cookie Notice.
We usually collect this information in a way which does not identify individuals and we do not make any attempt to find out the identities of those visiting. We will not associate any data gathered from this site with any personally identifying information from any source. If we do want to collect personally identifiable information through the Website, we will highlight this in advance. We will make it clear when we collect personal data and will explain what we intend to do with it.
How we will use your personal data
We use your personal data to:
- To inform the design of the Grand Union Canal Transfer scheme and inform the application for a Development Consent Order
- To keep you up to date with the Project and relevant developments
- To meet any requirements under the relevant statutory processes and to comply with law
Who will have access to your personal data?
Personal data will only be handled by our trained employees who have a legitimate business need to access your personal data for the purposes set out in this Privacy Notice.
We may also share your personal data with the contractors and sub-contractors that are supporting on this Project such as our consultation partner, our partners in the Grand Union Canal Transfer project, relevant governmental bodies such as the Planning Inspectorate, the Secretary of State for the Environment, Food and Rural Affairs (“Defra”), and/or any other organisation, as required by the relevant statutory processes and to comply with law.
We may be required to share any non-statutory and statutory consultation responses to the Planning Inspectorate, Defra and other relevant government bodies so that responses can be considered as part of the DCO Application process. The response may therefore be made public, however, we will request that your personal details are not placed on public record.
AECOM Limited (AECOM) have been instructed to act on our behalf for the purposes of correspondence and consultation, you may therefore receive a response from either AECOM or the Grand Union Canal Transfer depending on the nature of your query. AECOM act under a data processing agreement with Affinity Water Limited.
If a business transfer or change of business ownership takes place or is envisaged, we may transfer your personal data to the new owner (or a prospective new owner). If this happens, you will be informed of this transfer.
Legal basis for processing your personal data
We must have a legal basis for processing your personal data. We predominately process your personal data under the following legal grounds:
- It is necessary in order to fulfil our legitimate interests (or those of a third party) to perform a non-statutory consultation process. Following a non-statutory consultation process allows for early identification of issues which can be addressed before the statutory consultation commences.
- To comply with our statutory consultation obligations under the Planning Act 2008 (as amended).
In some cases, we may use more than one legal basis for processing your personal data; this will depend on the specific purpose for which we are using your personal data.
How long do we retain data?
We shall only retain your personal data in a form that permits identification only for as long as necessary to fulfil the purpose for which it was collected, for example, for as long as required to support the Development Consent Order application for the Project. In addition, we may retain your personal data for the duration of:
- any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data may be relevant); or
- an additional reasonable period following the end of such applicable limitation period.
In addition to the above:
- if any relevant legal claims are brought, we may continue to process your personal data for such additional periods as are necessary in connection with that claim.
Where your personal data is retained for claim limitation purposes or for a reasonable period thereafter, we will restrict our processing of your personal data to the storage of, and maintaining the security of, those personal data, except to the extent that those personal data needs to be reviewed in connection with any legal claim or obligation under applicable law.
After this period your personal data will be anonymised so that you are no longer identified or identifiable from such information, or securely deleted/destroyed.
Any third parties that we engage will keep your personal data stored on their systems for as long as is necessary to provide the relevant services to you or us. If we end our relationship with any third-party providers, we will make sure that they securely delete or return your personal data to us.
We may retain personal data about you for statistical purposes. Where personal data is retained for statistical purposes, it will always be anonymised, meaning that you will not be identifiable from that data.
How do we protect your personal data?
We are committed to maintaining the privacy and security of the personal data you provide to us through the deployment of physical, technical and organisational security procedures designed to secure your personal data against accidental loss, destruction or damage and unauthorized access, use, alteration or disclosure.
When we engage suppliers and partners to process data on our behalf, we do so based on written instructions, ensuring the third party has implemented appropriate technical and organisational measures to ensure the security of data. In all circumstances, we will ensure that the data is protected and transferred in a manner consistent with applicable data protection laws.
We ensure all our staff are trained in data protection so they understand how they can help keep your personal data safe from unauthorised use and access. Your personal data is held on secure systems and servers with access controls in place on a need to access basis.
Transfers of your personal data outside the UK
We do not anticipate transferring your personal data outside of the UK. In the event that your personal data is to be transferred, and stored with, a recipient outside the UK to a country not recognised as providing an adequate level of protection for personal data we will ensure the transfer shall be covered by appropriate safeguards as established in Article 46 of the UK General Data Protection Regulation (UK GDPR).
Unfortunately, the transmission of your personal data via the internet is not completely secure and although we do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to us over the internet and you acknowledge that any transmission is at your own risk.
External links
The Website may contain links to third-party sites. This Privacy Notice does not apply to those third-party sites. We recommend that you read the privacy notices of any other sites that you visit as we cannot accept responsibility for the privacy practices of these sites, which may differ from ours.
Your rights
The legal rights you have in relation to your personal data are summarised below:
Right to be informed – You have the right to be informed about the collection and use of your personal data, as covered by this Privacy Notice.
Right of access – You have the right to access and receive a copy of your personal data, and other supplementary information (subject to a limited number of exemptions).
Right to rectification – You have the right to have inaccurate personal data rectified, and incomplete personal data completed.
Right to erasure – You have the right to request erasure of your personal data in certain circumstances.
Right to restrict processing – You have the right to request restriction or suppression of your personal data.
Right to data portability – Where we are processing your personal data based on your consent or for the performance of a contract you may request that we transfer your personal data to another organisation in a structured, commonly used machine-readable format. This only applies to personal data provided to us by you.
Right to object – You have the absolute right to object to processing for direct marketing purposes. The right to request we stop processing your personal data also applies when we process your personal data based on a task carried out in the public interest or for our legitimate interests (or those of a third party). However, in these circumstances we may refuse to comply with your request if we can justify compelling legitimate grounds, or where the processing is for establishment, exercise or defence of legal claims.
Rights related to automated decision-making including profiling – You have the right not to be subject to a decision based solely on automated processing (no human intervention), where the decision affects your legal status or rights or where the decision has a similarly significant effect. This type of processing is permitted where the decision is necessary for entry into or performance of a contract with you; is authorised by law; or based on your explicit consent.
If we are processing your personal data on the basis of consent you have the right to withdraw your consent at any time. If you decide to withdraw your consent, we will stop processing your personal data for that purpose unless there is another lawful basis we can rely on.
You can exercise your rights free of charge by contacting Affinity Water, using the details provided below. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up and improve our response to you.
We will comply with your request within one calendar month (from the time we receive your request, or upon receipt of any additional information we have requested from you). Occasionally we may require more time to respond to your request if your request is complex. We will notify you within one month to inform you that we require additional time to comply with your request.
In exceptional circumstances where your request is manifestly unfounded or excessive, we may charge you for your request, or refuse to comply with your request. We will always inform you of the reasons for not being able to comply with your request.
If you are unsatisfied with our response to any data protection issues you raise with us or our DPO, you have the right to make a complaint to the ICO. The ICO is the authority in the UK which is tasked with the protection of personal data and privacy and contact details can be found at https://ico.org.uk/global/contact-us/.
Contact:
If you have any questions or concerns about how we handle your personal data, you can contact us by:
Post: FAO Data Protection Officer
Legal, Risk & Compliance
Affinity Way Ltd
Tamblin Way
Hatfield
Hertfordshire. AL10 9EZ
Email: data.protection@affinitywater.co.uk
Changes to this Privacy Notice
We may update this privacy notice from time to time and it is recommended that you review it on occasion for possible changes. This Privacy Notice was last updated March 2024.
