Privacy Policy
Who is Business Stream?
Scottish Water Business Stream Limited, (company number SC294924), having a registered office at 1-3 Lochside Crescent, Edinburgh EH12 9SE, is committed to protecting and respecting your privacy and personal information.
In this privacy statement references to "we", "Business Stream" (and connected words such as "us" or "our") refer to Scottish Water Business Stream Limited. We use the term "personal information", to describe the information we receive or collect about you.
This statement is intended for users of the Business Stream web platforms such as this website, our “my business stream” service as well as customers that receive or intend to receive services from us, download or use one of our apps and visitors to our offices.
Business Stream’s provides water and waste water retailer services to non-household customers in Scotland, England and Wales as well as value added services such as water efficiency solutions.
To operate as a retailer in the non-household retail water markets in Scotland and England and Wales we are required for legal and regulatory reasons to share information with other parties including other retailers and wholesalers (collectively called “trading parties”), two market operators (Market Operator Services Limited (“MOSL”) and Central Market Agency (“CMA”)) as well as our regulators Water Industry Commission for Scotland and Ofwat. Where the customer is a sole trader or a partnership in England some of the information we share would be personal information. For data that we share within these markets, we are joint controllers along with the other trading parties and the market operators in certain circumstances. For further information on how personal data is used in the English market along with a summary of the arrangements and allocation of responsibilities between joint data controllers please see MOSL’s summary of arrangements document file (mosl.co.uk).
This privacy statement (together with our terms of use and any other documents referred to on it) explain how we collect, use and share and/otherwise process your personal information. Please read the following carefully to understand our views and practices regarding your personal information and how we will treat it.
How we use your personal information
This privacy statement explains how we collect and use personal information about you.
In general terms, we collect and use personal information to:
- deliver our services, meet our legal responsibilities and regulatory obligations
- verify your identity where this is required
- contact you by post, email or telephone, including automated voice mail and SMS
- understand your needs and how they may be met
- maintain our records
- process financial transactions
- prevent and detect crime, fraud or corruption
When do we collect your personal information?
- When you visit any of our websites.
- When you request a quote from us online, over the phone or face to face.
- When you create an account with us through my business stream or our app.
- When you contract with us online, over the phone or face to face.
- When you engage with us on social media.
- When you download or install one of our apps.
- When you contact us by any means with queries, complaints etc.
- When you ask one of our employees to email you information about a product or service.
- When you enter prize draws or competitions.
- When you book any kind of appointment with us.
- When you choose to complete any surveys we send you.
- When you comment on or review our products and services.
- When you fill in any forms. For example our new connection forms.
- When you’ve given a third party permission to share with us the information they hold about you.
- We collect data from publicly available sources (such as Land Registry, Scottish Assessor Association and Companies House) when you have given your consent to share information or where the information is made public as a matter of law.
- We collect data indirectly from other trading parties, MOSL and CMA.
- We may purchase contact data from business information providers.
- When you visit our offices which have CCTV systems operated for the security of both customers and staff. These systems may record your image during your visit.
- When you visit our offices and sign our visitor’s book.
What sort of personal information do we collect?
We may collect and process the following personal information about you:
- Information that you provide by registering with us, corresponding with us by phone, email or otherwise, or if you receive a service from us. The information you give us may include your name, date of birth, gender, address, email address, job title, the organisation you work for, log-in details, social media name, reference number, supply point ID and phone number. If you contact us, we may keep a record of that correspondence.
- Information relating to your account detail and supply point where you are a sole trader or a partnership in England. This may include customer classifications including unique identifiers, meter information or market consumption data. The information we hold is described in detail in the market data catalogue (Code Subsidiary Document 0301).
- Information such as court proceedings or other information relating to creditworthiness that may be obtained from a credit check we may undertake.
- CCTV images and car number plate when you visit one of our offices in person.
- Information that you submit by using our site’s online payment facility, or over the phone with us, where you submit your credit/debit card details to WorldPay Limited ("WorldPay") which provides secure, online, real-time payment services to Business Stream. Further information about WorldPay can be found below.
- Information gathered by the use of cookies in your web browser. We may additionally collect information about how you access our services, including technical information such as the Internet Protocol (IP) address used to connect your computer to the internet.
- Information about your health. Former customers of Yorkshire Water Business Services may have provided information regarding health conditions to ensure additional assistance in the event of a water disruption and/or part of the credit management process. The legal basis for processing this category of information includes your consent or processing was necessary for a legal claim.
How and why do we use your personal information?
We want to provide the best possible customer service while meeting our obligations as a retailer in the non-household water retail markets in Scotland and England and Wales. To be able to do this we use your personal information in the following ways:
|
What we use your personal information for |
Our reasons |
Our legitimate interests |
|
Serving you as a customer |
||
|
• To manage our relationship with you or your business |
• Your consent |
• Keeping our records up to date, working out which of our products and services may interest you and telling you about them • Being efficient about how we fulfil our legal and contractual duties |
|
Managing our operations |
||
|
• To deliver of our products and services To participate as a retailer in the non-household retail water markets in Scotland and England and Wales |
• Fulfilling contracts |
• Being efficient about how we fulfil our legal and contractual duties |
|
Business improvement |
||
|
• To test new products |
• Fulfilling contracts |
• Developing products and services, and what we charge for them |
|
Business management |
||
|
• To run our business in an efficient and proper way. This includes managing our financial position, business capability, adding and testing systems and processes, managing communications, corporate governance, and audit • To exercise our rights set out in agreements or contracts |
• Our legitimate interests • Fulfilling contracts |
• Complying with rules and guidance from regulators |
|
Managing security, risk and crime prevention |
||
|
• To detect, investigate, report, and seek to prevent crime, including financial crime |
• Fulfilling contracts |
• Developing and improving how we deal with financial crime, as well as doing our legal duties in this respect |
Who do we share your personal data with?
We may share your personal information with outside organisations such as other trading parties, market operators and regulators. This is so that we can provide you with products and services, run our business, and obey rules that apply to us. Here we list all the types of organisation that we may share your personal information with.
- Any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006;
Authorities
This means official bodies that include:
- Central and local government
- HM Revenue & Customs, regulators and other tax authorities
- UK Financial Services Compensation Scheme and other deposit guarantee schemes
- Law enforcement and fraud prevention agencies
- Regulators such as Water Industry Commission for Scotland and Ofwat
- Ombudsman such as Scottish Public Services Ombudsman and Water Redress Scheme
- Environmental Agency and Scottish Environment Protection Agency
- To provide retail services
Outside companies and organisations we work with to provide services to you and to run our business:
- Agents, suppliers, sub-contractors and advisers these are types of firm that we use to help us run accounts, policies and services.
- IT companies who support our website and other business systems
- Analytics and search engine providers, that assist us in the improvement and optimisation of our site
- Agents who help us to collect what is owed to us
- Credit reference agencies (such as Experian and Graydon), see below
- Someone linked with you or your business’s product or service, this could mean a joint account holder, trustee, or fellow company director
- Third Party intermediaries this could be someone who advises you on things like water bills and water efficiency measures. We won’t share any personal information unless they have your consent to ask us for it.
- Other trading parties
- Market Operators MOSL and CMA
- If you use direct debits, we will share your data with the Direct Debit scheme.
- Market researchers we send data which these firms combine with data from other sources to produce market trend reports and advice.
- Advisers who help us to come up with new ways of doing business. This might be a legal firm, IT supplier or consultancy.
Credit reference agencies
- We will supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/
WorldPay - automated payment process – credit and debit card information:
- WorldPay is a secure online, real-time payment service provider, which supports all major credit and debit cards. WorldPay is part of The Royal Bank of Scotland banking group. WorldPay – and not Business Stream – is the data controller of this information.
- WorldPay is bound by data protection laws. If you have any queries regarding WordPay’s data protection policy, you can contact them at worldpay.com/shopper.
- If you would like a copy of the information WorldPay hold about you, you can write to: The Royal Bank of Scotland plc, 36 St Andrew Square, Edinburgh, EH2 2YB. Please note a fee may be payable.
- Business Stream does not store, hold use or process your credit/debit card details at any time.
- If you make a payment over the phone, a confirmation SMS text message will be sent to you to confirm the payment amount and the account to be credited.
- Business Stream will ask you to supply your customer reference, name, amount to pay, supply address and email address. This information may be kept for a period of up to six years for accounting purposes by Business Stream. You will then be transferred to a secure payment area maintained by WorldPay, where you will be prompted for your credit/debit card details to complete the transaction.
- WorldPay processes your payment and provides Business Stream with confirmation and details of your payment. These details include your IP address.
If you choose not to give personal information
You can choose not to give us personal information. In this section we explain the effects this may have.
We may need to collect personal information by law, or to enter into or fulfil a contract we have with you.
If you choose not to give us this personal information, it may delay or prevent us from fulfilling our contract with you, or doing what we must do by law. It may also mean that we cannot run your accounts or policies. It could mean that we cancel a product or service you have with us.
How long do we keep your personal information?
This section explains how long we may keep your information for and why
We will keep your personal information for as long as you are a customer of Business Stream.
We may keep your data for up to 8 years after you stop being a customer. The reasons we may do this are:
- To respond to a question or complaint
- To study customer data as part of our own internal research
- To obey rules that apply to us about keeping records
Where your personal information may be processed
This section tells you about the safeguards that keep your personal information safe and private, if it is sent outside the EEA.
Sometimes we will need to share your personal data with third parties and suppliers outside the European Economic Area (EEA).We will only send your data outside of the European Economic Area (‘EEA’) to:
- Follow your instructions
- Comply with a legal duty
- Work with our suppliers who help us to run your accounts and services
If we do transfer your personal information outside the EEA to our suppliers, we will make sure that it is protected to the same extent as in the EEA. We’ll use one of these safeguards:
- Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA. Learn more on the European Commission Justice website.
- Put in place a contract with the recipient that means they must protect it to the same standards as the EEA. Read more about this here on the European Commission Justice website,
- Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA. You can find out more about data protection on the European Commission Justice website.
Using our website
Cookies are small computer files that get sent down to your PC, tablet or mobile phone by websites when you visit them. They stay on your device and get sent back to the website they came from, when you go there again. Cookies store information about your visits to that website, such as your choices and other details. Some of this data does not contain personal details about you or your business, but it is still protected by this Privacy notice. For detailed information on cookies, please see our Cookie Policy.
Our site may, from time to time, contain links to and from the websites of our partner networks. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.
What are your rights over your personal data?
Access to your information – You have the right to request a copy of the personal information about you that we hold.
Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Deletion of your information – You have the right to ask us to delete personal information about you where:
- You consider that we no longer require the information for the purposes for which it was obtained
- We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
- You have validly objected to our use of your personal information – see Objecting to how we may use your information below
- Our use of your personal information is contrary to law or our other legal obligations.
Objecting to how we use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest or pursuant to the legitimate interests of us or a third party then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue. You can opt out/object to the processing of your personal information for marketing purposes at any time by contacting us here.
Restricting how we use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information but you don't want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Portability – if we process personal information that you provide to us on the basis of consent or because it is necessary for the performance of a contract to which you are party, and in either case that processing is carried out by automated means, then you have the right to have that personal information transmitted to you in a machine readable format. Where technically feasible, you also have the right to have that personal information transmitted directly to another controller.
Automated processing – if we use your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual to whom you may make representations and contest the decision. This right only applies where we use your information with your consent or as part of a contractual relationship with you.
Withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained by contacting the Data Protection Officer on the contact details given below.
This privacy statement was last updated on 11 January 2022 to provide more information on the joint controller arrangements in the English market, including a link to the MOSL summary of arrangements document.
Contact information and further advice
We hope this Privacy Statement has been useful in setting out the way we handle your personal information and your rights.
If you have any questions that haven’t been covered, please contact our Data Protection Officer:
- Email compliance@business-stream.co.uk
- Or write to us at:
Data Protection Officer, Business Stream, 1-3 Lochside Crescent, Edinburgh EH12 9SE
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office:
Online: https://ico.org.uk/global/contact-us/
By phone: 0303 123 1113
By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
We’re fully committed to improving our environmental performance and are certified to ISO 14001:2015. You can find out more in our environmental policy. Our Solutions team are certified to ISO 9001:2015 and ISO 45001:2018.
