Privacy policy

1. Who is responsible for your data

Pozzani Pure Water Ltd (trading as Drinking Water Testing), company number 02215909, of Warwick Road, Fairfield Industrial Estate, Louth, Lincolnshire, LN11 0YB, is the data controller for the personal data described in this notice. We are registered with the Information Commissioner's Office under registration number Z1095827. The person responsible for data protection at Pozzani is Ian Walmsley, Commercial Director. You can reach us about anything in this notice at enquiries@drinking-water-testing.co.uk, on 01507 608 100, or by post to the address above, marked for the attention of the Data Protection Lead.

2. What we collect

When you order a test or create an account we collect your name, email address, telephone number, delivery and billing addresses, and the details of what you ordered. Account customers may also give us a purchase order reference.

To analyse your water we hold details of the sampling point (for example the address of the property, borehole or pool, and which tap the sample came from), the laboratory results for each sample and the notes our team add to them. These are kept in your account as a history of the supply.

When you contact us by email, telephone, WhatsApp or the contact form we keep the correspondence.

When you browse the website our server records the IP address, browser type, the pages you visit and the time of each visit, and assigns a session identifier. We use this to keep the site secure, to tell visitors from automated traffic and to see which pages are used.

We do not collect special category data. If you tell us something about your health in the course of an enquiry, for example that a household member is immunocompromised, we use it only to advise you on the test and do not store it beyond that correspondence.

3. Payment details

Card payments are taken by Stripe on its secure checkout page. Your card number goes directly to Stripe and is never seen or stored by us. We receive a payment reference and confirmation that payment succeeded. Stripe's own privacy notice is at stripe.com/gb/privacy.

4. Why we use your data and our lawful basis

• To fulfil your order: sending the kit, analysing the sample, publishing results and handling cancellations, refunds and queries. Lawful basis: performance of a contract with you.
• To run your account and keep the history of each sampling point so you can see how a supply has changed. Lawful basis: performance of a contract.
• To tell you about a result that needs action and, where appropriate, to put you in touch with a Pozzani water treatment engineer. Lawful basis: performance of a contract and our legitimate interest in helping you act on a failed result. You can tell us not to.
• To keep accounting and tax records. Lawful basis: legal obligation.
• To keep the website secure and understand how it is used. Lawful basis: our legitimate interest in running a reliable, secure service.

We do not send marketing email unless you have asked for it, and every marketing message includes a way to stop. We never sell your data.

5. Who we share your data with

• The UKAS-accredited laboratory that analyses your sample. It receives your name, contact details and the sampling point details along with the sample, because its accreditation requires it to know whose water it is testing and to be able to contact you directly if a result needs urgent action. The laboratory acts under a contract with us and may use your data only for the analysis.
• Pozzani water treatment engineers, who are part of the same company, when a result needs action.
• Stripe, for card payments (section 3).
• Postmark (ActiveCampaign), which delivers our transactional email such as order confirmations and results notifications.
• Royal Mail, which receives your name and delivery address to deliver the kit.
• Google, where analytics and advertising tools are enabled on the site (section 8), and, if you accept Google's invitation on the order confirmation page, your email address, order number and expected delivery date so that Google Customer Reviews can ask you to rate us after delivery. If you decline, nothing is sent.
• Amazon Web Services, which hosts the website and its database on our behalf in its Ireland (EU) region.
• Our professional advisers, and regulators or law enforcement where the law requires it.

Each of these acts under a contract that limits what they may do with your data. Where data leaves the UK, for example to a US-based provider such as Stripe, Postmark or Google, it is protected by the UK's adequacy regulations or the International Data Transfer Agreement.

6. Our Polish website

The Polish-language pages at /pl are published by Pozzani Pure Water Ltd. Enquiries made from them are handled by our sister company, Pozzani Polska Sp. z o.o. in Toruń, which acts as a separate controller for the enquiries it receives.

7. How long we keep your data

• Orders, invoices and payment references: seven years from the end of the tax year, as HMRC requires.
• Laboratory results and sampling point history: for as long as your account is open, so your history is complete. If you close your account we keep the results with the order record for the period above and then delete them.
• Correspondence: three years from our last contact.
• Website visit records (IP address, pages visited): 90 days, after which they are deleted automatically.

8. Cookies and similar technologies

The website sets a small number of strictly necessary cookies: a session cookie that keeps you signed in and holds your basket, a security token that protects forms from forgery, a "remember me" cookie if you choose it at sign in, and a cookie that records your cookie choices. These are needed for the site to work and do not require consent. They are not used to track you across other sites.

With your consent, which we ask for in the banner on your first visit, we also use Google tools loaded through Google Tag Manager:

• Analytics (Google Analytics) tells us which pages are visited, how visitors arrive and where they leave, so we can improve the site.
• Advertising (Google Ads) measures whether our adverts on Google led to an order and lets Google show you adverts for our tests on other sites. This involves Google setting cookies on your device and receiving your IP address and the pages you visit here.

Neither is used until you allow it, and you can allow one without the other. Google's privacy notice is at policies.google.com/privacy. Where you refuse, Google may still receive anonymous, cookieless signals that no advert or visit is attributed to you, which it uses to estimate overall figures.

You can change or withdraw your choice at any time using the Cookie settings link at the foot of every page. Your choice is kept for six months, after which we ask again. You can also block or delete cookies in your browser settings; blocking the strictly necessary cookies will stop the basket and sign-in from working.

9. Security

The website is served over HTTPS. Passwords are stored as one-way hashes, access to customer records is limited to staff who need it, and our admin system is restricted to our own network. No system is completely secure; if we become aware of a breach affecting your data we will tell you and the Information Commissioner's Office where the law requires it.

10. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct data that is inaccurate or incomplete (you can update your contact details in your account);
• erase your data where we no longer need it, subject to the retention we must keep for tax purposes;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format where processing is based on contract;
• withdraw consent at any time, where we rely on it.

To exercise any of these rights, email enquiries@drinking-water-testing.co.uk. We will respond within one month. We may ask you to confirm your identity before releasing data.

11. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Our ICO registration number is Z1095827.

12. Changes to this notice

We will update this notice when our practices change and show the date of the latest version at the top. Significant changes will be notified to account holders by email.