The Board, as personal data controller, collects, maintains and further processes consumer data in accordance with the provisions of Regulatory Administrative Act 159/2012 as in force, issued under the Water Supply Of Municipal and Other Areas Act. In other words, it has as it’s the provisions of the Law on the majority of activities carried out in consumer data. In particular, data shall be collected and maintained through applications submitted by applicants for:
• The water supply of the premises
• Installation of a water system in land separations
• The return of the guarantee for the construction of the water meter cabinet after the connection of the water meters to the premises and the completion of the apartment building
• Consumer's application to be placed in the category of industrial charging
• Consumer's application to be subject to the multi-child charge
• Request to review the account in case of leakage
• Consumer's request for reconnection
• Disconnect Request
• Pricing and Billing of the Premises
• Water meter accuracy check
The data collected in these cases are: Name, Telephone Number, Home Address, Property Share, Address of Shipment of Accounts, Property Title of Premises, Signature, Identity Number, and Sales Document/Proof of Land Registry. They are necessary information for the identification of the Consumer mainly for reasons of correct billing and for the correct identification of the premises.
Furthermore, on the basis of Regulatory Administrative Act 159/2012, the Board collects the consumption data of the premises from the hydrometer, in order to carry out the billing and sending the account to the Consumer's contact address.
Another process carried out by the Council according the legislation is due to the power of the Chairman to order, by authorising an official of the WBL, an inspection of the premises. The sole purpose of this activity is to carry out the powers and fulfil the tasks set out in the Law and no other action can be taken through this authorization.
The Council, with the consent of the Consumer, may send the water bill by electronic means. The legal basis for this processing is therefore Article 6(2) of the EC Treaty. 1(a) of Regulation (EU) 2016/679. Consent shall be given by submitting, either in person or electronically, an application to which no. Consumer, Name, identity card number, Premises Address, No. Mobile, email, signature. The Board uses the above data for the sole purpose of sending an account by electronic means and the Consumer has the right to demand the cancellation of his request and the return to the sending of a paper account at any time. In this case, once the consent of the subject for the sending of the electronic account has been withdrawn the Board shall not further process the relevant data of the Consumer and any data collected shall be stored securely for as long as is necessary for the Council to either carry out internal checks or respond to legitimate requests from authorities in accordance with the applicable legislation and at the end of that period shall be destroyed.
The Board also acts as the processor for the Water Board as it is its responsibility to issue the waste control fee.
The Board shall not transmit the data to third parties, other than those referred to herein, its Executing or Jointly Responsible Partners, except where it has an obligation under the law of the Union or of a Member State and always in accordance with the provisions of European and Cypriot law, in compliance with appropriate technical and organisational measures to ensure their integrity and confidentiality. The Board shall not transmit the data to third parties or to bodies outside the European Union and, if it has to transmit it outside the European Union, this shall be done in accordance with Articles 44p. GDPR Regulation.
In order to ensure compliance with the Rules of Procedure with regard to the transfers concerned, the Board has made all necessary guarantees and shall examine them on a case-by-case basis.
In the context of the provision of its services, the Board shall transmit personal data to third parties or data processors in the following cases:
The Board uses an external Partner for the provision of Telephone Centre services as for the best service of Consumers and ensures that the choice of the Partner and the processing that will be performed on the Data of Consumers will be in accordance with Regulation (EU) 2016/679 and the Cyprus legislation on the processing of data. If, by choice and at the request of the Consumer, the order to repay the account by direct order to the Bank of the Consumer is given, the Council shall, on the legal basis of processing, execute a contract, i.e. the Article 6(1)(b) of Regulation (EC) No 1(b) of the Regulation proceeds to process the consumer's data with a view to activating and executing the relevant request and cancelling the request respectively by transmitting or receiving from the Bank of the Consumer the necessary data. In this case the Consumer gives only the information necessary for the execution of his requests (Name, Address, Account No, Bank, IBAN, Signature, Debtor Identification Code, Name of the person for whom payment is made, Facial Identification Code and IBAN) and the Council processes them for the sole purpose mentioned and in case of cancellation of the relevant request the Council does not further process the data provided for this purpose.
Finally, the Board for the safety of its persons and liability assets uses closed-circuit surveillance at the entrance of the building and at its external premises for which it has posted the necessary signs. The Council also works with a private company to print, and file and send the bills by post.
The Board may receive all applications which, by law or in the context of the performance of its contractual obligations, it is obliged to receive electronically via its website (wbl.com.cy). Electronic applications are securely stored in an electronic file accessible only to specially authorised persons. If they need to be printed or promoted and further processed in order to advance the process of examining requests, this is done without printing data that is not necessary or that can be categorized as expert data any categories sent along with the requests (such as a copy of an identity card or a copy of a passport).
The Board processes the personal data of the individual Consumer only for the absolutely necessary period of time provided for by law or necessary for the performance of the contract with the Consumer for the provision of his services or the processing of a request from the Consumer. Withdrawal of the consent, where given, to process the data means stopping the processing of data for the future without affecting the processing that has already taken place. For a longer period of time the Council may retain the data and process them only in order to serve its legitimate interests or in the context of compliance with the provisions of the applicable legislation or control order by competent authorities.
The Board, in full compliance with the Regulation, shall adopt deletion and anonymization procedures for the data it collects and maintains in accordance with technological developments. In any event, data which are not correct shall be deleted upon request for correction or if they are no longer correct or up-to-date or due to the satisfaction of a valid request for deletion. In the case of direct debit order data in particular, the Council shall, upon request for withdrawal of the request from the Consumer or after correction of the account details, delete only any data which are not necessary to carry out an audit of the orders and actions carried out.
The Board may process personal data for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes by applying technical and organisational measures, in particular to ensure compliance with the principle of minimisation of data or their anonymity as much as possible. In addition, the Board shall take all necessary technical and organisational measures to ensure the integrity, authenticity, confidentiality and accessibility of the data it maintains and processes, as it implements an integrated System for the Protection and Security of Personal Data and ensures the protection of both its physical space and its electronic environment. It shall also ensure that its system remains up-to-date through regular internal audits and reviews in order to ensure the continuity of its system and thus the continuous protection of personal data by adapting its system in line with technological developments, changes in legislation and needs. Finally, it selects partners including its electronic service providers and on the basis of the guarantees they also provide to the data they receive.
Consumers under the Rules of Procedure have the right to exercise a number of rights directly before the Controller. In particular, they have the following rights:
Right of information and access: The right to receive confirmation from the Board as to whether its data are being processed and the right of access to it and, but not limited to, information relating to: (a) the purposes of the processing, (b) the relevant categories of personal data, (c) the recipients or categories of recipients to whom the data have been or are to be disclosed; personal data, in particular recipients in third countries or international organisations, etc.
Right to Rectification: The right to require the Board l without undue delay to correct incorrect personal data concerning it.
Right to Erasure: The right to request the Board to delete personal data relating to it under conditions.
Right to Restrict Processing: The right to request, subject to conditions, the Board to restrict the processing of its rights.
Right to Data Portability: The right to request and receive from the Board a copy of the data held by the Board for the consumer in question in a structured, commonly used and machine-readable format, as well as the right to transmit such data to another controller where the processing is based on consent or contract in accordance with Article 6(1) (b) and the processing is carried out by automated means..
Right to Object: The right to object to a treatment by the Board where the Board has no legal right to process its data.
Right to Notice of Violation: The Board undertakes to inform Consumers and the Privacy Commissioner without delay of any breach of their data that may pose a high risk to their rights and rights freedoms of natural persons. The manner of disclosure (via individual email or by posting on its website) will depend on the type of violation and the number of Consumers it affects, as well as the ability to identify them.
Data Subjects can exercise their rights in writing by completing the special Rights Exercise Form, which can be obtained either in person from the Sly Funds, or downloaded from the WBL Website and sent to the Data Protection Officer at firstname.lastname@example.org. The Applicant completes his details in the Form and in particular (a) Name (b) Identity card number (c) email (d) address of residence which are necessary for his correct identification so as not to make mistakes in the event of a homonym. The email and home address are collected so that the Water Board of Limassol is able to send the reply to the applicant. The applicant shall also choose the method of sending a reply. If the applicant does not fill in the field, the reply of the WBL will be sent to him by e-mail.
The Applicant then selects from the list of the Form the Right or Rights he wishes to exercise at his request. In order to assess a request, a positive statement is required from the applicant who can fill in any other information he considers important. Finally, the applicant signs the Form and submits it either to the Addressed Official or electronically to the address mentioned above. The decision shall be notified to the applicant within one month or if there is to be a delay, it shall be informed of the reason and the length of the delay within one month. In the event of a right to do so, the Board undertakes to assess it and to respond within a reasonable period of time to the Space. However, if the Consumer still feels that his rights are not being met, he can contact the Office of the Commissioner for Personal Data Protection at the e-mail email@example.com and file a further complaint under the instructions he/she will find on its official website (http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en?opendocument).