WaterWorksX Limited (“WaterWorksX,” “we,” “us,” or “our”), a New Zealand company, is committed to protecting the privacy of individuals who visit our website, use our platform, or engage with our services. This policy explains how we collect, use, store, and disclose your personal information in accordance with applicable data protection laws, including the New Zealand Privacy Act 2020, the European Union General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), the UAE Federal Decree-Law No. 45 of 2021 (UAE PDPL), and the Kingdom of Saudi Arabia Personal Data Protection Law (KSA PDPL).
01 Information We Collect
We may collect the following categories of personal information:
- Contact & identity information — name, email address, phone number, job title, and organisation details provided when you enquire about or subscribe to our services.
- Account & usage data — login credentials, session activity, feature usage, and preferences within the WaterWorksX platform.
- Technical data — IP address, browser type, device identifiers, operating system, geolocation data, and access timestamps collected automatically when you interact with our website or platform.
- Operational data — asset telemetry, SCADA readings, sensor data, and infrastructure performance metrics submitted by or on behalf of water utility customers as part of service delivery.
- Communications — records of correspondence when you contact us for support or business enquiries.
- Commercial information — transaction records, billing details, and service history related to your use of our platform.
In the preceding 12 months, we have collected the categories of personal information described above. We do not sell personal information, nor do we share personal information for cross-context behavioural advertising. We do not collect or process sensitive personal information for purposes beyond those authorised under the CCPA.
02 How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the WaterWorksX platform and related services.
- Monitor infrastructure performance, generate analytics, and deliver actionable intelligence to authorised users.
- Communicate with you about your account, service updates, and support requests.
- Comply with legal obligations and enforce our agreements.
- Protect the security and integrity of our systems and data.
- Respond to lawful requests from regulatory and governmental authorities.
We process personal information only for the purposes for which it was collected. If we need to use your information for a materially different purpose, we will notify you and, where required, obtain your consent.
03 Lawful Basis for Processing
Depending on the applicable jurisdiction, we process personal information on one or more of the following lawful bases:
- Contract — processing is necessary for the performance of a contract with you or to take pre-contractual steps at your request.
- Legitimate interests — processing is necessary for our legitimate business interests, such as platform security, fraud prevention, and service improvement, provided these interests are not overridden by your rights.
- Consent — where you have given clear, informed consent for specific processing activities. You may withdraw consent at any time.
- Legal obligation — processing is necessary to comply with applicable laws, regulations, or court orders.
Under the KSA PDPL, consent is the default lawful basis for processing. Where we rely on an alternative basis such as contractual necessity or legitimate interest, we do so in accordance with the PDPL and its Implementing Regulations as enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA). We do not process sensitive personal data on the basis of legitimate interest alone.
04 Data Sharing & Disclosure
We do not sell, rent, or trade personal information. We may disclose information to the following categories of recipients:
- Technology partners — including Rockwell Automation, Inc. and its PartnerNetwork™ programme participants, where necessary for platform integration, edge computing services, or technical support. WaterWorksX is a participant in the Rockwell Automation PartnerNetwork™.
- Service providers — trusted third parties who assist with hosting, analytics, and support, bound by written data processing agreements and confidentiality obligations.
- Professional advisors — legal, accounting, and insurance providers as required for business operations.
- Regulatory or legal authorities — where disclosure is required by law, regulation, or valid legal process in any applicable jurisdiction.
- Your organisation — if you access WaterWorksX through an enterprise account, your employer or contracting organisation may have access to usage data.
- Business transfers — in connection with a merger, acquisition, or asset sale, personal information may be transferred to the acquiring entity subject to the same privacy commitments.
We have not sold or shared (as defined under the CCPA/CPRA) the personal information of any consumer in the preceding 12 months. We do not have actual knowledge that we sell or share the personal information of consumers under the age of 16.
05 International Data Transfers
As a New Zealand company working with global partners and customers, your personal data may be processed or stored outside your country of residence. We transfer data internationally only where appropriate safeguards are in place.
Where we transfer personal data outside the European Economic Area (EEA), we rely on adequacy decisions adopted by the European Commission, Standard Contractual Clauses (EU SCCs), or other approved transfer mechanisms under Chapter V of the EU GDPR. New Zealand is recognised by the European Commission as providing an adequate level of data protection.
Where we transfer personal data outside the United Kingdom, we rely on adequacy decisions, Standard Contractual Clauses (UK SCCs), or other approved transfer mechanisms under the UK GDPR and Data Protection Act 2018. New Zealand is recognised by the UK as providing an adequate level of data protection.
Cross-border transfers of personal data from the UAE are conducted in accordance with Federal Decree-Law No. 45 of 2021 and applicable executive regulations, ensuring an adequate level of protection is maintained.
Transfers of personal data outside the Kingdom of Saudi Arabia are conducted in compliance with the KSA PDPL and the Regulation on Personal Data Transfer Outside the Kingdom issued by SDAIA, including through Standard Contractual Clauses or Binding Corporate Rules where required.
Where personal information of Canadian residents is transferred outside Canada, we use contractual and organisational safeguards to ensure a comparable level of protection under PIPEDA. We remain accountable for information in the possession of third parties processing data on our behalf.
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles (APPs) in relation to that information, in accordance with APP 8. We remain accountable if an overseas recipient mishandles your personal information.
06 Data Retention
We retain personal information only for as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data category:
- Account data — retained for the duration of the business relationship and for a reasonable period thereafter as required by applicable law.
- Operational and telemetry data — may be retained for longer periods for historical trend analysis at the direction of the relevant utility customer.
- Technical and analytics data — retained for up to 24 months, unless a longer period is required for security or legal purposes.
- Communications — retained for as long as necessary to resolve queries and for a reasonable period thereafter.
When data is no longer required, it is securely deleted or anonymised in accordance with our data management procedures.
07 Security
We implement industry-standard technical and organisational measures to protect your information, including encryption in transit and at rest, role-based access controls, regular security assessments, and incident response procedures. Our platform infrastructure leverages hardened edge computing environments aligned with industrial cybersecurity best practices.
In the event of a data breach that poses a risk to your rights, we will notify affected individuals and the relevant supervisory authorities within the timeframes required by applicable law.
08 Your Rights
Depending on your location and applicable law, you may have the following rights with respect to your personal information:
- Access — request confirmation of whether we process your personal data and obtain a copy of it.
- Correction — request correction of inaccurate or incomplete information.
- Deletion — request deletion of your personal information, subject to legal and contractual obligations.
- Portability — receive your personal data in a structured, commonly used, machine-readable format.
- Restriction — request that we limit the processing of your data in certain circumstances.
- Objection — object to processing based on legitimate interests or for direct marketing purposes.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
New Zealand residents have the right to access and request correction of their personal information. We will respond within 20 working days of receiving a valid request.
EEA residents have all of the rights listed above, including the right to data portability, the right to erasure, and the right to object to processing based on legitimate interests or for direct marketing. You also have the right to lodge a complaint with your local Data Protection Authority. We will respond to valid requests within one calendar month.
UK residents have all of the rights listed above. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. We will respond to valid requests within one calendar month.
California residents have the right to know what personal information is collected, request its deletion, opt out of the sale or sharing of personal information, and limit the use of sensitive personal information. You have the right to not be discriminated against for exercising these rights. To submit a request, contact us at the details below. We will verify your identity and respond within 45 days. Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and others) may have similar rights under their respective state laws.
Canadian residents may request access to their personal information and challenge its accuracy. You may also withdraw consent to ongoing collection, use, or disclosure, subject to legal or contractual restrictions. Complaints may be filed with the Office of the Privacy Commissioner of Canada.
UAE residents have the right to access, correct, and request deletion of their personal data, as well as the right to data portability and to restrict or object to certain processing. You may lodge a complaint with the UAE Data Office.
Australian residents have the right to access their personal information (APP 12) and request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading information (APP 13). You also have the right to complain about a breach of the APPs. We will respond to access requests within 30 days. You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Individuals in Saudi Arabia have the right to be informed about the collection and purpose of processing, to access their personal data, to request correction or destruction of data, and to withdraw consent. You may file a complaint with SDAIA. We will respond within the timeframes prescribed by the PDPL and its Implementing Regulations.
To exercise any of these rights, please contact us using the details in Section 13 below. We may need to verify your identity before fulfilling your request.
09 How we use cookies and analytics
Analytics — Google Analytics 4 via Google Tag Manager. We use Google Tag Manager (container GTM-WTTPNL7R) to load Google Analytics 4 (measurement ID G-K6B1342VVP) on waterworksx.com. Google Analytics sets first-party cookies in your browser — principally _ga and _ga_K6B1342VVP — which contain a randomly generated identifier used to distinguish one browser from another and to recognise returning visits. We use this to understand how many people visit the site, which pages they read, how far they scroll, and which pages lead to a demo request. In Google Analytics we retain event-level and user-level data for 14 months, after which it is deleted automatically; the retention period resets when a visitor returns. Aggregated reporting is not affected by this limit.
We operate Google Consent Mode v2. Until you make a choice in our cookie banner, and if you decline, analytics and advertising storage are set to denied: no analytics or advertising cookies are written, and Google receives only cookieless pings that contain no identifier and cannot be used to recognise you. If you accept, analytics and advertising storage are set to granted and the cookies described here are written. You can change your choice at any time from the cookie settings link in the site footer.
Advertising — LinkedIn Insight Tag. We run the LinkedIn Insight Tag (partner ID 9659748) so that we can measure how many people who saw or clicked a LinkedIn ad go on to request a demo, and so that we can show follow-up ads to people who have already visited relevant pages. The tag loads only after you accept marketing cookies. It sets or reads the following cookies, some of them on the linkedin.com domain: li_adsId, an advertising identifier used to match a visit to LinkedIn ad activity; bcookie, LinkedIn's browser identifier; lidc, used for LinkedIn data-centre routing; UserMatchHistory, used for LinkedIn ad ID syncing; li_sugr, a probabilistic identifier used for audience matching; and li_gc, which records your consent choices for LinkedIn's own non-essential cookies. LinkedIn also receives your IP address and the URL of the page you are viewing. LinkedIn processes this data as an independent controller under its own terms; its cookie policy and opt-out controls are published at linkedin.com/legal/cookie-policy and linkedin.com/psettings/guest-controls/retargeting-opt-out.
Advertising — Google Ads. Our website tag has historically also sent data to a Google Ads destination configured during the site's original build, for remarketing audience building and enhanced conversion measurement. That destination has been removed from our website tag and no longer receives data from this site. Where we run Google Ads in future, the tag will use cookies including _gcl_au to attribute a demo request to the advertisement that produced it, and this will operate only with your consent to marketing cookies.
Embedded video — Vimeo. Our home page embeds a product explainer video hosted by Vimeo. When the video loads, Vimeo may set cookies in your browser, including vuid, which Vimeo uses for its own analytics across sites that embed its player, and player, which stores playback preferences such as volume; Vimeo may also set short-lived security and load-balancing cookies. Vimeo acts as an independent controller for this data, and its privacy policy is published at vimeo.com/privacy.
Demo and contact form data. When you complete a form on this site we collect the details you enter — your name, work email address, company or utility, country, and any message or enquiry you choose to write, together with your marketing-email preference where offered. We use this only to respond to your enquiry, to arrange a demonstration, and, if you have opted in, to send occasional product and water-industry updates. Submissions are delivered by email to WaterWorksX at [email protected] and [email protected] and are held in those mailboxes; outbound delivery is handled on our behalf by Mailgun Technologies, Inc. as a processor. We keep enquiry correspondence for no longer than 24 months from our last contact with you unless you become a customer, in which case it is retained under our customer records. Our lawful basis for responding to your enquiry is our legitimate interest in dealing with requests about our products, and, where you have opted in to marketing email, your consent — which you may withdraw at any time using the unsubscribe link in any message or by writing to [email protected].
LinkedIn Lead Gen Forms. We also advertise on LinkedIn using LinkedIn Lead Gen Forms. If you submit one of those forms, LinkedIn passes us the details held in your LinkedIn profile that the form requests — typically your name, email address, job title and company. Those forms reference this privacy policy, and the data we receive through them is handled exactly as described under "Demo and contact form data" above.
Your rights. You may ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or object to our use of it, by writing to [email protected]. You can also block or delete cookies through your browser settings; doing so will not affect your ability to use this website.
10 Children’s Privacy
WaterWorksX is a business-to-business platform and our services are not directed at individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.
11 Automated Decision-Making
Our platform may use automated processing and analytics to deliver operational intelligence, detect anomalies, and generate maintenance recommendations. These automated outputs are provided as decision-support tools and are not used to make decisions that produce legal or similarly significant effects on individuals without human oversight.
Where applicable law requires, you have the right to request human review of any automated decision that significantly affects you.
12 Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via our website or by direct notification. The “Effective date” at the top of this page indicates when the policy was last revised. Continued use of our services following any update constitutes acceptance of the revised policy.
13 Contact Us & Complaints
WaterWorksX Limited is the data controller responsible for your personal information. As we are established outside the European Economic Area and the United Kingdom, if we are required to appoint a representative under Article 27 of the EU GDPR or UK GDPR, details will be published on this page.
If you are not satisfied with our response, you may file a complaint with the relevant supervisory authority:
- New Zealand — Office of the Privacy Commissioner
- European Union — Your local Data Protection Authority (see EDPB member list)
- United Kingdom — Information Commissioner’s Office (ICO)
- United States (California) — California Privacy Protection Agency
- Canada — Office of the Privacy Commissioner of Canada
- Australia — Office of the Australian Information Commissioner (OAIC)
- UAE — UAE Data Office (as established under Federal Decree-Law No. 45 of 2021)
- Saudi Arabia — Saudi Data & Artificial Intelligence Authority (SDAIA)
Rockwell Automation®, Allen-Bradley®, FactoryTalk®, and PartnerNetwork™ are trademarks or registered trademarks of Rockwell Automation, Inc. All other trademarks are the property of their respective owners. WaterWorksX is not affiliated with, endorsed by, or sponsored by Rockwell Automation, Inc. except as a participant in the Rockwell Automation PartnerNetwork™ programme.