The Source to Tap project commenced in 2017 and will run until 2021. It is funded by the European Union’s (EU) INTERREG VA Programme, with match funding from the Department of Agriculture, Environment and Rural Affairs (DAERA) in Northern Ireland, and the Department of Housing, Planning and Local Government (DHPLG) in Ireland. It is managed by the Special EU Programmes Body (SEUPB).

The project is being delivered by a consortium of partners, including Northern Ireland Water Limited (NI Water), Irish Water, Agri-Food & Biosciences Institute, East Border Region Limited, The Rivers Trust and University of Ulster (together, the Partners). NI Water determines the purposes for which and the manner in which any personal data is processed and is the controller of the personal data that is collected in connection with the Land Incentive Scheme (LIS) element of the Source to Tap project and the lead partner of the consortium. The other Partners act as processors and have the common aim of ensuring your personal data is protected in accordance with all applicable data protection legislation, including the EU General Data Protection Regulation (GDPR). Whenever this Privacy Notice refers to ‘we’ ‘us’ or ‘our’, it means NI Water itself or one of the other Partners acting on behalf of NI Water.

To help us manage our relationship with you and so that we can provide farm advice and grant funding in relation to LIS, we need to collect, store and use information that can be used to identify you. In legal terms, this is called ‘processing personal data’.

Looking after your personal data is as important to the Partners as it is to you. The information in this Privacy Notice will explain:

who we are;
how and why we process your personal data in relation to LIS;
your rights as a data subject; and
how you can get in touch with us.
This Privacy Notice applies only to the personal data collected in relation to LIS.

SUMMARY NOTICE

We keep to a minimum the personal data we hold about you.
We use your personal data to respond to your enquiries, manage our relationship with you, plan visits to your farm, provide you with advice, support your grant applications, pay your claims and, as required by the project rules, for retention and audit reasons.
We also use your personal data to help us assess the effectiveness of the Scheme and to produce summary information for reporting on project progress to the Partners and funders on a pseudonymised basis (this means that your name and address is replaced with a unique reference number before being shared).
We securely delete and dispose of your personal data when we no longer need it.
We only share your personal data with other organisations involved in the Source to Tap project when we need to (such as with DAERA, to confirm eligibility of funding only), and we only share the data that each Partner needs to use.
We ensure that any organisations with which we share your data are also aware of what they need to do to protect your privacy.
You have lots of privacy rights.
We take security seriously.
We are happy to answer your questions about any of this.

FULL NOTICE

The sections below tell you what personal data is, who we are and what we do, what personal data we collect and what we do with it. They explain how GDPR protects you by controlling what the Partners can do with your personal data and clarify how to complain or withdraw your consent (if applicable). They also tell you for how long we keep your personal data, how you can get a copy of it or ask for it to be changed or removed, and with whom we might lawfully share your personal data.

What is personal data?

Personal data is information that can be used to identify a living person. This can include property or lands information (e.g. farm data) that is considered biographically significant and, when put together with other information, can then identify a person; for example, your name and contact details, or farm business details.

Who we are and what we do

The Source to Tap consortium of partners includes the following:

Northern Ireland Water Limited (NI Water)
NI Water is the sole provider of public water and sewerage services in Northern Ireland. It is a non-departmental public body (NDPB) and a Government-Owned Company (GoCo), set up in April 2007.

NI Water’s registered office address is:

Northern Ireland Water Ltd.
Westland House
40 Old Westland Road
Belfast
BT14 6TE

NI Water is the controller of personal data collected by the Partners in relation to the LIS. Its Data Protection Officer (known as a DPO) can be contacted at:

Telephone: 0044 (0) 345 7440088
Email: imu@niwater.com

Irish Water (Irish Water)
Irish Water is the single national utility responsible for public water and wastewater services in Ireland and is tasked with operating, improving and investing in the water and wastewater systems in order to provide safe, reliable and high quality services to customers. Irish Water is regulated by the Commission for Regulation of Utilities and the Environmental Protection Agency.

Irish Water’s registered office address is:

Colvill House

24-26 Talbot Street

Dublin 1

Email: dataprotection@ervia.ie

Tel: 00353 1 850 278 278

Irish Water is a processor in relation to personal data collected and used under the LIS as part of the Source to Tap project.

The Agri-Food & Biosciences Institute (AFBI)
AFBI was created on 1 April 2006 by joining the Science Service of the then Department of Agriculture and Rural Development (DARD) with the Agricultural Research Institute of Northern Ireland (ARINI). DARD became DAERA on 8 May 2016. AFBI is a DAERA non-departmental public body. AFBI carries out high technology research and development, statutory, analytical, and diagnostic testing functions for DAERA and other Government departments, public bodies and commercial companies.

AFBI’s registered office address is:

Agri-Food & Biosciences Institute, 18a Newforge Lane,
Belfast

BT9 5PX

Telephone: 0044 (0) 28 9025 5636

Email: foi.officer@afbini.gov.uk

AFBI is a processor in relation to personal data collected and used under the LIS as part of the Source to Tap project.

East Border Region Limited (EBR)
EBR is a Local Authority-led cross-border network. EBR comprises six Local Authorities namely: Newry, Mourne & Down District Council, Armagh, Banbridge & Craigavon Borough Council, and Ards & North Down Borough Council in Northern Ireland and Louth, Monaghan and Meath County Councils in the Republic of Ireland and has a total population of 826,000. EBR was established in 1976 to promote innovative, cross-border economic development in the areas of agriculture, industry, commerce and tourism and to improve the living conditions and employment prospects of those living in the region.

EBR’s registered office address is:

East Border Region Ltd.

2 Monaghan Court

Monaghan Street

Newry

BT35 6BH

Telephone: 0044 (0) 28 3025 2684

Email: admin@eastborderregion.com

EBR is a processor in relation to personal data collected and used under the LIS as part of the Source to Tap project.

The Rivers Trust (The Rivers Trust)
The Rivers Trust is an environmental Non-Government Organisation, a registered charity (Registered Charity No: 1107144) and is the umbrella body of the Rivers Trust movement in the UK and Ireland. With the support of over 60 member Trusts, they work on the ground, with communities, farmers, landowners and businesses to plan and implement action to protect, promote and enhance our freshwater ecosystems for both people and wildlife. The Rivers Trust’s registered office address is:

Rain-Charm House

Kyl Cober Parc

Stoke Climsland

Callington

Cornwall

PL17 8PH

Telephone: 01579372142

Email: info@theriverstrust.org

The Rivers Trust is a processor in relation to personal data collected and used under the LIS as part of the Source to Tap project.

Who does this Privacy Notice apply to?

This Privacy Notice relates to the collection and use of the personal data of farmer and landowner contacts (and those acting on their behalf, including individuals and sole traders) in connection with the LIS under the Source to Tap project.

How do we process your personal data?

The Partners will process the personal data you provide in a manner that complies with the GDPR, the Data Protection Act 2018 (UK) and Data Protection Acts 1988 to 2018 (Ireland). This means that the Partners are required to:

keep your personal data accurate and up-to-date;
not keep your personal data for longer than needed; and
keep your personal data safe, only permitting access to the those who need to use it.
Personal data you supply to us may be used by us in a number of ways, including the below:

We need to keep your name, address and contact details so we can arrange farm visits, help you submit your LIS funding application, tell you about training or technical workshops relevant to the project and monitor the environmental outcomes of the actions we help you to implement;
We collect your farm business data and map data about your farm practice, so we can plan the most effective actions to address specific environmental issues on your farm. We also need this information so we can cross-check your funding application against other grant schemes and to ensure that we are not breaching the strict legal requirements of the European Commission (which provides the funding for the project and the grant scheme) and the funding management body; the SEUPB;
We need to collect bank details to process your grant payments, and, in the event of an inspection or audit, to provide proof to the European Commission, the DAERA in Northern Ireland and/or the DHPLG in Ireland that the grants have been spent on the agreed actions and in compliance with their legal requirements; and
We need to store and retain your personal data in accordance with the requirements of the project and its associated legislation.
How do we collect personal data?

We may collect your contact details from you when you enquire about the LIS by phone, email or in person. We will collect further personal data when we visit your farm, on subsequent visits, phone calls or emails while we are preparing your farm plan and while we are supporting you through the funding application process.

We may also collect your personal details when someone associated with LIS refers your enquiries to us, or when your business contacts refer your enquiry to us.

We use securely encrypted laptops to record your data when we visit you, uploading this to secure servers when we return to the office. We also use mobile phones to gather spatial data about your farm, including information about potential runoff and erosion issues, which the LIS grants could be used to tackle. This survey data includes photos of your farm buildings, yards, fields and infrastructure. Photographs of your farm business maps may also be taken to aid in preparing the plan for your farm. These are held temporarily on the mobile phone (secured with a passcode) until the project officers return to the office, when the data are securely uploaded to a cloud service and removed from the mobile phone.

Our lawful basis for processing personal data

GDPR states there must be a lawful basis for processing your personal data. The lawful basis on which personal data of farmers and landowners will be processed in relation to LIS is being necessary for a contract to be entered into by that farmer or landowner. If the farmer or landowner does not provide the personal data, we will not be able to undertake a farm visit or proceed with an LIS application.

How long we keep your personal data

Farmer and landowners’ personal data will be securely archived and retained for seven years after the end of the Source to Tap project in order to satisfy the requirements of the project auditors.

Who we share your personal data with and why

The Partners work with a number of organisations to manage the Source to Tap project, and need to share some of your personal data with these parties:

to administer funding,
to ensure that the grant scheme complies with the legal requirements of the funder (the European Commission), and
to help analyse the effectiveness of the grant scheme in tackling some of the issues the project is designed to address.
Where we share data with third parties, there will be a legal agreement in place to make sure the organisation complies with applicable data protection legislation.

Who sees or has access to your personal data will depend on why we need to process it, but the organisations we share with may include the following:

The Department of Agriculture, Environment and Rural Affairs;
The Department of Housing, Planning and Local Government;
Special EU Programmes Body (SEUPB);
European Commission Auditors;
European Court of Auditors;
European Territory Co-operation Audit Authority;
Northern Ireland Audit Office;
Comptroller & Auditor General Ireland;
Esri (in relation to personal data held by The Rivers Trust);
Microsoft (in relation to personal data held by The Rivers Trust); and
NICS IT Assist servers (in relation to personal data held by AFBI)
You can find a detailed breakdown of exactly what personal data is shared between each Partner in the following section:

What data (including personal data) we collect and what we do with it

COLLECTION
To complete a Water Environment Management Plan (WEMP) and progress an application for funding through the pilot LIS, the following personal data will be collected:

Name
Address
Telephone Number
Mobile Telephone Number
Email address
Farm Business Number (NI)
Herd Number (NI)
Farm name
GPS coordinates
Business address
VAT number
Farm size (hectare)
Area owned
Number of Fields per farm
Number of livestock
Photos of farm business
Activities on farm
Most important activity for income
Type of livestock on farm
Track Runoff Issue (y/n – includes a geospatial reference)
Machinery Compaction Issue (y/n – includes a geospatial reference)
Livestock Compaction Issue (y/n – includes a geospatial reference)
Field Poaching Issue (y/n – includes a geospatial reference)
Bankside Poaching Issue (y/n – includes a geospatial reference)
Drinker Poaching Issue (y/n – includes a geospatial reference)
Feeder Poaching Issue (y/n – includes a geospatial reference)
Pesticide storage Issue (y/n – includes a geospatial reference)
Pesticide mixing Issue (y/n – includes a geospatial reference)
Pesticide disposal Issue (y/n – includes a geospatial reference)
Yard spoutings Issue (y/n – includes a geospatial reference)
Yard runoff Issue (y/n – includes a geospatial reference)
Yard number separation Issue (y/n – includes a geospatial reference)
Livestock crossing Issue (y/n – includes a geospatial reference)
Livestock in river Issue (y/n – includes a geospatial reference)
Peat drainage Issue (y/n – includes a geospatial reference)
Bare peat Issue (y/n – includes a geospatial reference)
Himalayan Balsam Issue (y/n – includes a geospatial reference)
Giant Hogweed Issue (y/n – includes a geospatial reference)
Japanese Knotweed Issue (y/n – includes a geospatial reference)
Field ID Number
Notes describing the issues in detail and possible LIS recommendations
Photos (geolocated to ± ten metres)
Conacre Farmer Name
Conacre Farmer Address
Source to Tap ID
Tenant Name
Certified copies of invoices (Containing Name, Address)
Certified copies of receipts (Containing Name, Address)
Completed Claim form (including some details listed above)
Bank Details (including account number and sort code)
Location (coordinates to ca 10+B36:B73m accuracy)
Gateway Location Issue (y/n)
Runoff Issue (y/n)
Soil Compaction Issue (y/n)
Poaching Issue (y/n)
Bankside Erosion Issue (y/n)
Manure Storage Issue (y/n)
Pesticide Application Issue (y/n)
Pesticide Handling Issue (y/n)
Farmyard Issue (y/n)
Livestock Access Issue (y/n)
Peatland Issue (y/n)
Non-Native Invasive Species Issue (y/n)
Other Issue (y/n)
Field Runoff Issue (y/n)
SHARING

NI Water

NI Water lawfully shares the 65 personal data fields above with Irish Water and The Rivers Trust as NI Water hosts the data on both its ESRI ArcGIS platform (geospatial data only) and its EStream Extranet Site (other data, including personal data) and both Irish Water and The Rivers Trust process (upload and store) their respective LIS grant applications onto NI Water’s systems.
NI Water’s system will provide AFBI with restricted access to only the data sub-sets below for the economic assessment of the pilot LIS:
Area owned (hectare);
Farm size (hectare);
Fields per farm;
Activities on farm;
Most important activity for income;
Type of livestock on farm;
Number of livestock;
Photos containing unique & distinctive identifiers;
The Rivers Trust

The Rivers Trust shares the 65 personal data fields above with NI Water for hosting as NI Water hosts the data on both its Esri ArcGIS platform (geospatial data only) and its EStream Extranet Site (other data, including personal data).
The Rivers Trust lawfully shares all personal data above with Irish Water (at Project Officer level) to co-ordinate LIS visits.
The Rivers Trust lawfully shares the data sub-sets below with DAERA (regarding landowners in Northern Ireland) for the prevention of dual funding and detection of fraud:
Name;
Address;
Farm Business Number (NI);
Herd Number (RoI);
Farm name;
Field numbers;
De minimus Aid (EU funding up to €15k over three consecutive years).
The Rivers Trust lawfully shares certified copies of invoices (containing name, address), certified copies of receipts (only if containing name and address) and completed claim forms with EBR for verifying expenditure and fraud detection.
Irish Water

Irish Water lawfully shares the 65 personal data fields above with NI Water as NI Water hosts the data on both its Esri ArcGIS platform (geospatial data only) and its EStream Extranet Site (other data, including personal data) and authorised personnel within Irish Water have access to those systems.
Irish Water lawfully shares the data sub-sets below with DAERA (regarding landowners in Northern Ireland) for the prevention of dual funding and detection of fraud:
Name;
Address;
Farm Business Number (NI);
Herd Number (RoI);
Farm name;
Field numbers;
De minimus Aid;
East Borders Region and AFBI

Neither party provides any personal data to any other party in relation to the Source to Tap project other than to data storage and destruction service providers in the UK from time to time.Where is your personal data processed?The Source to Tap project office is in Northern Ireland, and your data is processed in both Northern Ireland and the Republic of Ireland, as well as in the wider European Union by the SEUPB, the EU Desk Officer for the project and the EU’s IT server contractor in Vienna, Austria.
NI Water’s Esri ArcGIS platform (which securely hosts the geospatial personal data collected on behalf of the LIS) is hosted in the United States. Personal data is transferred to the hoster (Esri) on the basis that it has signed up to the US Privacy Shield, certifying that it adheres to the principles of the Privacy Shield.
NI Water’s Extranet Site (which securely hosts the remaining personal data collected on behalf of the LIS) is hosted within Northern Ireland.
Protecting your personal data

We are committed to ensuring that your personal data is secure. In order to prevent unauthorised access or disclosure, the Partners have each put in place appropriate technical, physical and organisational procedures to safeguard and secure the information we collect about you.

Your rights as data subject

Although not applicable in the context of the LIS, if your personal data is being processed on the basis of consent, you can withdraw your consent to the use of your personal data at any time. However, in some cases, we may not be required or able to comply for legal reasons. If this is the case, we will tell you and explain why.
Subject to some legal exceptions, you have the right to request a copy of the personal data the Partners hold about you. You have the right to ask for all the information we hold about you and the services you receive from us. When we receive a request from you in writing, we should respond formally to you within one month of receiving your request.
You have the right to have any inaccuracies corrected. You should let us know if you disagree with something we hold about you. We may not always be able to change or remove that information. Where we can, we’ll correct factual inaccuracies and will include your comments in the record to show that you disagree with it.
You have the right to be forgotten. In some circumstances, you can ask for your personal data to be deleted; for example:
when it is no longer needed for the reason it was first collected;
when you have withdrawn your consent for us to process your information (and where there is no other lawful reason for us to continue processing it);
when there is no legal reason for the continued use of your information;
when deleting the information is a legal requirement.
Where your personal data has been shared with others, we’ll do what we can to make sure those using your personal data comply with your request for erasure. Please note that we can’t delete your information where:
it is for scientific or historical research or statistical purposes, and deleting it would make information unusable; or
it is necessary for financial or legal claims.
You have the right to ask us to restrict what we use your personal data for:
where you have identified inaccurate information and have told us of it;
where we have no legal reason to use that information, but you want us to restrict what we use it for rather than erase the information altogether.
Where restriction of use has been granted, we’ll inform you before we carry on using your personal data. Where possible, we’ll seek to comply with your request, but we may need to hold or use information because we are required to by law.You can tell any of the Partners that you want to exercise any of your available rights, and they will promptly pass that request to NI Water (as controller).The authority responsible for overseeing data protection matters in Northern Ireland is the Information Commissioner’s Office (ICO). To learn more about all these rights, please see the ICO’s website:https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation- gdpr/individual-rights/ The authority responsible for overseeing data protection matters in Republic of Ireland is the Data Protection Commissioner (DPC). Guidance about your rights is available on its website:https://www.dataprotection.ie/docs/A-guide-to-your-rights-Plain-English-Version/r/858.htm Please be aware that there may be circumstances when we are unable to comply with your request to exercise your rights. If this is ever the case, we will inform you of the reason and provide details of how you can register a complaint with the relevant authority responsible for data protection in your jurisdiction if you believe we have got this wrong. However, complaints can often be dealt with satisfactorily without the involvement of any authorities, so please let us know if you have any such complaints in the first instance.
Changes to this Privacy Notice

We may update the Privacy Notice from time to time – please ensure you visit the Source to Tap website for the latest version: http://www.sourcetotap.eu/privacy-notice/