Privacy

We have a strong commitment to ensuring that your personal information is protected and used appropriately as outlined in our Privacy Policy.

1. Purpose

This Privacy Policy explains how Yarra Valley Water handles both personal information (including sensitive information) and health information in accordance with our legal obligations. Where we are considering any proposal which may result in a significant change in the way we manage personal information (including sensitive information) or health information, we will carry out a privacy impact assessment.

2. Scope

This Privacy Policy applies to all Yarra Valley Water employees, executives and directors, contractors and consultants.

All references in this Privacy Policy to “we”, “us” and “our” are to Yarra Valley Water. References to “you” and “your” in this Privacy Policy are references to individuals whose personal information we collect, hold, use or disclose.

3. Policy Statement

Yarra Valley Water Corporation (Yarra Valley Water) is a water corporation established under the Water Act 1989 (Vic). Yarra Valley Water provides clean water to its customers and takes their sewerage away.

Yarra Valley Water and its employees respect the privacy of all individuals. Yarra Valley Water must comply with the Information Privacy Principles (IPPs) contained in the Privacy and Data Protection Act 2014 (Vic) (Privacy and Data Protection Act) in the way that we handle personal information (including sensitive information). If we collect any health information, we are bound by the Health Privacy Principles (HPPs) in the Health Records Act 2001 (Vic) (Health Records Act).

3.1. Collection

In line with the Privacy and Data Protection Act, Yarra Valley Water collects personal information from you for the purpose of carrying out our business activities and functions as a water corporation under the Water Act 1989 (Vic).These include, among other things, providing water and sewerage related services and products to you, the promotion of those services and products, associated research, contacting you for billing purposes or in relation to your account, if we detect a water leak, where you make a request to us or require our assistance and as otherwise required or permitted by law.

The types of personal information that may be collected by us depends on the circumstances and may include:

identifying information (i.e. name, date of birth, driver licence details, and pension and concession card numbers);
contact details (i.e. address; telephone number, email address, and fax number); information about your employment (e.g. place of work, position, authority to transact with us, etc.);
information relevant to your employment with us (i.e. tax file number and banking details);
health or special needs information for the purposes of applying payment concessions and identifying customers who may, because of their special needs, be affected by service outages (e.g. customers who require water for the operation of a life support machine);
information on prior dealings with us;
information on your personal circumstances (e.g. if you are experiencing payment difficulty or if you are affected by or experiencing family or domestic violence and advise us accordingly). Our Website contains further information regarding our approach to supporting customers experiencing family or domestic violence);
credit information and payment information collected as part of a transaction;
health information; and
close to real time water usage recorded by digital meters (which may or may not be personal information depending on the circumstances).

Yarra Valley Water may collect personal information in a number of ways including without limitation, over the counter, the telephone, by email, the internet or surveys and using digital metering. Additionally, in certain situations, we may summarise personal information about you using AI tools which may be considered a collection of that personal information. YVW does not use personal information on publicly available AI tools. For further information regarding the adoption of AI at YVW, please see section 3.5 of this Privacy Policy below.

If you do not provide us with the personal information that we require, then we may be unable to supply the services or products that you request.

Generally, we try and collect personal information directly from that individual. However, there may be certain circumstances where we collect personal information from someone other than you, such as government bodies, publicly available sources of information and other third parties such as real estate agents, landlords, solicitors/conveyancers, third party data providers and AI tools, or a legally appointed agent or authorised representative.

Under the Privacy and Data Protection Act, the concept of ‘sensitive information’ is a subset of personal information about an individual’s:

racial or ethnic origin;
political opinions;
membership of a political association;
religious or philosophical beliefs or affiliations;
membership of a professional or trade association, or trade union;
sexual preferences or practices; or
criminal history.

Yarra Valley Water will not collect any sensitive information unless your consent has been obtained, or the collection is permitted or required under law
Under the Health Records Act, ‘health information’ includes information or opinion about:

the physical, mental or psychological health of an individual;
a disability of an individual;
an individual’s expressed wishes about the future provision of health services to him or her;
a health service provided or to be provided to an individual, that is also personal information.

Yarra Valley Water will not collect health information unless your consent has been obtained, or the collection is permitted or required under law.

We may request your health information if:

interruption to services would impact your health (e.g. because you are on dialysis);
you are an employee and you are injured at work;
you are an employee and we otherwise need to know about your health information as part of your employment; or
it is required for occupational health and safety laws.

3.2. Anonymity

Where it is lawful and practicable, we will provide you with the option of not identifying yourself when entering into transactions with us.

However, sometimes, if you do not provide us with the personal information that we require, then we may be unable to supply the services or products that you request.

The types of transactions you may be able to undertake without identifying yourself include:

paying a bill if you have the bill in front of you;
reporting an incident;
browsing our public website; and

other instances where you are legally permitted to remain anonymous.

3.3. Use and Disclosure

Yarra Valley Water will use and disclose personal information to carry out and improve our business activities and functions, including providing water and sewerage related services and products to customers, promoting those services and products, associated research, and as otherwise required or permitted by law.

An example of where we may use or disclose personal information to conduct and improve our business activities is in relation to digital water meters. Digital meters enable us to ensure accurate meter reading, detect leaks quickly, and gather insights on our water network. Digital meter information may therefore be disclosed to property owners and/or occupiers to help them manage their water usage. Digital meter information may also be disclosed to contractors or third parties (in a de-identified form) for similar purposes, including, for example, to perform network analytics, research and other water saving activities.

Yarra Valley Water may use and disclose your personal information to contractors or third parties, such as mercantile credit agencies, information technology service providers, research agencies, meter readers and our other partners including construction and fault repair contractors.

Yarra Valley Water may also use and disclose your personal information to relevant statutory agencies, including local government, Victorian government and the Commonwealth government. This is to facilitate our compliance with our statutory and legal obligations.

The personal information we collect will not be used or disclosed for any purpose not set out in this Privacy Policy without your consent, unless permitted under the Privacy and Data Protection Act the Health Records Act or other applicable legislation.

3.4. Consent

When using Yarra Valley Water’s website, you will be considered to have consented to our Internet Service Provider monitoring your use of our website and using your personal information for the purpose of promoting water and sewerage related services and products and market research.

3.5. Use of AI

We may use artificial intelligence tools to support business activities and functions as a water corporation.

Yarra Valley Water does not use personal information in publicly available AI tools such as ChatGPT.

The AI tools we use have been approved under our governance processes, which have been developed to ensure their adoption within YVW complies with applicable privacy legislation. Any personal information used, disclosed or generated through an enterprise AI tool will be managed in accordance with this Privacy Policy.

3.6. Website Data

When you use our website, using tools such as cookies and web beacons, we make a record of your visit and log information for statistical purposes. This is known as “clickstream data”. Clickstream data provides useful information about a user’s online experience without identifying individuals. Types of clickstream data we may collect include:

your computer address and relevant domains;
the times and dates of site visits;
the pages accessed and files downloaded; and
the browsers and operating systems used by visitors.

We only use visitor logs and clickstream data from our website for statistical purposes and to update and improve our website, and we will not attempt to identify you.

In using cookies and web beacons, Yarra Valley Water does not record any personal information unless you choose to provide this information to us, for example, by registering on our website. If you choose to provide this information to us, this information may be linked to data stored in the cookie.

You can configure your browser to notify you when you receive a cookie, providing you with the opportunity to either accept or reject it. You can also refuse all cookies from your computer if required. This will also prevent web beacons from tracking the user’s activity. The web beacon will still account for an anonymous visit, but the user’s unique information will not be recorded.

3.7. Marketing Communications Contact

Please contact us if you do not wish to receive any marketing communications from us quoting your Yarra Valley Water account number at:

The Privacy Officer
Yarra Valley Water Corporation
25-35 Lucknow Street
Mitcham Victoria 3132
Or by email: [email protected]

3.8. Communications

Please note that marketing communications do not include amendments to terms and conditions, surveys and other important information concerning our water and sewerage related services and products.

3.9. Transfer of personal information outside of Victoria

We do not routinely transfer personal information outside of Victoria, although in some circumstances we may do so where we engage third party contractors outside Victoria or are required to disclose information by law (e.g.to the ATO). If we need to transfer personal information about you to a recipient outside Victoria, we will only do so if we reasonably believe that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the Information Privacy Principles, you consent or as otherwise permitted in privacy legislation.

3.10. Data Quality

Yarra Valley Water will make every effort to ensure that the personal information we collect, use and disclose is accurate, complete and up to date.

Because we generally collect your personal information directly from you, we rely on you to provide accurate and current information to us in the first instance and to help us to keep your information up to date by telling us when your circumstances or details change.

If you notify us that personal information we hold is not accurate, complete or up to date then we will take action to correct the information in accordance with the requirements of the Privacy and Data Protection Act.

If you believe that any of the information we hold about you is inaccurate, incomplete or out of date, please email us at [email protected] or phone us on 1800 051 379.

3.11. Data Security

Yarra Valley Water has appropriate security measures in place to protect personal information from misuse or loss and from unauthorised access, modification or disclosure. This includes ID verification requirements on your account, confidentiality requirements for employees and contractors and having policies and systems in place about the handling of information.

We safeguard and help prevent unauthorised access to personal information, to maintain data security and ensure we use and disclose the information we collect appropriately. We will take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose unless records are required to be maintained longer under the Public Records Act 1973.

If there is a data breach concerning your personal information, we will respond in accordance with our obligations under the Privacy and Data Protection Act, relevant guidelines and our applicable incident and emergency response plans.
In relation to account enquiries, we will not disclose personal information relating to you or your account to other individuals without your permission unless required to do so by law. You can authorise other persons to have access to your account by contacting us.

If we are advised that you are experiencing family or domestic violence, we implement additional controls to safeguard the way in which we handle your personal information.

3.12. Data Access

You may contact us in writing to request access to your personal information held by us:

The Privacy Officer
Yarra Valley Water Corporation
25-35 Lucknow Street
Mitcham Victoria 3132
Or by email: [email protected]

We may be unable to provide you with access to your personal information where we are permitted to refuse to provide such access under the Privacy and Data Protection Act.

Where we are unable to provide access to personal information, we will provide written reasons for refusal.

We may charge you the reasonable cost of processing your request.

A person may request documents from us under the Freedom of Information Act 1982 (Vic) (FOI Act), Yarra Valley Water will charge in accordance with the FOI Act.

YVW will rely on the exemption provision at section 33 of the FOI Act to withhold disclosure of documents where such disclosure would entail unreasonable disclosure of information relating to the personal affairs of any person.

3.13. Unique Identifiers

We will not assign unique identifiers to you unless the assignment of unique identifiers is necessary to enable us to carry out any of our functions efficiently. Further, we will not require an individual to provide a unique identifier (i.e. your tax file number) unless required or authorised by law.

3.14. Amendments to Policy

We reserve the right to change this Privacy Policy at any time and will notify you by posting an updated version of the Privacy Policy on our website

3.15. Privacy Complaints

If you have a privacy complaint, or suspect a breach of this Policy, we ask that you please advise us as soon as possible by calling us on 1800 051 379 or by addressing your written complaint to:

The Privacy Officer
Yarra Valley Water Corporation
25-35 Lucknow Street
Mitcham Victoria 3132
Or by email: [email protected]

If you are not satisfied with our response you can take the matter further by contacting the Office of the Victorian Information Commissioner on 1300 006 842 or by completing the ‘Privacy complaint form’ available on the website.

3.16. Further Information

You may request further information about the way that Yarra Valley Water handles personal information by contacting us.

The Privacy Officer
Yarra Valley Water Corporation
25-35 Lucknow Street
Mitcham Victoria 3132
Or by email: [email protected]
Internet: http://www.yvw.com.au/

4. Responsibilities

All employees, contractors, consultants and third parties are required to comply with this Privacy Policy and ensure that personal information is handled in accordance with applicable legislative and YVW requirements.

5. Definitions / Terminology

Directors, Executives and Managers - are accountable for ensuring that privacy obligations are effectively implemented, communicated, and monitored within their areas of responsibility

Personal Information - information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not, as defined in the Privacy and Data Protection Act 2014 (Vic).

Sensitive Information - a subset of personal information relating to an individual’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or criminal history, which is afforded a higher level of protection under privacy legislation.

Health Information - Information or an opinion about an individual’s physical, mental, or psychological health, disability, or health services, that is also personal information, as defined in the Health Records Act 2001 (Vic).

Collection (of Personal Information) - the act of gathering, acquiring, or obtaining personal information by any means, including directly from individuals or indirectly from third parties or systems (including AI tools).

Disclosure - the release or sharing of personal information to an external party, including contractors, government agencies, or service providers.

Consent - voluntary agreement by an individual to the collection, use, or disclosure of their personal or health information, either explicitly or implicitly, where permitted by law.

De-identified - in respect of information, means information that has been processed to remove or obscure personal identifiers so that individuals cannot reasonably be identified.

Clickstream data - non-identifiable data collected automatically when a user interacts with a website, such as pages visited, timestamps, browser type, and IP address, used for statistical and analytical purposes.

Data breach - unauthorised access, disclosure, loss, or misuse of personal information that may compromise its confidentiality, integrity, or availability.

Privacy impact assessment - a structured process used to evaluate the potential privacy risks of a project, system, or initiative and identify measures to mitigate those risks.

6. Review and Revision

The Board or delegated Committee, along with the Executive team, will monitor the effectiveness of this policy, relevant strategies, and action plans. They will review them every three years, or sooner if needed, to adapt to changing business circumstances or regulations. Changes to the policy are to be approved by the Board.

7. Approval and Change History

Ver.	Description of changes	Approved By	Approved Date
1.0	As per report from FARM Committee	YVW Board	24/9/2024
2.0	Updated with AI specifics, reformatted to new template	YVW Board	22/06/2026