Privacy policy.

1. Who we are

WaterGraph is a trading name of Cambridge Lakehouse Ltd, a company registered in England and Wales (Companies House number 16305286). Cambridge Lakehouse Ltd is the legal entity behind every WaterGraph product, service, and communication. The relationship is a trading-name arrangement, not a parent and subsidiary structure. References in this policy to “we”, “us”, or “WaterGraph” mean Cambridge Lakehouse Ltd acting under its WaterGraph trading name.

Our trading address is Somerset House, Victoria Embankment, London, WC2R 1LA. Our registered office, where statutory correspondence is held, is 253 Gray's Inn Road, London, WC1X 8QT.

For the purposes of UK data protection law, Cambridge Lakehouse Ltd is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office under application reference C1938704. Once the formal registration is issued, the registration number replaces this reference and the change is reflected on this page at the next update.

2. Contact for data protection enquiries

Hugh Fraser is the named contact for all data protection enquiries, including subject access requests, complaints, and questions about this policy. We are a small team and do not yet have a dedicated data protection officer, so Hugh Fraser handles these matters directly.

The fastest way to reach us is by email at hello@watergraph.co.uk. You can also call +447786965763 during normal UK business hours. We aim to respond to data protection enquiries within five working days.

3. What data we collect and why

We only collect personal data that we need to deliver the WaterGraph service, contact you about your test, build the household-level exposure picture our subscribers expect, and meet our legal obligations. The categories below describe everything we collect.

Account and contact data

When you order a test or sign up for an account, we ask for your name, email address, telephone number, address, and postcode. We use this to post your kit, send your results, and stay in touch about your home’s water over time.

Test results and property context

When we test the sample you post to us, we record the readings from our lab, along with structured context about the property and household: property type and age, water supplier, whether a filter is fitted, the residents’ composition band, and any vulnerability information you choose to share. We use this to compute your Home Water Health Score, generate your personalised report, and improve your readings over time when you re-test.

Optional sensitive information

The household profile asks two optional questions about pregnancy and clinical vulnerability. These are special category data under UK GDPR. You do not have to answer either. If you do, we use the information only to make your test report more personally relevant (for example, to flag the increased significance of certain readings for pregnant residents or immunocompromised people). We never use this data for marketing.

Marketing and analytics data

When you visit watergraph.co.uk we log your IP address, device type, browser, the pages you view, and the actions you take. We use this to understand how people use the site, fix problems, and improve the experience. The detail on the specific tools we use and how to control them is in section 10.

Communications

If you contact us by email, phone, or web form, we keep a record of that correspondence so we can respond and resolve any issues you raise. We do not use the content of personal communications for any other purpose.

4. The legal basis we rely on

UK GDPR requires us to identify a specific legal basis for each kind of processing we carry out. The bases we rely on are set out below.

Performance of a contract

We use your account, contact, test result, and property context data to deliver the WaterGraph service you have ordered or subscribed to. This includes posting your kits, testing your samples, computing your score, sending your report, and providing ongoing monitoring. We could not deliver the service without this data, so the lawful basis is performance of a contract with you (UK GDPR Article 6(1)(b)).

Explicit consent

For special category data (pregnancy status and clinical vulnerability flags) we rely on your explicit consent (UK GDPR Article 9(2)(a)). You can withdraw consent at any time by emailing hello@watergraph.co.uk. Withdrawing consent removes the special category data from your record but does not affect any non-sensitive data we hold under the contract basis.

Legitimate interests

We use marketing and analytics data on the basis of our legitimate interest in understanding and improving our website and service (UK GDPR Article 6(1)(f)). Where the underlying technology requires consent (cookies that are not strictly necessary), we ask for that consent separately as set out in section 10.

Legal obligation

Some data we hold is retained because we are required to (UK GDPR Article 6(1)(c)). This applies most often to billing records and any correspondence we are required to keep under accounting and tax law.

5. How long we keep your data

We hold personal data only for as long as it serves the purpose it was collected for, plus any period required by law or by our legitimate interest in defending claims.

6. Who we share data with

We do not sell personal data and we do not share it for the purposes of third-party advertising. The only third parties who process your data on our behalf are the operational service providers we use to run the WaterGraph service. They act only on our written instructions and only for the purposes of delivering their service to us.

We may also share data where we are required to by law (for example, in response to a court order or a binding regulatory request) or where it is necessary to protect the rights, property, or safety of WaterGraph, our subscribers, or others.

7. Our use of anonymised and aggregated data

WaterGraph aggregates and anonymises water test results to produce Area Water Health Scores, the public WaterGraph Map, and other statistics about the state of water across the United Kingdom. Aggregated and anonymised data is not personal data under UK GDPR because individuals can no longer be identified from it.

We may publish, license, or otherwise share aggregated and anonymised datasets, and insights derived from them, with third parties including local authorities, water companies, insurers, property platforms, academic researchers, and journalists. This is a core part of how WaterGraph’s data products operate and is consistent with the purposes for which the underlying personal data was originally collected.

We use industry-standard techniques to ensure that anonymised data cannot be reverse-engineered to identify an individual household. Where the density of testing in a small area would risk re-identification, we either suppress the data at that resolution or report it at a coarser geography.

8. Your rights

UK GDPR gives you a set of rights over the personal data we hold about you. The rights are set out below. To exercise any of them, email hello@watergraph.co.uk with enough detail for us to identify your record. We aim to respond within one calendar month.

• Right of access. You can ask us for a copy of the personal data we hold about you.
• Right to rectification. You can ask us to correct inaccurate or incomplete information.
• Right to erasure. You can ask us to delete your personal data, subject to the exceptions below.
• Right to restriction. You can ask us to limit how we use your data in specific circumstances.
• Right to portability. You can ask for a structured, machine-readable copy of the personal data you have given us.
• Right to object. You can object to processing that we carry out on the basis of legitimate interests.
• Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.

One important note on the right to erasure. When you ask us to delete your data, we will remove all identifying information from your record. The anonymised, aggregated readings that have already contributed to Area Water Health Scores remain part of the public dataset, because they are no longer linked to you and form part of the public-interest picture WaterGraph is building. This is a legitimate use under UK GDPR, but we will explain it again when you make the request so you can make an informed decision.

You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk. We would prefer that you raise any concern with us first so we have the chance to resolve it, but this is not a precondition for going to the ICO.

9. International transfers

Most of our processing takes place in the United Kingdom and the European Economic Area. Some of our sub-processors, named in section 6, are based in the United States. When personal data is transferred outside the UK to a US-based provider, we rely on the UK Extension to the EU-US Data Privacy Framework (commonly called the UK-US Data Bridge), which the UK government and the European Commission have recognised as providing an adequate level of protection.

Where a sub-processor is not certified under the UK-US Data Bridge, we put in place the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses with the UK addendum, plus any supplementary technical and organisational measures the transfer requires.

10. Cookies and analytics

Our website uses a small number of cookies and similar technologies. The consent banner that appears on your first visit asks whether you want to allow analytics and measurement cookies. We do not set any non-essential cookie until you opt in.

Strictly necessary

Strictly necessary cookies are required for the site to work. They remember your session, your form inputs, and the consent choices you have made on this site. We do not ask for consent before setting these because the site cannot function without them.

Consent management

The consent banner is provided by CookieYes Ltd, a UK-incorporated consent management platform. When you make a choice on the banner, CookieYes records the choice (the consent options shown, your selection, the date and time, and an anonymised identifier) so we can demonstrate compliance with UK GDPR and PECR. The consent record is stored by CookieYes on infrastructure in the United Kingdom and India.

Analytics and measurement

We use Google Analytics 4 and Mixpanel to understand how people use the site, and the Meta Pixel to measure the performance of advertising campaigns that bring people to watergraph.co.uk. These tools may transmit information about your visit to Google, Mixpanel, and Meta respectively; Mixpanel is configured to use its EU API endpoint for WaterGraph product analytics.

The Meta Pixel records four event types: a PageView on every page load, a Lead when you leave your email with us (for example, to join a waitlist), an InitiateCheckout when you start an order, and a Purchase when an order is paid. Each event carries the page address, the product name and the order value, and is used solely to measure and optimise advertising performance, never for profiling unrelated to the campaign.

Mixpanel receives product analytics events, such as page views, button clicks, share actions, recommendation clicks, autocaptured interactions, and session replay data, so we can understand conversion funnels and improve the customer journey. We send named conversion events from our first-party event endpoint and use Mixpanel's browser SDK for autocapture and replay. We do not use Mixpanel to sell personal data.

These analytics tools only fire after you opt in. If you decline, CookieYes signals Google Consent Mode to suppress Google and Meta measurement, WaterGraph does not forward first-party product analytics events to Mixpanel, and the Mixpanel browser SDK is not initialised for autocapture or replay.

Managing your choices

You can review and change your cookie choices at any time by clicking the Cookie preferences link in the site footer. You can also clear cookies in your browser, which prompts the consent banner again on your next visit. If you have any difficulty changing your preferences, email hello@watergraph.co.uk and we will help.

11. Changes to this policy

We update this policy when our service changes, when the law changes, or when we add or remove a sub-processor. The most recent version is always available at watergraph.co.uk/privacy. For material changes that affect you directly, we will notify subscribers by email before the change takes effect.

12. Last updated

This policy was last updated on 9 November 2026.