Privacy policy.

1. Who we are

WaterGraph is a trading name of Cambridge Lakehouse Ltd, a company registered in England and Wales (Companies House number 16305286). Cambridge Lakehouse Ltd is the legal entity behind every WaterGraph product, service, and communication. The relationship is a trading-name arrangement, not a parent and subsidiary structure. References in this policy to “we”, “us”, or “WaterGraph” mean Cambridge Lakehouse Ltd acting under its WaterGraph trading name.

Our trading address, where the service is operated, is Pylewell Park, Lymington, Hampshire, SO41 5SJ. Our registered office, where statutory correspondence is held, is 253 Gray's Inn Road, London, WC1X 8QT.

For the purposes of UK data protection law, Cambridge Lakehouse Ltd is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office under application reference C1938704. Once the formal registration is issued, the registration number replaces this reference and the change is reflected on this page at the next update.

2. Contact for data protection enquiries

Hugh Fraser is the named contact for all data protection enquiries, including subject access requests, complaints, and questions about this policy. We are a small team and do not yet have a dedicated data protection officer, so Hugh Fraser handles these matters directly.

The fastest way to reach us is by email at hugh@watergraph.co.uk. You can also call +447786965763 during normal UK business hours. We aim to respond to data protection enquiries within five working days.

3. What data we collect and why

We only collect personal data that we need to deliver the WaterGraph service, contact you about your test, build the household-level exposure picture our subscribers expect, and meet our legal obligations. The categories below describe everything we collect.

Account and contact data

When you book a Watermark test or sign up for an account, we ask for your name, email address, telephone number, property address, and postcode. We use this to deliver the test, send your results, and stay in touch about your water exposure picture over time.

Test results and property context

At the point of your home test we record the parameter readings we measure at your kitchen tap, along with structured context about the property and household: property type and age, water supplier, whether a filter is fitted, the residents’ composition band, and any vulnerability information you choose to share. We use this to compute your Home Water Exposure Score, generate your personalised report, and improve your readings over time when you re-test.

Optional sensitive information

The household profile asks two optional questions about pregnancy and clinical vulnerability. These are special category data under UK GDPR. You do not have to answer either. If you do, we use the information only to make your test report more personally relevant (for example, to flag the increased significance of certain readings for pregnant residents or immunocompromised people). We never use this data for marketing.

Marketing and analytics data

When you visit watergraph.co.uk we log your IP address, device type, browser, the pages you view, and the actions you take. We use this to understand how people use the site, fix problems, and improve the experience. The detail on the specific tools we use and how to control them is in section 11.

Communications

If you contact us by email, phone, or web form, we keep a record of that correspondence so we can respond and resolve any issues you raise. We do not use the content of personal communications for any other purpose.

4. The legal basis we rely on

UK GDPR requires us to identify a specific legal basis for each kind of processing we carry out. The bases we rely on are set out below.

Performance of a contract

We use your account, contact, test result, and property context data to deliver the Watermark service you have booked or subscribed to. This includes scheduling visits, performing the test, computing your score, sending your report, and providing ongoing monitoring. We could not deliver the service without this data, so the lawful basis is performance of a contract with you (UK GDPR Article 6(1)(b)).

Consent for SMS marketing

If you have opted in to SMS marketing on our Meta lead form, we send you SMS messages under your explicit consent (UK GDPR Article 6(1)(a)) and Regulation 22 of the Privacy and Electronic Communications Regulations 2003, which requires prior consent for marketing messages sent to individual subscribers. You can withdraw your consent at any time by replying STOP to any message or by emailing hugh@watergraph.co.uk. The full disclosures for the SMS programme are in section 5.

Explicit consent

For special category data (pregnancy status and clinical vulnerability flags) we rely on your explicit consent (UK GDPR Article 9(2)(a)). You can withdraw consent at any time by emailing hugh@watergraph.co.uk. Withdrawing consent removes the special category data from your record but does not affect any non-sensitive data we hold under the contract basis.

Legitimate interests

We use marketing and analytics data on the basis of our legitimate interest in understanding and improving our website and service (UK GDPR Article 6(1)(f)). Where the underlying technology requires consent (cookies that are not strictly necessary), we ask for that consent separately as set out in section 11.

Legal obligation

Some data we hold is retained because we are required to (UK GDPR Article 6(1)(c)). This applies most often to billing records and any correspondence we are required to keep under accounting and tax law.

5. SMS marketing

We run a small SMS marketing programme to help you find a time for your home water test, send you a reminder before the appointment, and follow up afterwards. This section explains how the programme works and your rights over it.

How you join the list

You are only added to the SMS list if you specifically tick an SMS marketing consent box when you fill in our Meta lead form. The consent is specific to SMS, not bundled into any other agreement. We keep a record of when you consented, the form you completed, and exactly what you agreed to, so we can demonstrate compliance with UK GDPR and PECR if asked.

What we send

We send three kinds of message: finding a time for your booking when you have not yet scheduled, a reminder shortly before your appointment so you do not miss it, and a follow-up after your visit to check that everything went well. We do not send unrelated promotional content on this channel.

How often

Up to four messages per month. In most months you will receive fewer.

Cost

Standard network charges from your mobile carrier may apply. WaterGraph does not charge you for the messages themselves.

Opting out

Reply STOP to any message at any time. You will be removed from the list within 24 hours. You can also email hugh@watergraph.co.uk and ask to be removed. We honour either route equally.

Getting help

Reply HELP to any message for guidance, or email hugh@watergraph.co.uk.

Lawful basis

We rely on your explicit consent under UK GDPR Article 6(1)(a) and Regulation 22 of the Privacy and Electronic Communications Regulations 2003. You can withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Who runs the SMS infrastructure

The SMS sending platform is operated by Mailchimp (a service of Intuit Inc.) acting as our data processor. Your phone number, consent record, and the messages we send to you are stored on their infrastructure. Mailchimp is named in the sub-processor table in section 7. You can read their own privacy policy at mailchimp.com/legal/privacy.

6. How long we keep your data

We hold personal data only for as long as it serves the purpose it was collected for, plus any period required by law or by our legitimate interest in defending claims.

7. Who we share data with

We do not sell personal data and we do not share it for the purposes of third-party advertising. The only third parties who process your data on our behalf are the operational service providers we use to run the WaterGraph service. They act only on our written instructions and only for the purposes of delivering their service to us.

We may also share data where we are required to by law (for example, in response to a court order or a binding regulatory request) or where it is necessary to protect the rights, property, or safety of WaterGraph, our subscribers, or others.

8. Our use of anonymised and aggregated data

WaterGraph aggregates and anonymises water test results to produce Area Water Exposure Scores, the public WaterGraph Map, and other statistics about the state of water across the United Kingdom. Aggregated and anonymised data is not personal data under UK GDPR because individuals can no longer be identified from it.

We may publish, license, or otherwise share aggregated and anonymised datasets, and insights derived from them, with third parties including local authorities, water companies, insurers, property platforms, academic researchers, and journalists. This is a core part of how WaterGraph’s data products operate and is consistent with the purposes for which the underlying personal data was originally collected.

We use industry-standard techniques to ensure that anonymised data cannot be reverse-engineered to identify an individual household. Where the density of testing in a small area would risk re-identification, we either suppress the data at that resolution or report it at a coarser geography.

9. Your rights

UK GDPR gives you a set of rights over the personal data we hold about you. The rights are set out below. To exercise any of them, email hugh@watergraph.co.uk with enough detail for us to identify your record. We aim to respond within one calendar month.

• Right of access. You can ask us for a copy of the personal data we hold about you.
• Right to rectification. You can ask us to correct inaccurate or incomplete information.
• Right to erasure. You can ask us to delete your personal data, subject to the exceptions below.
• Right to restriction. You can ask us to limit how we use your data in specific circumstances.
• Right to portability. You can ask for a structured, machine-readable copy of the personal data you have given us.
• Right to object. You can object to processing that we carry out on the basis of legitimate interests.
• Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.

One important note on the right to erasure. When you ask us to delete your data, we will remove all identifying information from your record. The anonymised, aggregated readings that have already contributed to Area Water Exposure Scores remain part of the public dataset, because they are no longer linked to you and form part of the public-interest picture WaterGraph is building. This is a legitimate use under UK GDPR, but we will explain it again when you make the request so you can make an informed decision.

You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk. We would prefer that you raise any concern with us first so we have the chance to resolve it, but this is not a precondition for going to the ICO.

10. International transfers

Most of our processing takes place in the United Kingdom and the European Economic Area. Some of our sub-processors, named in section 7, are based in the United States. When personal data is transferred outside the UK to a US-based provider, we rely on the UK Extension to the EU-US Data Privacy Framework (commonly called the UK-US Data Bridge), which the UK government and the European Commission have recognised as providing an adequate level of protection.

Where a sub-processor is not certified under the UK-US Data Bridge, we put in place the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses with the UK addendum, plus any supplementary technical and organisational measures the transfer requires.

11. Cookies and analytics

Our website uses a small number of cookies and similar technologies. The consent banner that appears on your first visit asks whether you want to allow analytics and measurement cookies. We do not set any non-essential cookie until you opt in.

Strictly necessary

Strictly necessary cookies are required for the site to work. They remember your session, your form inputs, and the consent choices you have made on this site. We do not ask for consent before setting these because the site cannot function without them.

Consent management

The consent banner is provided by CookieYes Ltd, a UK-incorporated consent management platform. When you make a choice on the banner, CookieYes records the choice (the consent options shown, your selection, the date and time, and an anonymised identifier) so we can demonstrate compliance with UK GDPR and PECR. The consent record is stored by CookieYes on infrastructure in the United Kingdom and India.

Analytics and measurement

We use Google Analytics 4 to understand how people use the site, and the Meta Pixel to measure the performance of advertising campaigns that bring people to watergraph.co.uk. Both technologies set cookies and may transmit information about your visit to Google and Meta respectively, in the United States, under the UK-US Data Bridge.

The Meta Pixel records three event types: a PageView signal on every page load, an InitiateCheckout signal when you click a booking call to action, and a Lead signal when a booking is completed. Each event carries non-identifying context (the page URL, the product name, and the booking value of £29) and is used solely to measure and optimise advertising performance, never for profiling unrelated to the campaign.

These analytics tools only fire after you opt in. If you decline, CookieYes signals Google Consent Mode to suppress measurement, no analytics or measurement cookies are set, and no information about your visit is transmitted to Google or Meta.

Managing your choices

You can review and change your cookie choices at any time by clicking the Cookie preferences link in the site footer. You can also clear cookies in your browser, which prompts the consent banner again on your next visit. If you have any difficulty changing your preferences, email hugh@watergraph.co.uk and we will help.

12. Changes to this policy

We update this policy when our service changes, when the law changes, or when we add or remove a sub-processor. The most recent version is always available at watergraph.co.uk/privacy. For material changes that affect you directly, we will notify subscribers by email before the change takes effect.

13. Last updated

This policy was last updated on 28 May 2026.