WYLA privacy notice

For: everyone whose details are in WYLA (Water YOU Looking At) - console users, alarm contacts, certified operators and anyone named in a WYLA record. Last updated: 8 November 2026 (version 4).

In short

WYLA (Water YOU Looking At) is a remote monitoring and alarm service for drinking-water treatment plants. The water supplier you work for or with (our customer) uses it.
Most of what WYLA holds about you was entered by that water supplier, not by you. This notice tells you what it is, why it is kept, where, who sees it, for how long, and how to see or correct it.
It is stored in Microsoft Azure in Canada. Sign-in is handled by Auth0 (Okta) in the United States. If text messages and voice calls are switched on for your site, they go through Twilio, outside Canada.
Many WYLA records are regulatory records that nobody can edit or delete. If something is wrong, a correction is added next to the original instead (section 8 explains why).
Questions and requests: John Farrugia, privacy officer, privacy@wateryoulookingat.com.

1. Who is responsible for your information

The water supplier is in charge of most of the information in WYLA: its staff, its alarm contacts, its operators' certificates and its plant records. WYLA holds and processes that information on the supplier's behalf, to run the service.
WYLA (Water YOU Looking At) is responsible for its own use of sign-in information (keeping the service secure and counting active users on a customer's account), for the accounts of WYLA's own staff, and for anything you send us directly.
Contact: Water YOU Looking At (WYLA), [postal address - to be added]. Privacy officer: John Farrugia, privacy@wateryoulookingat.com.
How you hear about this notice: if a water supplier adds you as an alarm contact, or records your operator certificate, and you do not sign in to WYLA, WYLA emails you a short notice with a link to this page. People added before WYLA started sending these emails get one when the supplier's owner sends it from the console; nothing is sent to them automatically. Console users can open this notice from the Privacy link in the console.

2. What WYLA holds about you

If you are...	WYLA holds	Usually comes from
A console user	Your name, work email, role and the sites you can see. Each sign-in: the time, your IP address and browser, and whether you used a passkey or a password (the method's name, never the passkey or password itself). If you sign in with a Microsoft or Google account: which of the two it is, that provider's own id for your account, and when you confirmed it with the one-time code (the code itself is not kept). The actions you take in the console (the audit log).	The water supplier adds you; Auth0 when you sign in
An alarm contact (call-out recipient)	Your name, email, mobile number and any number for voice calls, which alarms you get and how (email, text, call), your place in the escalation list. Every message or call made to you about an alarm, how it went, and whether and how you acknowledged it.	The water supplier, or you on the My alarms page
A certified operator	Your name, email, certificate number, class or level, issuing body, jurisdiction, issue and expiry dates, scope, evidence note, who verified it, and the expiry reminders sent about it.	The water supplier, or you
A person allowed to make changes, or in charge of a plant	Permission given or withdrawn for a site, by whom, and the certificate it relied on; any designation as operator-in-charge or overall responsible operator. Each change proposed and each change you confirmed you made at the panel, and your shift notes and end-of-shift sign-offs, with times, values and notes.	The water supplier, and you
A person who signs a report or records a notice	On each signed monthly report: your name, email, role and how and when you confirmed it was you. In the notice log: who told which authority, when, how, and the reference given.	You
A contact at a regulator or health authority	Your name and contact details as the water supplier entered them in a site's regulatory profile, a notification case or the notice log.	The water supplier
Named in a gateway's own settings	Email addresses or phone numbers a site has set up in its gateway's own alarm settings appear in the configuration backups WYLA keeps (passwords and keys are removed before storing).	The site's gateway setup
Someone who contacts us	What you send us. A request made from the Help page in the console also holds what you write and attach, and what WYLA adds so it can help: your name, email and role, your organisation's plan and features, the site you chose and its gateways, and your browser's name.	You

WYLA does not hold payment card details, government ID or social insurance / social security numbers, or health information, and it never sees your password or passkey (Auth0 holds those). The plant readings themselves (chlorine, UV, flow, alarms) are about the plant, not about you.

Laboratory results. When you record or import laboratory results, WYLA keeps the results, the laboratory's sample IDs, where and when each sample was taken, who took it, the laboratory's name and accreditation number and, for an imported file, the original file exactly as you uploaded it. A laboratory file can name people, for example the person who took the sample or the laboratory's signatory; WYLA keeps those names only as part of the record. WYLA uses results to show what is due, to raise alarms (for example when E. coli is found or a result is over its maximum acceptable value), to prepare your reports and your Hinekorako upload file, and for an evidence export you ask for. WYLA does not send results or files to Taumata Arowai, the Ministry of Education, your laboratory or anyone else: you upload or send them yourself. Results and laboratory files are kept for at least 10 years with the rest of the site's records and are never edited; a correction is kept as a new entry beside the original.

Hinekorako file. The file WYLA prepares contains the name and email address of the person who will upload it, as Taumata Arowai's template asks.

3. Why WYLA keeps it

To send alarms to the right people, call the next person when nobody answers, and record that each alarm reached someone and who acknowledged it.
To let you sign in securely and see only your own water supplier's sites.
To keep the records drinking-water rules ask suppliers to keep: who did what and when, operator certificates, changes made at the panel, signed monthly reports and notices to regulators. WYLA keeps these for the supplier; WYLA's own collection of your details is not required by a law.
To run the service: support, security monitoring, fixing faults, and counting active users on the supplier's account.

WYLA does not sell your information or use it for advertising, and the console has no analytics or advertising trackers. The console keeps your sign-in session in your browser's storage.

Your water supplier decides what to enter. Without an email address or phone number WYLA cannot alarm you; without a current certificate record WYLA will not let you confirm changes at a site.

4. Where it is kept

What	Where
The WYLA database and its backups	Microsoft Azure, Canada Central region (Toronto)
Alarm and report emails	Sent through Azure Communication Services (data location Canada). An email then travels over the internet to your own mail provider.
Your sign-in account (email, name, password or passkey, sign-in history)	Auth0 by Okta, United States region
Text messages and voice calls - only if switched on for your site	Twilio, which processes your number and the message in the United States, Ireland or Australia; Twilio has no Canadian region. Not set up as of 12 October 2026.
"Continue with Google" or "Continue with Microsoft" - only if you choose it at sign-in	Google or Microsoft confirms who you are to Auth0. The first time, WYLA emails a one-time code to the address of your WYLA login to check the account is yours

These providers process information for us to provide their service. Information processed in another country can be accessed by that country's courts and authorities under its laws. In New Zealand, keeping information with a provider that holds it for us is not a disclosure (Privacy Act 2020 section 11).

5. Who can see it

The water supplier's own WYLA users, according to their role (owner, operator, installer, viewer).
A service company the water supplier has allowed to see a site (read only).
People who receive a site's alarms and reports: an alarm message or monthly summary can name who acknowledged an alarm.
WYLA staff who run and support the service. When they view a supplier's account as that supplier, the session is read only and recorded in the supplier's own audit log. They cannot sign a supplier's reports or give permission for changes.
WYLA support acting in a supplier's account. When a water supplier asks WYLA for help, WYLA support may act in the supplier's account as one of its users, for a limited time (at most one hour per session), so they see and use the account the same way that person does. Everything done in the session is recorded in the supplier's own audit log, with the WYLA support person's name, the user acted as, the reason and the times. The supplier's owner can switch this off at any time. WYLA support never signs reports, never changes sign-in security (passkeys and sign-in methods), never adds users or changes their roles, and never grants control permissions - those always stay with the supplier.
Regulators, only through the water supplier: WYLA never sends anything to a regulator itself. A report or notice the supplier submits can name you (for example as the person who signed it). This includes the Hinekorako upload file and any evidence export the supplier asks WYLA to make.
The providers in section 4, and anyone legally entitled to require it (for example by a court order); we will tell the water supplier unless the law forbids it.

6. How long it is kept

WYLA keeps its records for at least 10 years and deletes nothing automatically, because drinking-water rules ask for treatment and operator records to be kept for years (up to 10 years for some United States records, and 15 years for some Ontario records).
Removing you as a user stops your access at once; your past actions stay in the audit log.
Changing or removing your number or email as an alarm contact applies from the next alarm; earlier call-out records keep the number or address that was used then.
Backup copies are kept for up to a year.
Each finished month of regulatory records is also kept in a write-once archive for 10 years, which cannot be changed or deleted during that time. Your details are in it only where a regulatory record holds them: the number or address used in an alarm call-out, and your name or email on an action in the audit log, a certificate, a control change or a shift note. The alarm contact list, user accounts, sign-in history, invoices and support or feature requests are not archived, so those can still be corrected or deleted on request.
When a water supplier stops using WYLA, its records are handed over to it, then kept or deleted as WYLA's data retention policy sets out.
Your Auth0 sign-in account is deleted when you ask, or when you no longer need access.

7. Seeing and correcting your information

Ask your water supplier, or ask us. We will confirm whether we hold information about you, give you a copy, and correct it (section 8). Because we hold most of it for the water supplier, we may pass your request to them and help them answer; we will tell you if we do. We may need to check who you are first. We do not charge.

New Zealand: you can ask for access (information privacy principle 6) and correction (principle 7). The answer is due within 20 working days (Privacy Act 2020 sections 44 and 63). You can complain to the Office of the Privacy Commissioner (privacy.org.nz).
Canada: you can ask for access and correction (PIPEDA Schedule 1, clause 4.9). The answer is due within 30 days, which can be extended once by up to 30 days with notice (PIPEDA section 8). You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). In Alberta or British Columbia a provincial privacy law may apply instead, with its own commissioner; and if your water supplier is a municipality or other public body, its own freedom-of-information and privacy law applies to its records.
United States: no general federal law gives these rights, and state privacy laws often do not apply to public water systems. We answer requests in the same way regardless.

8. Corrections and deletion: what can and cannot change

Can be changed: your contact details, alarm choices, role and access, and your certificate record (each change is kept as a new version).
Cannot be changed or deleted by anyone, WYLA included: the audit log, the call-out log, certificate history, control permissions, operator-in-charge designations, the record of changes made at the panel, shift notes and sign-offs, signed reports, the notice log and notification cases, the calibration log, and laboratory results and imported laboratory files. The database itself refuses edits and deletions.
Why: drinking-water rules require that these records are not altered and show who made each entry (for example New Zealand's Water Services Act 2021 section 179, Ontario Regulation 128/04 section 27, and United States 40 CFR 141.33). A record that could be quietly edited would be no use as evidence - to the water supplier, or to you if your actions are ever questioned.
What happens instead: a correction is a new entry that says what is right and why; it is shown with the original, which is marked as corrected or superseded. If the record is not corrected the way you asked, you can give us a statement of the correction you want and we will keep it with the record (in New Zealand, information privacy principle 7).
Deletion: information that is not a regulatory record (for example your sign-in account, or your number for future alarms) is deleted or removed when you ask or when it is no longer needed. Regulatory records are kept for the retention period in section 6.

9. If something goes wrong

WYLA keeps a written procedure for privacy incidents and a register of every one. If a breach affects information WYLA holds for a water supplier, we tell that supplier within 72 hours of becoming aware of it at the latest, and within 24 hours when it clearly involves people's personal information (our own commitment), and help it tell you and the regulator where the law requires. For information we are responsible for ourselves, we tell you and the privacy regulator ourselves.

10. For water suppliers: a paragraph to give your staff

When you add a person to WYLA, you are collecting their information for WYLA, so please make sure they know. You can give them this paragraph (fill in the brackets):

[Supplier name] uses WYLA (Water YOU Looking At), a monitoring and alarm service, at our treatment plant(s). We have given WYLA your name, work email and [mobile number / operator certificate details] so it can send you alarms, record who acknowledged them, and keep the operator and treatment records the drinking-water rules require. WYLA stores this in Microsoft Azure in Canada; sign-in is handled by Auth0 in the United States[; texts and calls go through Twilio, outside Canada]. Records are kept for at least 10 years and are corrected by adding a new entry, not by editing. To see or correct your information, ask us or WYLA's privacy officer, John Farrugia (privacy@wateryoulookingat.com). The full notice is at https://app.wateryoulookingat.com/privacy.html.

11. Changes to this notice

We update this notice when what WYLA collects, or where it is kept, changes, and show the date at the top. Questions: John Farrugia, privacy officer, privacy@wateryoulookingat.com.