Privacy Policy
Last Updated: 24/09/2026
1. Who we are
This privacy notice explains how Lightsonic processes personal data.
References to "Lightsonic", "we", "us" or "our" mean Lightsonic Ltd and, where relevant, Lightsonic Norway. The relevant entity will depend on which part of Lightsonic provides the service, enters into the relationship with you, or determines the purpose of the processing.
Lightsonic provides utility infrastructure intelligence services for water networks. We use existing fibre infrastructure, sensing technology, signal processing and machine learning to help water utilities detect potential leaks, prioritise field investigations and improve network visibility.
Lightsonic does not operate a consumer service and its core operational outputs are intended to relate to infrastructure, potential leak locations and field investigation priorities rather than identifying individuals. Most personal data we process is ordinary business, account, support, security, supplier, finance, recruitment or staff administration data.
This notice is primarily intended to explain how we process personal data under the UK GDPR, the Data Protection Act 2018, the EU GDPR as it applies in the EEA, and the Norwegian Personal Data Act. Where other privacy laws apply, we will comply with them as applicable.
2. When this notice applies
This notice applies when you:
- visit our website
- contact us, request a demo or receive communications from us
- use or access Lightsonic systems, reports, dashboards or service outputs as an authorised user
- work for, or represent, one of our customers, suppliers, partners or fibre network partners
- interact with us as part of our business operations or service delivery
- apply for a role with us or take part in a recruitment process
- work for us, or have worked for us, as an employee, worker, contractor, consultant or temporary staff member
This notice does not apply to third-party websites, applications or services that may be linked from our website or services. Those third parties are responsible for their own privacy practices.
Where appropriate, we may provide more specific privacy information to staff, contractors or candidates, for example during recruitment, onboarding or through internal policies.
3. Our role as controller and processor
Lightsonic acts as a controller where we decide why and how personal data is processed. This includes personal data processed for our own business purposes, such as website enquiries, demo requests, customer relationship management, account administration, supplier management, marketing, security monitoring, finance, compliance, recruitment, employment and business operations.
For recruitment, staff and contractor administration, Lightsonic acts as controller. We process this data to assess applications, enter into and manage employment or contractor relationships, meet legal and regulatory obligations, administer payments and benefits where applicable, protect our systems and support business operations.
Where we provide services to customers and process personal data on their behalf, we may act as a processor. In those cases, the customer is responsible for determining the purpose and lawful basis for the processing, and Lightsonic processes personal data in accordance with our contract and the customer’s instructions.
Lightsonic’s core service is focused on infrastructure monitoring and leak detection. Some personal data may still be processed where it relates to authorised users, customer contacts, supplier contacts, support activity, access logs, field validation feedback, operational records or information provided by customers or partners.
Where you are an end user of one of our customers and your personal data is processed by Lightsonic on that customer’s behalf, you may need to contact that customer directly to exercise your data protection rights. If you contact us about personal data we process on behalf of a customer, we may need to refer your request to the relevant customer.
4. Personal data we process
The personal data we process depends on your relationship with us. We aim to keep this proportionate and limited to what is necessary for the relevant business, service, legal or employment purpose.
| Category | Examples |
|---|---|
| Business contact data | Name, job title, employer or organisation, work email address, work phone number and communication history. |
| Account and access data | Authorised user account details, permissions, authentication records and access history. |
| Customer and service administration data | Customer records, demo requests, meeting notes, onboarding information, service communications and account management records. |
| Service and support data | Support requests, issue details, service correspondence, troubleshooting information and report access details. |
| Technical and security data | IP address, device and browser information, operating system, platform usage, audit logs, system logs and security events. |
| Operational service data | Infrastructure monitoring outputs, deployment area information, points of interest, field validation feedback and operational reporting information. This data is generally intended to relate to network assets and service delivery rather than identify individuals. |
| Supplier and partner data | Supplier or partner contact details, contract records, due diligence information and service records. |
| Billing and finance data | Business contact details, invoicing details, payment status, purchase order information and finance records. |
| Website and analytics data | Cookie identifiers, website usage, analytics data, preferences and consent choices. |
| Recruitment data | CV, application details, qualifications, employment history, interview notes, assessment results, references and right to work information where relevant. |
| Staff and contractor data | Contact details, role details, contract or engagement records, payment details, tax information, emergency contact details, absence records, training records and basic performance or management records where relevant. |
| Limited HR, legal and compliance data | Right to work checks, policy acknowledgements, health and safety records, grievance or disciplinary records, and background screening information only where lawful, relevant and proportionate. |
5. Special category and criminal offence data
Lightsonic does not routinely process special category personal data through its website or core services. We may process limited special category data where necessary and lawful in a recruitment, employment or contractor context, for example health information for sickness absence, reasonable adjustments or health and safety, or equal opportunities information where collected.
We do not routinely carry out criminal record checks. If checks are needed for a particular role, customer requirement or legal reason, we will only do this where permitted by law and where appropriate safeguards are in place.
If special category or criminal offence data is processed, we will identify an appropriate lawful basis and any additional condition required by data protection law.
6. How we collect personal data
We may collect personal data:
- directly from you when you contact us, request a demo, complete a form, use our services, apply for a role or communicate with us
- from your employer or organisation where they are our customer, supplier, partner or potential customer
- automatically through our website, platform, systems, cookies and similar technologies
- from customers where we provide services on their behalf
- from fibre network partners, suppliers, service providers or business partners where relevant to the service or relationship
- from publicly available sources, where relevant to business development, due diligence, recruitment or relationship management
- from recruitment agencies, job boards, referees, former employers, professional bodies or background screening providers where relevant and lawful
- from internal systems, managers, colleagues and service providers where relevant to staff, contractor, IT, security, compliance or business administration
7. Why we use personal data and our lawful basis
We only use personal data where we have a lawful basis to do so.
| Purpose | Personal data used | Lawful basis |
|---|---|---|
| Responding to enquiries and demo requests | Name, work contact details, organisation and message content. | Legitimate interests. |
| Managing customer, supplier and partner relationships | Business contact details, communications, contract records and meeting notes. | Legitimate interests and/or contract. |
| Providing access to Lightsonic systems, reports, dashboards or service outputs | User account data, access permissions, authentication records and audit logs. | Contract and/or legitimate interests. |
| Delivering infrastructure monitoring and reporting services | Operational service data, customer-provided data, report outputs and validation feedback. | Contract and/or legitimate interests. Where Lightsonic acts as processor, the customer determines the lawful basis. |
| Providing support and service administration | Support requests, communications, technical information and service records. | Contract and/or legitimate interests. |
| Security monitoring and incident response | IP addresses, access logs, audit logs, security events and device or system information. | Legitimate interests and/or legal obligation. |
| Website analytics and non-essential cookies | Cookie identifiers, device data and usage data. | Consent where required. |
| Marketing to business contacts | Name, work email address, organisation and preferences. | Legitimate interests or consent, depending on the communication. |
| Billing, finance and record keeping | Contact details, contract data, invoice records and payment status. | Contract, legal obligation and/or legitimate interests. |
| Managing recruitment and hiring | CV, application details, interview notes, assessment results, references, recruitment communications and right to work information where relevant. | Steps prior to entering into a contract, legitimate interests and/or legal obligation. |
| Managing staff and contractor relationships | Staff and contractor records, contact details, role details, HR records, payment information, absence records, training records and limited performance or management records. | Contract, legal obligation and/or legitimate interests. |
| Managing sickness absence, reasonable adjustments, health and safety and workplace obligations | Health information, absence records, reasonable adjustment records and health and safety records where relevant. | Legal obligation, legitimate interests, contract and applicable special category conditions. |
| Handling disputes, investigations and legal claims | Relevant HR, business, communications, security and legal records. | Legal obligation, legitimate interests and/or legal claims. |
| Legal, regulatory and compliance purposes | Records relevant to compliance, disputes, legal claims or regulatory obligations. | Legal obligation and/or legitimate interests. |
Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and freedoms. Where we rely on consent, you can withdraw your consent at any time. This will not affect processing carried out before consent was withdrawn.
8. Cookies and analytics
We use cookies and similar technologies to operate our website, understand how it is used and improve our services.
Some cookies are necessary for the website to work. We may also use analytics cookies, such as Google Analytics, to understand website usage and improve our website.
Where required, we will ask for your consent before setting non-essential cookies. You can manage your cookie preferences through our cookie banner or cookie settings.
9. Who we share personal data with
We only share personal data where necessary and appropriate. This may include sharing personal data with:
- customers, where we process data on their behalf or support service delivery
- fibre network partners, infrastructure partners or field delivery partners where needed for the relevant service
- service providers who support our website, hosting, systems, security, analytics, email, support, finance, HR, payroll, recruitment and business operations
- professional advisers, auditors, insurers, banks, payroll providers, pension providers and benefits providers where applicable
- recruitment agencies, referees, former employers, professional bodies or background screening providers where relevant and lawful
- regulators, public authorities, tax authorities, courts, tribunals or law enforcement agencies where required by law or where necessary to protect our rights
- prospective buyers, investors or advisers in connection with a business transaction, subject to appropriate safeguards
We require service providers that process personal data on our behalf to protect it appropriately and only process it in accordance with our instructions.
10. International transfers
We may process personal data in the United Kingdom, Norway, the EEA and other locations where our service providers operate.
Where personal data is transferred from the EEA or Norway to the UK, we rely on the UK’s adequacy status where applicable. Where personal data is transferred to a country that does not benefit from an adequacy decision, we use appropriate safeguards, such as standard contractual clauses, the UK International Data Transfer Agreement or other approved transfer mechanisms where required.
Where we act as a processor, international transfers will also be handled in accordance with the relevant customer contract and applicable data protection terms.
11. How long we keep personal data
We keep personal data only for as long as necessary for the purpose for which it was collected, including to provide services, manage our business, meet legal obligations, resolve disputes and maintain security.
| Data type | Typical retention approach |
|---|---|
| Website enquiry and demo request data | Retained for as long as needed to respond and manage the relationship. |
| Customer account and business contact data | Retained for the duration of the customer relationship and a reasonable period afterwards. |
| Authorised user account data | Retained while the account is active and for a limited period afterwards for audit, security and administration purposes. |
| Supplier and partner records | Retained for the duration of the relationship and as needed for contract, finance and audit purposes. |
| Support records | Retained for as long as needed to provide support, evidence service history and manage risk. |
| Security and audit logs | Retained for a limited period needed for security monitoring, investigation and audit. |
| Operational service records and reports | Retained in line with customer contracts, service requirements and operational needs. |
| Marketing data | Retained until you unsubscribe or we no longer have a lawful reason to contact you. |
| Contract and finance records | Retained in line with legal, accounting and business record requirements. |
| Recruitment records | Retained for the recruitment process and a reasonable period afterwards to manage queries, evidence decisions and handle legal or regulatory requirements. Longer retention may apply where a candidate is hired or agrees to be considered for future roles. |
| Staff and contractor records | Retained for the duration of the employment or engagement and for a reasonable period afterwards in line with legal, tax, accounting, employment and business record requirements. |
| Data processed on behalf of customers | Retained in accordance with the relevant customer contract and instructions. |
When personal data is no longer needed, we delete it, anonymise it or securely archive it where retention is still required.
12. How we protect personal data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
- access controls
- role-based permissions
- encryption where appropriate
- logging and monitoring
- secure configuration
- supplier due diligence
- staff awareness and confidentiality obligations
- incident response processes
- backup and recovery arrangements
No system can be completely secure, but we work to protect personal data in line with applicable law, our contractual obligations and good security practice.
13. Automated decision-making
Lightsonic does not use personal data to make solely automated decisions about individuals that produce legal or similarly significant effects.
Lightsonic uses signal processing and machine learning in connection with infrastructure monitoring and leak detection. This is intended to support operational analysis of network assets and field investigation priorities, not to make decisions about individual people.
14. Your rights
Depending on where you are located and the circumstances of the processing, you may have rights to:
- request access to your personal data
- request correction of inaccurate personal data
- request deletion of your personal data
- request restriction of processing
- object to processing
- request data portability
- withdraw consent where processing is based on consent
- complain to a data protection authority
Some rights may not apply in all circumstances. Where we process personal data as a processor on behalf of a customer, we may need to refer your request to that customer.
15. Complaints
We would appreciate the opportunity to address any concerns first, so please contact us using the details below.
You also have the right to complain to a data protection authority:
- If you are in the UK, you can contact the Information Commissioner’s Office.
- If you are in Norway, you can contact Datatilsynet, the Norwegian Data Protection Authority.
- If you are elsewhere in the EEA, you can contact your local data protection authority.
16. Children
Our website and services are intended for business users and are not directed at children. We do not knowingly collect personal data from children through our website or services.
17. Changes to this notice
We may update this notice from time to time. When we make changes, we will update the date at the top of this notice. Where changes are significant, we may take additional steps to notify you.
18. Contact us
For questions about this notice or how we use personal data, please contact:
Lightsonic Ltd71-75 Shelton Street
London
WC2H 9JQ
United Kingdom Lightsonic HQ
Sigden 2
6518 Kristiansund
Norway
Email: info@lightsonic.ai