Pensions Privacy Notice

This Privacy Notice was last updated on 27th November 2023.
Version 4

1. Who we are

For the purposes of data protection legislation, the board of Trustees of the Consumers' Association Pension and Employee Benefit Scheme is a controller of your personal information. We are registered at the following address: 2 Marylebone Road, London NW1 4DF.

The Trustees also appoint an actuary to perform certain functions for them, in particular to calculate the benefits that are payable to members. The Scheme Actuary is Alan Wilkes of XPS Pensions Limited. XPS Pensions Limited also provides wider actuarial services to the Scheme.

This Privacy Notice explains what information the Trustees (“the Trustees”, “we”, “us”, “our”) of the Consumers' Association Pension and Employee Benefits Scheme (“the Scheme”)  may collect from or about you and about individuals connected to you, including any dependant or beneficiary nominated by you in relation to the Scheme (“Connected Persons”), why we collect it, how we will store it, how we may use it, who we may share it with and when we will destroy it.  It also explains your rights regarding our use of your personal information and how you can update any information about you that is incorrect.  We are responsible for the administration of your benefits payable from the Scheme.

2. What information do we collect?

Information that you provide to us

You may give us your personal information when you:

• apply to join the Scheme;
• correspond with or contact us;
• fill in death benefit request forms;
• pay Additional Voluntary Contributions;
• transfer benefits into or out of the Scheme;
• retire; or
• otherwise interact with us.

Information that we receive from other sources

We receive personal information about you from your employer, who sponsors the Scheme.  This will have included your contact details, date of birth, gender, National Insurance number, employment details and financial information.

We also receive information about you in certain circumstances from regulatory authorities or government departments, solicitors, independent financial advisers and/or other pension arrangements.

In limited circumstances, such as for an ill health early retirement or for the purpose of taking out insurance on your life in a pension scheme or to purchase an annuity for you, medical information will be provided to us, with your written consent, by a medical professional.

We may also collect information about you from public records or through the use of a tracing agency; for example, if we have lost contact with you and wish to contact you about your pension scheme benefits.

3. What type of information do we process?

We collect, store and use the following types of information:

• name and contact details (including your postal address, telephone number, email address);
• date of birth;
• marital status;
• gender;
• copies of identification documents (including birth, marriage / civil partnership, death certificates);
• National Insurance number;
• details about your dependants;
• employment details;
• health details (for example sickness absence periods);
• information about benefits in other pension arrangements (if transferred into the Scheme);
• financial information (for example bank details, salary details, contributions you and your employer have made to the pension scheme, amount of your pension entitlement, information relating to the amount of Annual Allowance and Lifetime Allowance you have used, information about pension entitlement in other pension arrangements where relevant);
• correspondence you have had with us; and
• retirement benefits information.

We will sometimes also collect the following information about any Connected Person:

• name, date of birth, postal address, telephone or mobile number and email address;
• information about your relationship with the Connected Person (e.g. that you are married to the Connected Person); and
• where benefits are payable on your death, bank account details (to process pension and other benefit payments).

4. How do we use the information we collect and on what legal basis?

The following sections describe in more detail how the Trustees, or one of the companies who work on our behalf, may use your information, and in particular the legal grounds on which we rely in doing so. 

What we use your personal information for

We use the information collected for a number of purposes, including:

• to administer the Scheme, including any potential transfer to a Master Trust;
• to calculate and pay your benefits from the Scheme;
• to comply with our legal obligations under the Scheme, to calculate the liabilities of the Scheme, and to comply with regulatory and statutory regulations and voluntary codes.
• to carry out our obligations arising from any agreement that we have with, or concerning, you and to provide you with the information, benefits and services that you request from us;
• in relation to any correspondence (including queries relating to your membership of the Scheme) related to the administration of the Scheme;
• to notify you about our services and changes to our services;
• for statistical, financial modelling and reference purposes;
• for internal record keeping;
• for risk management purposes including the insurance of longevity risks and related demographic risks;
• to comply with any present or future law, rule, regulation, guidance or directive, and complying with any industry or professional rules and regulations or any applicable voluntary codes; and
• to comply with demands or requests made by local and foreign regulators, governments and law enforcement authorities, and complying with any subpoena or court process, or in connection with any litigation.

The Scheme Actuary and XPS Pensions Limited need to use your personal data to advise the Trustees on the financial management of the Scheme. This advice helps ensure the Trustees are able to meet their obligations and to pay members’ benefits, and is necessary to comply with the legal, administration and funding obligations placed on the Trustees and the Actuary.

The legal grounds we rely on to process your information

The legal grounds on which we rely are:

• to give effect to provisions of your contract of employment relating to the provision of benefits from the Scheme;
• to pursue our legitimate interests;
• your consent; and / or
• to fulfil a legal duty.

Legitimate interests

When we rely on our legitimate interests, these are as follows:

• ensuring the scheme operates in accordance with the Scheme’s rules and relevant legislation;
• ensuring that the Scheme operates to provide the relevant pension and other benefits;
• keeping our records up to date;
• administering the Scheme, including any potential transfer to a Master Trust; and
• managing any risks associated with the Scheme.

The Scheme Actuary and XPS Pensions Limited (in their role as actuarial advisors) also hold and use your data in order to achieve the same legitimate interests, and because they have their own legitimate interests in providing advice to the Trustees.

The Trustees, Scheme Actuary and XPS Pensions Limited recognise that some of the data they might process is particularly sensitive.

Where we process personal information which is particularly sensitive (“special category data”), such as health data or data which may reveal your sexual orientation, we process that personal data on the basis that such processing is necessary in the establishment, exercise or defence of legal claims:

• we process personal data relating to health in order to establish your entitlement under the rules of the Scheme to any relevant incapacity benefits; and
• we process personal data included in your expression of wishes form, which may reveal your sexual orientation, in order to defend ourselves against any legal claim that we failed to take into account your wishes when determining the recipient of a discretionary lump sum death benefit.

5. Who do the Trustees share my information with?

The Trustees and the Scheme Actuary are data controllers for the purpose of data protection legislation. XPS Pensions Limited, as a provider of wider actuarial services, is also a data controller. The data controllers decide what data they need to collect and who it needs to be sent to.

The Trustees, the Scheme Actuary and XPS Pensions Limited pass information including your personal data between themselves in order to administer the Scheme.

We as the data controllers, or one of the companies who work on our behalf, also share your personal information with the following third parties:

• Data processors and service providers
  
  To help us administer the Scheme, we may share your personal information with third parties who provide services to us or act on our behalf, for instance actuaries, insurers, auditors, legal advisers, tracing agencies, payment providers, financial institutions including a Master Trust, shipping companies or postal authorities, and HM Revenue and Customs.

• Other third parties
  
  These third parties may be companies through which you have contacted us, or companies you ask us to contact on your behalf, for example an independent financial adviser.
   
• Other circumstances in which we will disclose your information
  
  We will disclose your information to local and foreign regulators, governments, law enforcement authorities, advisors and actuaries, your employer, courts, tribunals and arbitrators when we have a legal obligation to do so or when we believe our compliance with the request to be fair, reasonable and lawful, e.g. to detect, prevent or investigate security breaches, fraud or other crimes. We will also disclose your information to establish, exercise or defend legal claims.

6. Where your data is processed

Some potential recipients of your information might be located outside the UK, in jurisdictions which do not have the same data protection laws as those in the UK. If we do transfer your information outside the UK we will take appropriate steps to protect that information, which include:

• transferring to third parties in jurisdictions that the UK has (or the European Commission had, at 31 December 2020), determined offers adequate protection for your information (information relating to adequacy decisions made by the UK Information Commissioner’s Office are available here [1]); and
• entering into an agreement with the recipient, which includes clauses that the UK Information Commissioner’s Office has determined offers adequate protection for your information (a template copy of which is available here [2]).

For more information, please contact us using the details outlined in the section How may I contact the Trustees about this privacy notice? below.

7. What are my data protection rights?

You have the following rights in relation to your personal data:

• Access:  The right to request access to and a copy of your personal information (which can be done by emailing PensionSAR@which.co.uk);
• Restriction: You can ask us to pause processing your information in certain circumstances (e.g. you are disputing its accuracy);
• Rectification:  You can have any inaccuracies in your personal information corrected;
• Deletion:  You can ask us to delete all your personal information in certain circumstances (e.g. if the information is no longer necessary for the purposes for which it was collected);
• Objection:  You can object to us processing your personal information in certain circumstances;
• Portability:  You can ask us to transfer your information electronically to you or another organization in certain circumstances;
• Withdrawal of consent: Where we rely on your consent to process your information, you can withdraw consent at any time, although this will not affect our uses of your personal information prior to the withdrawal of your consent; and
• To lodge a complaint with the Information Commissioner’s Office (“ICO”) or other relevant supervisory authority: You can complain to the ICO (www.ico.org.uk/global/contact-us/email) or other relevant supervisory authority about any aspect of our handling of your information.

More information about the right to complain can be found at https://ico.org.uk/for-the-public/. If you have any questions about these rights, or you would like to exercise them, please contact us using the details in the section How may I contact the Trustees about this privacy notice? below.

Please be aware that you are under no obligation to provide us with your personal information. However, failure to do so may, in some circumstances, prevent us from being able to provide you with the Scheme’s benefits, or otherwise interact with you.

When exercising your data protection rights we may ask you to verify your identity in order to help us respond efficiently to your request.

If you would like to exercise any of the above rights, please email or write to us using the details outlined in the section How may I contact the Trustees about this privacy notice? below.  All of these rights are free to exercise and we will do our best to respond to you as quickly as possible and in any event, within one month of receipt of your written request.  We will inform you within one month of receipt of such request if we will need longer to respond, for example due to the complexity of the request.

We want to make sure that your personal information is accurate and up to date.  Please always let us know if you think that it is not and needs updating.  Details of how to get in touch are in the section How may I contact the Trustees about this privacy notice? below. 

8. How long will my personal information be retained?

We will only keep information about you for as long as we need to fulfil the purposes for which we are processing your information (this means we are likely to keep some information about you for the life of the Scheme) unless the law permits or requires longer.  We take steps to ensure that any companies that process your information on our behalf do the same. 

We have an internal retention policy where there are varying retention periods for different categories of information, depending on our legal obligations, the resolution of disputes and the enforcement of our agreements. The criteria which we use to determine how long we retain your personal information include:

• legal and regulatory obligations;
• record keeping;
• data protection obligations;
• practical reasons (e.g. storage costs); and/or
• any requests for deletion.

Generally, we keep the information we hold about you for 7 years after your death or the death of your dependant (if we have paid benefits to your dependant following your death) or 120 years from your birth where we’ve not been notified of your death.

This excludes:

1. your identification documents, which we’ll keep for 7  years after the earliest of:

• the date we pay out your Scheme benefits in full.
• the date you transfer your Scheme benefits out of the Scheme.
• the date of your death or the death of your dependant if we have paid benefits to your dependant following your death, or 120  years from your birth where we’ve not been notified of your death.

2. information in relation to your death, which we’ll keep for 7 years following the payment of your Scheme benefits in full.
3. Information relating to a transfer of your benefits to another pension arrangement which we will keep for 120 years from your birth where we have not been notified of your death.
4. Information relating to a refund of your contributions which we will keep for 120 years from your birth where we have not been notified of your death.

9. How may I contact the Trustees about this privacy notice?

You can contact us by post, telephone and email as follows:

Postal address

Trustees of the Consumers' Association Pension and Employee Benefit Scheme
2 Marylebone Road
London
NW1 4DF

Telephone number: 020 7770 7000

Email: pensions@which.co.uk

If your questions or concerns relate to the Scheme Actuary or XPS Pensions Limited you should contact

Alan Wilkes
XPS Pensions Limited
Albion
Fishponds Road
Wokingham
RG41 2QE

You will find further information regarding XPS Pensions Limited’s data processing polices and safeguards here:

https://www.xpsgroup.com/legal-regulatory/privacy-policy/