Consumers’ Association Pension and Employee Benefit Scheme Privacy Notice

This Privacy Notice applies only to members of the Consumers’ Association Pension and Employee Benefit Scheme (referred to below as “the Scheme”). If you are a member of the Consumers' Association Retirement Savings Plan with Aviva, this Privacy Notice does not apply to you and you can find more information here. 

This Privacy Notice explains what information the Trustees (“the Trustees”, “we”, “us”, “our”), and other companies acting on our behalf, may collect from or about you and about individuals connected to you, including any dependant or beneficiary nominated by you in relation to the Scheme (“Connected Persons”), why we collect it, how we will store it, how we may use it, who we may share it with and when we will destroy it. It also explains your rights regarding our use of your personal information and how you can update any information about you that is incorrect. 

Who we are 

For the purposes of data protection legislation, the board of Trustees (“the Trustees”, “we”, “us”, “our”) of the Scheme is a controller of your personal information. We are registered at the following address: 2 Marylebone Road, London NW1 4DF. 

We are responsible for the administration of your benefits payable from the Scheme. The Trustees also appoint an actuary to perform certain functions for them, in particular, to calculate the benefits that are payable to members. The Scheme Actuary is Alan Wilkes of XPS Pensions Consulting Limited. The Scheme Actuary is a data controller in their own right. You can find further information regarding XPS's data processing polices and safeguards here.

XPS Pensions Consulting Limited and other companies within the XPS Group (“XPS”) also provides wider actuarial and administrative services to the Scheme. As the Scheme Administrator, XPS supports the day-to-day operations of the Scheme on behalf of the Trustees, including managing member records, calculating and processing benefit payments, and providing members with information and responding to queries.

What information do we collect? 

Information that you provide to us 

You may give us your personal information when you: 

• apply to join the Scheme; 
• correspond with or contact us; 
• fill in death benefit request forms; 
• pay Additional Voluntary Contributions; 
• transfer benefits into or out of the Scheme;
• retire; or 
• otherwise interact with us.

Information that we receive from other sources 

We receive personal information about you from the employers who sponsor the Scheme. This will include your contact details, date of birth, gender, National Insurance number, employment details and financial information. 

We also receive information about you in certain circumstances from regulatory authorities or government departments, solicitors, independent financial advisers and/or other pension arrangements. 

In limited circumstances, such as for an ill health early retirement or for the purpose of taking out insurance on your life in a pension scheme or to purchase an annuity for you, medical information will be provided to us, with your written consent, by a medical professional. 

We may also collect information about you from public records or through the use of a tracing agency; for example, if we have lost contact with you and wish to contact you about your pension scheme benefits. 

What type of information do we process? 

We collect, store and use the following types of information: 

• name and contact details (including your postal address, telephone number, email address); 
• date of birth; 
• marital status; 
• gender; 
• copies of identification documents (including birth, marriage / civil partnership, death certificates); 
• National Insurance number; 
• details about your dependants; 
• employment details; 
• health details (for example sickness absence periods);
• information about benefits in other pension arrangements (if transferred into the Scheme); 
• financial information (for example bank details, salary details, contributions you and your employer have made to the pension scheme, amount of your pension entitlement, information relating to the amount of Annual Allowance and Lifetime Allowance you have used, information about pension entitlement in other pension arrangements where relevant); 
• correspondence you have had with us; and 
• retirement benefits information.

We will sometimes also collect the following information about any Connected Person: 

• name, date of birth, postal address, telephone or mobile number and email address; 
• information about your relationship with the Connected Person (e.g. that you are married to the Connected Person); and 
• where benefits are payable on your death, bank account details (to process pension and other benefit payments).

How do we use the information we collect and on what legal basis? 

The following sections describe in more detail how the Trustees, and companies who work on our behalf, may use your information, and in particular, the legal grounds on which we rely in doing so. 

What we use your personal information for 

We use the information collected for a number of purposes, including: 

• to administer the Scheme, including any potential transfers such as to a Master Trust; 
• to calculate and pay your benefits from the Scheme; 
• to comply with our legal obligations under the Scheme and to calculate the liabilities of the Scheme; 
• to carry out our obligations arising from any agreement that we have with, or concerning, you and to provide you with the information, benefits and services that you request from us;
• in relation to any correspondence (including queries relating to your membership of the Scheme) related to the administration of the Scheme; 
• to notify you about our services and changes to our services; 
• for statistical, financial modelling and reference purposes; 
• for internal record keeping; 
• for risk management purposes including the insurance of longevity risks and related demographic risks; 
• to comply with any present or future law, rule, regulation, guidance or directive, industry or professional rules and regulations, or any applicable voluntary codes; and 
• to comply with demands or requests made by local and foreign regulators, governments and law enforcement authorities, and complying with any subpoena or court process, or in connection with any litigation.

The Scheme Actuary and XPS need to use your personal data to advise the Trustees on the financial management of the Scheme. This advice helps ensure the Trustees are able to meet their obligations and to pay members’ benefits, and is necessary to comply with the legal, administration and funding obligations placed on the Trustees and the Actuary. 

The legal grounds we rely on to process your information 

The legal grounds on which we rely are: 

• to give effect to any contract with you relating to the provision of benefits from the Scheme; 
• to pursue our legitimate interests; 
• your consent; and/or 
• to fulfil a legal duty.

Legitimate interests 

When we rely on our legitimate interests, these are as follows: 

• ensuring the Scheme operates in accordance with the Scheme’s rules and relevant legislation; 
• ensuring that the Scheme operates to provide the relevant pension and other benefits;
• keeping our records up to date; 
• administering the Scheme, including any potential transfers such as to a Master Trust; and
• managing any risks associated with the Scheme.

The Scheme Actuary and XPS also hold and use your data in order to achieve the same legitimate interests, and (in their role as actuarial advisors) because they have their own legitimate interests in providing advice to the Trustees. 

The Trustees, Scheme Actuary and XPS recognise that some of the data they might process is particularly sensitive. 

Where we process personal information which is particularly sensitive (“special category data”), such as health data or data which may reveal your sexual orientation, we process that personal data on the basis that such processing is necessary in the establishment, exercise or defence of legal claims: 

• we process personal data relating to health in order to establish your entitlement under the rules of the Scheme to any relevant incapacity benefits; and 
• we process personal data included in your expression of wishes form, which may reveal your sexual orientation, in order to defend ourselves against any legal claim that we failed to take into account your wishes when determining the recipient of a discretionary lump sum death benefit.

Who do we share your information with? 

The Trustees and the Scheme Actuary are data controllers for the purpose of data protection legislation. XPS, as a provider of wider actuarial services, is also a data controller. The data controllers decide what data they need to collect and who it needs to be sent to. 

The Trustees, the Scheme Actuary and XPS pass information including your personal data between themselves in order to administer the Scheme. 

We as the data controllers, or the companies who work on our behalf, also share your personal information with the following third parties: 

• Data processors and service providers – to help us administer the Scheme, we may share your personal information with third parties who provide services to us or act on our behalf, for instance actuaries, insurers, auditors, legal advisers, tracing agencies, payment providers, financial institutions including a Master Trust, shipping companies or postal authorities;
• HM Revenue and Customs; 
• Other third parties – these third parties may be companies through which you have contacted us, or companies you ask us to contact on your behalf, for example an independent financial adviser. 
• Other circumstances in which we will disclose your information – we will disclose your information to local and foreign regulators, governments, law enforcement authorities, advisors and actuaries, your employer, courts, tribunals and arbitrators when we have a legal obligation to do so or when we believe our compliance with the request to be fair, reasonable and lawful, e.g. to detect, prevent or investigate security breaches, fraud or other crimes. We will also disclose your information to establish, exercise or defend legal claims.

Where your data is processed

In some instances we may need to send your information to parties outside of the UK.  These countries and territories may not have the same data protection laws as those in the UK. If we do transfer your information outside the UK we will take appropriate steps to protect that information. These steps include: 

• transferring to third parties in countries and territories that the UK Government has determined offers adequate protection for your information. Information about these adequacy decisions is available here; and
• entering into an agreement with the recipient of the data which includes clauses that the UK Information Commissioner’s Office has determined offer adequate protection for your information (more detail is available here).

What are your data protection rights? 

You have the following rights in relation to your personal data: 

• Access: The right to request access to and a copy of your personal information; 
• Restriction: You can ask us to pause processing your information in certain circumstances (e.g. you are disputing its accuracy); 
• Rectification: You can have any inaccuracies in your personal information corrected;
• Deletion: You can ask us to delete all your personal information in certain circumstances (e.g. if the information is no longer necessary for the purposes for which it was collected); 
• Objection: You can object to us processing your personal information in certain circumstances; 
• Portability: You can ask us to transfer your information electronically to you or another organisation in certain circumstances; 
• Withdrawal of consent: Where we rely on your consent to process your information, you can withdraw consent at any time, although this will not affect our uses of your personal information prior to the withdrawal of your consent; and 
• To lodge a complaint with the Information Commissioner’s Office (“ICO”) or other relevant supervisory authority: You can complain to the ICO (https://ico.org.uk/make-a-complaint/data-protection-complaints/) or other relevant supervisory authority about any aspect of our handling of your information.

More information about the right to complain can be found on the ICO website.

If you would like to exercise any of the above rights, please email or write to us using the details outlined in the section ‘How to contact us’ below. All of these rights are free to exercise and we will do our best to respond to you as quickly as possible and in any event, within one month of receipt of your written request. We will inform you within one month of receipt of such request if we will need longer to respond, for example due to the complexity of the request. 

Please be aware that you are under no obligation to provide us with your personal information. However, failure to do so may, in some circumstances, prevent us from being able to provide you with the Scheme’s benefits, or otherwise interact with you. 

When exercising your data protection rights we may ask you to verify your identity in order to help us respond efficiently to your request. 

We want to make sure that your personal information is accurate and up to date. Please always let us know if you think that it is not and needs updating. Details of how to get in touch are in the section ‘How to contact us’ below. 

How long will your personal information be retained? 

We will only keep information about you for as long as we need to fulfil the purposes for which we are processing your information (this means we are likely to keep some information about you for the life of the Scheme) unless the law permits or requires longer. We take steps to ensure that any companies that process your information on our behalf do the same. 

We have an internal retention policy where there are varying retention periods for different categories of information, depending on our legal obligations, the resolution of disputes and the enforcement of our agreements. The criteria which we use to determine how long we retain your personal information include: 

• legal and regulatory obligations; 
• record keeping; 
• data protection obligations; 
• practical reasons (e.g. storage costs); and/or 
• any requests for deletion.

Generally, we keep the information we hold about you for 7 years after your death or the death of your dependant (if we have paid benefits to your dependant following your death) or 120 years from your birth where we’ve not been notified of your death. 

This excludes: 

a. your identification documents, which we’ll keep for 7 years after the earliest of: 

• the date we pay out your Scheme benefits in full. 
• the date you transfer your Scheme benefits out of the Scheme. 
• the date of your death or the death of your dependant if we have paid benefits to your dependant following your death, or 120 years from your birth where we’ve not been notified of your death.

b. information in relation to your death, which we’ll keep for 7 years following the payment of your Scheme benefits in full. 

c. Information relating to a transfer of your benefits to another pension arrangement, which we will keep for 120 years from your birth where we have not been notified of your death. 

d. Information relating to a refund of your contributions, which we will keep for 120 years from your birth where we have not been notified of your death. 

How to contact us 

If you have any questions or concerns, or wish to exercise any rights, then you can contact the Trustees through the Scheme Administrator using the details below: 

By email 

which@xpsgroup.com 

By phone 

0330 054 5827 

By post 

The Consumers’ Association Pension and Employee Benefit Scheme  
XPS Administration
PO Box 562
Middlesbrough
TS1 9JA  

Changes to this Privacy Notice 

The Trustees may need to update this Privacy Notice from time to time. You can see when the Privacy Notice was last updated by checking the date at the bottom of this document. 

A summary of changes can be found in this section, along with the date they were made. If we make any updates, such as materially changing how we use your personal data, we will alert you as required by applicable privacy laws. 

[1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/

[2] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/transfer-risk-assessments/

This Privacy Notice was last updated on 3rd November 2025. Version 5.