Valid from 24 March 2023

for the Amey OS Pension Scheme (the “Scheme”)

This notice is for members and beneficiaries of the Scheme. It has been prepared by ZEDRA Governance Limited (the “Trustee”, or “we”) in its capacity as Trustee of the Scheme. This notice will also be made available online on the Scheme’s website, details of which will be provided to you separately.
This notice replaces the previous version of this privacy notice and supplements any other notices and statements we issue that are specific to particular data collection / processing activities.

Why we are providing this notice to you

As the Trustee of the Scheme, we hold certain information about you and from which you can be identified (either from the information itself or with other information that we may hold) (“personal data”). In line with the transparency requirements of applicable data protection laws, we are required to give you specified information about the personal data we hold about you, how we use it, and the safeguards that are in place to protect it. This notice is designed to give you that information.

Why we hold your personal data

The Trustee processes personal data about you, in its role as a Data Controller, for the proper handling of all matters relating to the Scheme, including its administration and management, calculating, securing, and paying benefits and managing liabilities in relation to it. Further information about how we process this data is provided under the heading “How we will use your data” below.

The lawful basis for our use of your personal data will generally be one or more of the following:
a) We need to process your personal data to satisfy our legal obligations as trustee of the Scheme
b) We need to process your personal data for the legitimate interests of administering and managing the Scheme and liabilities under it; calculating, securing, and paying benefits; and performing our obligations and exercising any rights, duties, and discretions the Trustee has in relation to the Scheme
c) The processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract

Where we are processing ‘special categories’ of particularly sensitive data and you have given consent to the processing of that data (please see below for further information) then the provision of your consent will be the legal basis that we rely upon in relation to that processing.

What personal data we hold and how we obtain it

The types of personal data we hold and process about you can include:
• Contact details, including name, address, telephone numbers and email address
• Identifying details, including date of birth, national insurance number and employee and membership numbers
• Information that is used to calculate and assess eligibility for benefits, for example length of service and salary information
• Financial information relevant to the calculation or payment of benefits, for example bank account and tax details
• Information about your family, dependents or personal circumstances, for example, marital status and information relevant to the distribution and allocation of benefits payable on death
• Information about your health, for example, to assess eligibility for benefits payable on ill health, or when your health is relevant to a claim for benefits following the death of a member of the Scheme

We obtain some of this personal data directly from you. We may also obtain data from your current or past employer(s) or companies that succeeded them in business (for example salary information), from a member of the Scheme (where you are or could be a beneficiary of the Scheme as a consequence of that person’s membership), and from a variety of other sources including public databases, our advisers, and government or regulatory bodies.

Where we obtain information concerning certain “special categories” of particularly sensitive data, such as health information, extra protections apply under the data protection legislation. We will only process your personal data falling within one of the special categories with your consent, unless we can lawfully process this data for another reason permitted by that legislation. You have the right to withdraw your consent to the processing at any time by notifying the Trustee in writing. However, if you do not give consent, or subsequently withdraw it, the Trustee may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits.

Where you have provided us with personal data about other individuals, such as family members, dependants, or potential beneficiaries under the Scheme, please ensure that those individuals are aware of the information contained within this notice. 

How we will use your personal data

We may use this data to deal with all matters relating to the Scheme, including its administration and management. This can include the processing of your personal data for all or any of the following purposes:
• to contact you
• to assess eligibility for, calculate and provide you (and, if you are a member of the Scheme, your beneficiaries upon your death) with benefits
• to identify your potential benefit options and, where relevant, implement those options
• to allow alternative ways of delivering your benefits, for example, through the use of insurance products and transfers to or mergers with other pension arrangements
• to comply with our legal and regulatory obligations as trustee of the Scheme
• to respond to queries from you and others that may receive benefits as a consequence of your membership, and to address any actual or potential disputes concerning the Scheme
• the management of the Scheme’s liabilities, including the entering into of insurance arrangements and selection of Scheme investments
• for statistical and financial modelling and reference purposes
• in connection with the sale, merger or corporate reorganisation of the employers that sponsor the Scheme and their group companies

We may process your personal data when corresponding with the sponsoring employers of the Scheme in connection with your employment or their obligations as employers.

We may also process your personal data when liaising with or responding to orders or requests from, government bodies and dispute resolution and law enforcement organisations, including the courts, the Pensions Regulator, the Pensions Ombudsman, the Pension Protection Fund and HM Revenue and Customs (HMRC).

Organisations that we may share your personal data with

From time to time, we will share your personal data with our advisers and service providers so that they can help us carry out our duties, rights, and discretions in relation to the Scheme. As at the date of this Notice these include the following:
• The Scheme administrator Railpen
• The legal advisers to the Trustee Squire Patton Boggs (UK) LLP. Their privacy policy, which sets out how they carry out their duties in relation to personal data, can be found on their website: https://www.squirepattonboggs.com/en 
• The Trustee’s insurers, currently Pension Insurance Corporation plc and Just Retirement Limited. Their privacy policies, which set out how they carry out their duties in relation to personal data can be found on their websites: https://www.pensioncorporation.com/privacy-policy and https://www.wearejust.co.uk/definedbenefit/ 
• The Scheme actuary Andrew Allsopp of Broadstone Pensions Limited • Actuarial consultants Broadstone Pensions Limited and XPS
• The Scheme auditors Grant Thornton
• Investment advisers Schroders
• Communications advisers Quietroom
• Buy-in advisers, currently XPS Pensions Group
• Additional voluntary contribution providers Prudential and Utmost 
• Mortality screening providers Lexis Nexis
• The Scheme’s banks
• Suppliers of IT, document production and distribution services 

In some instances, advisers and service providers will be Data Controllers in their own right and will be directly responsible to you for their use of your personal data. They may be obliged under the data protection laws to provide you with additional information regarding the personal data that they hold about you and how and why they process that data. Further information may be provided to you in a separate notice or may be obtained from the advisers and service providers direct, for example, via their websites. Whenever one of our advisers or service providers acts as a joint controller with us in respect of your personal data, because we jointly determine the purposes and means of processing it, we will agree with them how we are each going to meet our respective and collective obligations under the data protection laws. If you would like more information about how such an arrangement works, please contact us using the contact details below.

We may also provide some of your data to the Scheme’s sponsoring employers and group companies of those employers, their advisers, and potential purchasers of their businesses.

In addition, where we make Scheme investments or seek to provide benefits for Scheme members in other ways, such as through the use of insurance or pension scheme mergers, then we may need to share personal data with providers of investments, insurers and other pension scheme operators. In each case we will only do this to the extent that we consider the information is reasonably required for these purposes.

The advisers, service providers and organisations referred to in the paragraphs above may use personal data to perform their functions as well as for statistical and financial modelling (such as calculating expected average benefit costs and mortality rates) and planning, business administration and regulatory purposes. They may also pass the data to other third parties (for example, insurers may pass personal data to other insurance companies for the purpose of obtaining reinsurance), to the extent they consider it appropriate to do so.

Where requested or if we consider that it is reasonably required, we may also provide your personal data to government bodies and dispute resolution and law enforcement organisations, including the courts, the Pensions Regulator, the Pensions Ombudsman, the Pension Protection Fund and Her Majesty’s Revenue and Customs (HMRC). They may then use the data to carry out their legal functions.

Transferring information outside the UK

In some cases, recipients of your personal data may be outside the UK. This means your personal data may be transferred outside the UK to a jurisdiction that has not been assessed by the UK Government as providing an adequate level of data protection. If this occurs, appropriate safeguards must be implemented with a view to protecting your data in accordance with applicable laws. Please contact the Trustee, using the contact details below, if you want information about the safeguards that are currently in place.

How long we keep your personal data

We will only keep your personal data for as long as we need to in order to fulfil the purposes identified above. In practice this means that we will retain your data for such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Scheme and for so long afterwards as may be required to deal with any questions, complaints or claims that we may receive about our administration of the Scheme. We may also retain your data for a longer period to comply with our legal and regulatory obligations.

Your rights

You have a right to access and obtain a copy of the personal data that the Trustee holds about you and to ask the Trustee to correct your personal data if there are any errors or it is out of date. In some circumstances you may also have a right to ask the Trustee to restrict the processing of your personal data, or to transfer or erase your personal data. In certain circumstances, you have the right to object to the processing of your personal data, for example, you have the right to object to processing of your personal data which is based on the legitimate interests defined in the section above headed “Why we process your personal data”, or where the processing is for direct market purposes.

You can obtain further information about these rights from the Information Commissioner’s Office at: www.ico.org.uk or via their telephone helpline (0303 123 1113).

If you wish to exercise any of these rights or have any queries or concerns regarding the processing of your personal data, please contact the Trustee using the contact details provided below. You also have the right to lodge a complaint in relation to this privacy notice or the Trustee’s processing activities with the Information Commissioner’s Office, you can do this via the ICO’s website or telephone helpline.

As explained in the section above headed “How we will use your personal data”, one of the reasons we collect and hold your personal data is to administer your Scheme benefits and we may from time to time ask for further information from you for this purpose. If you do not provide such information or ask that the personal data we already hold is deleted or restricted, this may affect the payment of benefits from the Scheme. In some cases, it could mean the Trustee is unable to put your pension into payment or has to stop your pension (if already in payment).

Updates

We may update this notice periodically. Where we do this, we will inform you of the changes and the date on which the changes take effect. 

Contacting us

Please contact the Trustee for further information using the contact details below.

 Railpen Limited
 Amey OS Pension Scheme
 PO Box 193
 Darlington DL1 9FP

 Tel: 0845 299 6996
 Email: amey@railpen.com