As Trustees of the Scheme, we are responsible for managing certain personal information about our members. In line with data protection legislation, we are legally required to inform you about the personal data we collect, how we use it, and the measures we take to keep it secure. This privacy notice has been created to provide you with that information clearly and transparently. 

Under data protection laws, the Trustees act as “data controllers”. This means we decide why and how your personal data is processed, ensuring it is handled responsibly and in accordance with legal requirements.

We currently collect and process various categories of personal data and confidential information at and for the duration of, your relationship with us and beyond (subject to appropriate retention periods set out at section 5 below). We will limit the collection and processing to information necessary to achieve one or more legitimate purposes as identified in this Privacy Notice. 
 
Personal data processed by us may include:  

• Contact details, including name, address, telephone numbers and email address;

• Identifying details, including Date of Birth, National Insurance number and Employee and Membership numbers; 

• Information that is used to calculate and assess eligibility for benefits, for example length of service and salary information; 

• Financial information relevant to the calculation or payment of benefits, for example bank account and tax details; 

• Information about your family, dependents or personal circumstances, for example, marital status and information relevant to the distribution and allocation of benefits payable on death; 

• Information about your health, for example, to assess eligibility for benefits payable on ill health, or when your health is relevant to a claim for benefits following the death of a member of the Scheme; 

• Information about a criminal conviction if this has resulted in you owing money to your employer and the employer may be reimbursed from your benefits;. 

• Information about your financial circumstances;  

• Information about your use of our app or website;  

• Visual images and personal appearance (such as photos or copies of passports), and voice recordings; 

• Background checks; and  

• Information about your communications with us. 

We may also process certain special categories of personal data where strictly necessary for completing specific activities related to our services, such as to make our services accessible to members or for reporting of complaints for regulatory purposes, or where it is in the wider public interest (for example, to protect members’ economic wellbeing or to prevent and detect unlawful acts, fraud and financial crime). We will only process special categories of personal data where we've obtained your explicit consent or are otherwise lawfully permitted to do so (and then only for the particular purposes and activities for which the information is provided). 

 
This may include information revealing: 

• Racial or ethnic origin 

• Biometric data 

• Information concerning health 

You have the right to withdraw your consent to the processing at any time by notifying the Trustees in writing. However, if you do not give consent, or subsequently withdraw it, the Trustees may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits. 

Where permitted by law we may process information about criminal convictions, criminal offences, related security details, alleged offences including unproven allegations, spent or previous convictions, or other details provided in relation to a criminal reference check or similar. We process this information for specific purposes, such as detecting and preventing fraud and financial crime, where it is in the wider public interest (for example, to protect members' economic wellbeing), or to make our services accessible to members or for reporting of complaints for regulatory purposes. 

We may use artificial intelligence models while providing products and services and this may include use of generative artificial intelligence models. We process this information for the purpose of locating your existing pensions from previous employers and other providers and bringing them all into one place on our platform for easier management.  

Where you have provided us with personal data about other individuals, such as family members, dependents or potential beneficiaries under the Scheme, please ensure that those individuals are aware of the information contained within this notice. The Trustees assume members have their beneficiaries’ consent to their data being shared with the Trustees. 

We obtain some of this personal data directly from you. 

We also receive personal information about you indirectly, from the following sources in the following scenarios:

• Your current or past employer(s) or companies that succeeded them in business (for example salary information); 

• from a member of the Scheme (where you are or could be a beneficiary of the Scheme as a consequence of that person’s membership); 

• Fraud prevention, law enforcement or government agencies; and

• From a variety of other sources including public databases, our advisers, tracing agencies, insurers and government or regulatory bodies. In some circumstances the member may be providing data due to statutory requirements (e.g., disclosure legislation requires members to share information about when they flexibly access benefits elsewhere with the Trustees). 

We will only use and share your information where it is necessary for us to carry out our lawful business activities. We want to ensure that you fully understand how your information may be used:  

• We have your permission – Our activities where we may rely on your consent include where; 

• we process certain special categories of data; or

• where we collect your permission for sending marketing or any other processing where we request your consent. 

Contractual Necessity - We may use this data to deal with all matters relating to the Scheme, including its administration and management. This can include the processing of your personal data for all or any of the following purposes:

• to communicate with you about your account(s) or the products and services you receive from us;

• to assess eligibility for, calculate and provide you (and, if you are a member of the to comply with our legal and regulatory obligations Scheme, your beneficiaries upon your death) with benefits;

• to identify your potential benefit options and, where relevant, implement those options;

• to allow alternative ways of delivering your benefits, for example, through the use of insurance products and transfers to or mergers with other pension arrangements;

• to allow alternative ways of delivering benefits to you, for example, through the use of insurance products and transfers to or mergers with other pension arrangements

• address any actual or potential disputes concerning the scheme;

• management of the Scheme’s liabilities, including the entering into of insurance arrangements and selection of Scheme investments;

• enabling the company’s service providers to provide aspects of its services to you;

• to comply with our legal and regulatory obligations as Trustees of the Scheme;

• to respond to queries from you and others that may receive benefits as a consequence of your membership, and to address any actual or potential disputes concerning the Scheme;

• the management of the Scheme’s liabilities, including the entering into of insurance arrangements and selection of Scheme investments;

• for statistical and financial modelling and reference purposes; and in connection with the sale, merger or corporate reorganisation of the employers that sponsor the Scheme and their group companies;

• providing member service support and tracking member requests; or 

• performing assessments and analysing your data for the purposes of managing, improving and fixing data quality. 

Legal Obligation - throughout your relationship with us, we are required by law to collect and process certain personal information about you. Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you. This may include processing to:

• Complying with the company’s legal obligations, any relevant industry or professional rules and regulations or any applicable voluntary codes;

• Confirm your identity, (including using biometric information and voice-recognition technology and other identification procedures, for example fingerprint verification where we have a valid legal basis e.g., consent); 

• Accessibility and providing reasonable adjustments; 

• Prevention and detection of fraud or other criminal activities; 

• Perform anti-money laundering, KYC and background checks on you, reporting to internal and external stakeholders; 

• Coordinate responses to business-disrupting incidents and to ensure facilities, systems and people are available to continue providing services; 

• Provide assurance that the Trustees have effective processes to identify, manage, monitor and report the risks it is or might be exposed to; 

• Conduct investigations into breaches of conduct and corporate policies by our employees; 

• Complying with demands or requests made by any relevant regulators, government departments and law enforcement or tax authorities or in connection with any disputes or litigation;

• Share data with police, law enforcement, tax authorities or other government and fraud prevention agencies where we have a legal obligation, including reporting suspicious activity and complying with production and court orders; 

• Deliver mandatory communications to customers or communicating updates to product and service terms and conditions;

• Investigate and resolve complaints, and remediate errors occurring on your account or service.

Legitimate Interests - We may process your information where it is in our legitimate interests do so as data controller or where it is in the legitimate interest of a third party: 

• Responding to enquiries and keeping a record of communications with enquirers; 

• Market research; 

• Analysing and improving the services provided by the company;

• Internal record keeping; 

• Send you relevant marketing information where you have not opted out (or where you have provided your permission); 

• Sale, merger, acquisition, disposal, reorganisation or similar change;  

• To make decisions about you and the continued operation of your accounts; 

• Compensate you for loss, inconvenience or distress as a result of services, process or regulatory failures;

• Responding and participating in industry improvements, consultations and initiatives, to monitor, maintain and improve internal business processes, information and data, technology and communications solutions and services (for example confirmation of payee); 

• Responding to and investigating complaints both raised directly to us, or raised through a third party such as a regulatory body;

• Managing relationship with introducers; 

• Provide assurance on the Scheme’s material risks and reporting to internal management and supervisory authorities on whether the Scheme is managing them effectively; 

• Assess the quality of customer services and to provide staff training. Calls to our service centres, video calls and communications to our mobile and online helplines may be recorded and monitored for these purpose;

• Perform analysis on customer complaints for the purposes of preventing errors and process failures and rectifying negative impacts on customers; 

• Risk reporting and risk management; 

• Research your experiences with us and to monitor the performance and effectiveness of products and services; 

• Identify new business opportunities and to develop enquiries and leads into applications or proposals for new business; 

• Perform general, financial and regulatory accounting and reporting; 

• Further our purpose to improve our and our customers’ environmental impact, including the aim of working towards a carbon neutral position; 

• Ensure business continuity and disaster recovery and respond to information technology and business incidents and emergencies; 

• Ensure network and information security, including monitoring authorised users’ access to our information technology for the purpose of preventing cyber-attacks, unauthorised use of our telecommunications systems and websites, prevention or detection of crime;

• Statistical and financial modelling and reference purposes;

• to monitor, maintain and improve internal business processes, information and data, technology and communications solutions and services.

So that we can provide you with products and services, meet our legal obligations and manage our business, it may be necessary to share your personal information with other third parties including:

• The Scheme administrators, MUFG Retirement Solutions Pension Administration (HS) Limited (MUFG);

• The administration platform provider, currently Cushon Group Limited;

• The Secretary to the Trustees, currently Cushon Group Limited;

We may also provide some of your data to the Scheme’s sponsoring employers and group companies of those employers, their advisers and potential purchasers of their businesses.

• The legal advisers to the Trustees, currently Pinsent Masons LLP;

• The Scheme auditors, currently Crowe UK LLP;

• The investment advisers, currently Isio Services Limited and Isio Group Limited;

• Tracing bureaus for mortality screening and locating members and beneficiaries, currently Lexis Nexis;

• The group life broker, currently Incorporate Insurance Services Limited;

• The group life insurer, currently Canada Life;

• The group accidental death insurer, currently Chubb;

• The data analyst/Integrated Service Provider for Pensions Dashboard, currently Lumera ITM UK Ltd;

• Pensions Dashboard via our Integrated Service Provider (Lumera ITM UK Ltd);

• Pension tracing service, currently Money Labs Ltd (t/a The Pension Lab);

• Automated pension transfer service, currently Origo Services Ltd;

• The Scheme’s banks, currently Barclays and HSBC;

• The Scheme’s Employer Portal Provider, Strait Logics;

• The web enabled system provider, currently ITS;

• Suppliers of IT, document production and distribution services;

• Payer of overseas benefits, currently Western Union;

• Providers of investments, insurers and other pension scheme operators:

• Government bodies and dispute resolution and law enforcement organisations, including the Courts, the Pensions Regulator, the Pensions Ombudsman, the Pension Protection Fund and His Majesty’s Revenue and Customs (HMRC):

• From time to time, specialist advisers and auditors (however usually on an anonymised and aggregated basis):

In some instances, advisers and service providers will be controllers in their own right and will be directly responsible to you for their use of your personal data. They may be obliged under the data protection legislation to provide you with additional information regarding the personal data that they hold about you and how and why they process that data. 

We do not generally make decisions based solely on automated decision-making within the meaning of UK GDPR. In the event that we rely solely on automated decision-making that could have a significant impact on you, we will provide you an opportunity to express your views and will provide any other safeguards required by law.

Your information is securely stored and encrypted both in transit and at rest. It may only be accessed on a need-to-know basis for the purposes set out in this Privacy Notice.

We manage our records to help us to serve our members well (for example for operational reasons, such as dealing with any queries relating to your account) and to comply with legal and regulatory requirements. Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.

In the unlikely event that recipients of your personal data are outside the EEA (this means your personal data may be transferred outside the EEA to a jurisdiction that may not offer an equivalent level of protection as is required by EEA countries), appropriate safeguards must be implemented with a view to protecting your data in accordance with applicable laws. Please contact the Trustees, using the contact details below, if you want information about the safeguards that are currently in place.

We will only keep your personal data for as long as we need to in order to fulfil the purposes identified above. In practice this means that we will retain your data for such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Scheme and for so long afterwards as may be required to deal with any questions, complaints or claims that we may receive about our administration of the Scheme. We may also retain your data for a longer period to comply with our legal and regulatory obligations.

Under data protection law, you have rights including: 

• Your right of access – You have the right to ask us for copies of your personal information.

• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. 

• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances. 

• Your right to data portability – You have the right to ask that we transfer your personal information you gave us to another organization, or to you, in certain circumstances. 

• You are able to remove your consent at any time. 

• You can exercise your rights & remove your consent at any time by contacting us using the contact details included below in this Privacy Notice. 

If you wish to exercise any of these rights or have any queries or concerns regarding the processing of your personal data, please contact the Trustees using the contact details provided below. You also have the right to lodge a complaint in relation to this privacy notice or the Trustees processing activities with the Information Commissioner’s Office, you can do this via the ICO’s website or telephone helpline.

The personal data we hold about you is used to administer your Scheme benefits and we may from time to time ask for further information from you for this purpose. If you do not provide such information or ask that the personal data we already hold is deleted or restricted, this may affect the payment of benefits from the Scheme. In some cases, it could mean the Trustees are unable to put your pension into payment or have to stop your pension (if already in payment).

Effective 9 December 2025 we have updated our privacy notice to comply with the new Data (Use and Access) Act 2025. This legislation enhances your rights regarding your personal data and introduces new requirements for how we collect, use and share your information.

Key Updates:

• Data Access Rights – You now have the right to request access to the personal data we hold about you, including information on how it is being used and shared; 

• Data Portability – You can request that your data be transferred to another service provider in a structured, commonly used, and machine-readable format;

• Increased Transparency – We are committed to providing clearer information about our data practices, including the purposes for which your data is collected and how long it will be retained;

• Enhanced Security Measures – We have implemented additional security protocols to protect your data against unauthorized access and breaches; 

• Opt-Out Options – You now have greater control over your data, including options to opt-out of certain data processing activities.

We may update this notice periodically. When we do this, we will inform you of the changes and the date on which the changes take effect.

Please contact the Trustees for further information using the contact details below:

Cushon 5007
Lytchett House
13 Freeland Park
Wareham Road
Poole
Dorset, BH16 6FA

Email us

You can obtain further information about these rights from the Information Commissioner’s Office at: www.ico.org.uk or via their telephone helpline (0303 123 1113).

Last review date: December 2025