YOUR SCHEME WORKING FOR YOUR FUTURE

Data Privacy Statement

Trustee's commitment to your privacy

The Trustee of The ITB Pension Funds "Trustees" are committed to protecting and respecting your privacy and rights. This Privacy Statement ("Statement") gives you information about the Trustees, how they will collect and use personal data about you, the circumstances in which they may share or otherwise use the personal data and to whom they may disclose this personal data. Personal data is information, or a combination of pieces of information, that could reasonably allow you, or another living individual, to be identified.

The Trustees are data controllers in respect of the personal data they collect about you for the purposes of the EU General Data Protection Regulation as it applies to the laws of England and Wales (the "UK GDPR"). The Trustees address is:

The ITB Pension Funds
23 King Street
Watford
Hertfordshire
WD18 OBJ

Although matters can be addressed to the Trustees, The ITB Pension Funds Office operates and will respond on their behalf.

Information the Trustees may collect from you

The Trustees may collect and process personal data which you provide to them in connection with the Scheme. This may include data about your name, age, date of birth, gender, marital status, bank account details, National Insurance number, contact details and any other information you provide directly to the Trustees in connection with the Scheme. Also included may be your length of employment with your Employer, details of your dependents and other persons in your household, and your contact details (e.g. residential address, email address and telephone number). "Employer" means your employer(s) who currently participates, or who has previously participated in, The ITB Pension funds.

In addition, we may collect, hold and use the following categories of personal data about you that are of a sensitive nature ("Sensitive Personal Data") such as medical information and sexual orientation.

Information the Trustees may collect about you from your Employer or third parties

The Trustees may collect personal data about you from your Employer or third parties. This may include information relating to if you were auto-enrolled into the Scheme, your employment, your salary, your contributions and your benefits, to the extent relevant to your pension and related arrangements. Periodically, the Trustees may have or will collect personal data relating to you from third parties such as former employers or regulatory authorities. Personal data collected from third parties includes your tax status information.

Purposes for which and the basis upon which the Trustees will process your personal data

The purposes for which the Trustees may process your personal data, and the legal basis on which such processing may be performed, are:

Processing purpose

Types of personal data

Legal basis for processing

Communicating with you about the Scheme and your benefits

Information provided by you:

  • name
  • date of birth
  • gender
  • marital status
  • bank account details
  • National Insurance number
  • length of employment
  • details of dependants
  • contact details
  • other relevant information
    provided to us

Information provided by Employers
and third parties:

  • National Insurance number
  • payroll records and tax status information
  • information relating to your employment, salary, contributions and benefits
  • other relevant information provided to us

We have a legitimate interest in communicating with you about the Scheme and your benefits

Establishing, exercising and defending our legal rights

Information provided by you:

name

  • date of birth
  • gender
  • marital status
  • bank account details
  • National Insurance number
  • length of employment
  • details of dependants
  • contact details
  • other relevant information
    provided to us

Information provided by Employers
and third parties:

  • National Insurance number
  • payroll records and tax status information
  • information relating to your employment, salary, contributions and benefits
  • other relevant information provided to us

We have a legitimate interest in establishing, exercising and defending our legal rights

For audit, compliance and other risk management

Information provided by you:

  • name
  • date of birth
  • gender
  • marital status
  • bank account details
  • National Insurance number
  • length of employment
  • details of dependants
  • contact details
  • other relevant information provided to us

Information provided by Employers and third parties:

  • National Insurance number
  • payroll records and tax status information
  • information relating to your employment, salary, contributions and benefits
  • other relevant information provided to us

We have a legitimate interest in auditing the Scheme and ensuring that it is managed properly

Considering any potential beneficiaries of death benefits under the Scheme

Personal data of potential beneficiaries:

  • name
  • date of birth
  • marital status
  • contact details
  • other relevant information provided to us

We have a legitimate interest in selecting beneficiaries of your death benefits under the Scheme

Generally, the Trustees will rely upon the "legitimate interests" ground as the legal basis for processing your personal data. This means that the Trustees will process personal data for the legitimate interests of themselves or a third party to whom they may disclose personal data in accordance with this Statement. The legitimate interests being the administration of the Scheme (provided always that the legitimate interests are not overridden by the interests or fundamental rights or freedoms of Scheme members (or others) which may require protection of personal data).

The Trustees may also process Sensitive Personal Data for the following purposes and under the following legal bases:

Processing purpose

Types of Sensitive Personal Data

Legal basis and special condition for processing

Considering your eligibility to receive benefits early on grounds of ill-health
  • health information

We have obtained your explicit consent to process your health data

Retention of personal data

The Trustees will hold personal data of Scheme members and their dependants for as long as may be necessary in order to fulfil the purposes we collected it for as described above (Please see Purposes for which and the basis upon which the Trustees will process your personal data). Inevitably, this means that personal data may be retained by the Trustees for extremely long periods of time, including after entitlement to receive benefits by an individual and/or their beneficiaries has ceased. The end date for holding data in respect of a particular member is expected to be 30 years from the date on which the last payment is made to or in respect of that member.

To determine the appropriate retention period for your personal data, the Trustees consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data and whether the purpose of the processing can be achieved through other means. Our retention of your personal data, and the criteria we apply to determine how long it is necessary for us to retain your personal data, is kept under review.

Disclosure of personal data

The ITB Pension Funds Office administers the Scheme on behalf of the Trustees. In the course of administering the Scheme, the Trustees may share your personal data with the following categories of recipient:

  • administrator and platform provider (currently, Legal & General Assurance Society Ltd) who are responsible for the day-to-day administration of the DC section of the Scheme;
  • the Trustees' legal adviser (currently, Mayer Brown International LLP) for the purpose of providing legal advice to the Trustees;
  • the Trustees' auditor (currently, PricewaterhouseCoopers LLP) for the purpose of providing audit services to the Trustees;
  • the Trustees' actuary (currently, Government Actuary's Department) for the purpose of providing actuarial services to the Trustees ;
  • tracing agencies and consultants who assist with updating Scheme data or providing statistical information; and
  • providers of IT services and other third parties who assist with the day-to-day administration of the Scheme.

The Trustees may disclose your personal data to these third parties in connection with services provided by the third parties to the Trustees. At all times, the Trustees will ensure that the personal data is processed in accordance with their instructions and in circumstances which require the recipient to observe industry standard security measures in respect of the personal data.

The list of recipients is not exhaustive and the Trustees may from time to time need to share personal data with other third parties in order to administer the Scheme and pay benefits, for example, if the Trustees engage a different service provider. The Trustees will update this Statement if the categories of recipient change.

The DC Section of the ITB Pension Funds is currently administered by Legal & General Assurance Society Ltd ("L&G") and we may therefore disclose relevant personal data to L&G so that they can set up and manage your DC account. L&G is a data controller in respect of that personal data which means they will be directly responsible under the data protection legislation for protecting it. L&G's privacy statement can be found at: www.legalandgeneral.com/privacy-policy. In the event that L&G are in future replaced by a different provider, we may disclose relevant personal data to the new provider.

The Trustees may also disclose your personal information to third parties in the following types of situations:

  1. in the event that they wish to enter a buy-out/buy-in of any of the benefits under the Schemes, in which case they may disclose your personal data to the prospective counterparty to such a transaction; or
  2. if they are under a duty to disclose or share your personal data in order to comply with any legal obligation.

International transfers of personal data

As required by data protection legislation, the Trustees have strict security procedures regarding the storage and disclosure of personal data. The personal data that they collect about you may be transferred to, and stored at, or processed outside the UK, for example, in the European Economic Area ("EEA"). The UK Government considers the EEA to offer an adequate level of data protection.

The Trustees may also transfer the personal data about you to countries which have not yet been deemed by the UK Government to offer adequate data protection. In such cases, the Trustees will take steps to ensure an adequate level of data protection in the country of the recipient as required under the UK GDPR, please contact us if you woudl like more information about these steps . If the Trustees decide that personal data does need to be transferred to a country outside the UK which does not offer adequate protection, the Trustees will notify you in writing and ensure that appropriate technical and organisational measures are put in place so that such processing meets the requirements of the data protection legislation. If the Trustees cannot ensure such an adequate level of data protection, your personal data will not be transferred.

Automated decision-making

We do not envisage that any decisions will be taken about you using automated means. In the event that this position changes, we will notify you in writing.

Your rights under the UK General Data Protection Regulation

You have rights under the GDPR including:

  • the right to access your personal data. This right always applies. However, there are some exemptions which mean you may not always receive all of your personal data that we process;
  • the right to have your personal data rectified if it is inaccurate or incomplete. This right always applies;
  • the right to have your personal data deleted or removed in certain circumstances if there is no legitimate reason for its continued storage and processing;
  • the right to restrict the processing of your personal data in certain circumstances (for example, if you want the Trustees to establish its accuracy or the reason for processing it);
  • the right to object to your personal data being processed where we rely on a legitimate interest as a legal basis for processing your personal data (unless we have compelling legitimate grounds for the processing);
  • the right to request the transfer of your personal data which you have given to us to another party. This right only applies where we rely on your consent to process your personal data; and
  • where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent at any time.

You may address your requests in writing to:

The ITB Pension Funds Office (on behalf of the Trustees)
23 King Street
Watford
Hertfordshire
WD18 OBJ

Or by e-mail to pensions@itbpen.com