Scheme Member Privacy Notice

What we do

What personal data do we collect or process?

How do we use your personal data?

What is the lawful basis for processing my personal data?

Recording calls to and from our administration telephone lines

For more information please read our call recording privacy statement.

We’ll collect a recording of the conversation, your phone number, the date and time of the call and your personal details, in order to identify you.

We’ll use call recordings to assist in quality monitoring, to investigate and resolve a complaint or dispute and for the detection, investigation and prevention of crime (including fraud).

We may be asked to share a call recording with the trustees of your pension scheme.

We may also share recording where necessary for law enforcement, investigation of fraud, criminal or court proceedings or at the request of a regulator or ombudsman, for example the Financial Conduct Authority, the Pensions Regulator or the Pensions Ombudsman.

Recording calls is necessary for our legitimate interests.

These include protecting you, us and our staff and complying with FCA consumer duty rules.

Because we’re regulated by the UK’s Financial Conduct Authority (FCA) we’re under a duty to act in a way that helps to protect consumers, which includes pension scheme members and beneficiaries. This is known as “consumer duty”.

As part of our consumer duty, we record telephone calls to and from our administration telephone numbers.

Verifying your identity using IDScan

For more information please read the information leaflet and FAQs we’ve sent to you with your invitation to use IDScan.

GBG Group plc provide the IDScan software, and they are a separate data controller. Please read their privacy notice for more information about how GBG uses your personal data. You can find it at www.gbgplc.com/en/legal-and-regulatory/products-services-privacy-policy/

In particular, the section headed “Biometrics Notice” explains how the technology works.

We’ll collect the personal data appearing on your identity documents and your selfie photograph. We’ll use this information to check your identity and the validity of your identity documents.

We’ll also perform a “passive liveness check”. This means comparing the image on your photo ID with your selfie.

This is called biometric data because it relates to your physical characteristics, is processed using technical means and uniquely identifies you.

We’ll use this information to check your identity and the validity of your identity documents.

We’ll perform the “passive liveness check” to confirm that a live human being is using IDScan and that it’s you.

When you claim your pension scheme benefits, the scheme’s trustees need to verify your identity. This is because they have an obligation to make sure benefits are paid to the right people.

If we ask you to verify your identify using IDScan, we will ask for your consent for this purpose.

As we are also processing biometric data we also ask separately for your explicit consent for this processing.

If you don’t consent, you won’t be able to use IDScan. We’ll have to verify your identity another way. For example, you might need to post your ID documents to us. This will take longer.

You can withdraw your consent at any time. Please see “Your rights” below.

Providing actuarial advice and other professional services to your pension scheme or fund

We need personal details including name, address, date of birth, sex, marital status and NI number.

We also need employment membership details, including length of service, salary, pension contributions and benefits paid.

In some cases, we need limited health information, for example whether retirement was due to ill health – this is sometimes referred to as special category data.

We’ll process this information to provide actuarial and other professional services to the scheme or fund.

This includes things like calculating the value of the pension scheme or fund, calculating benefits for members and advising on how much money the pension scheme or fund needs to pay all of the benefits.

We may also help the scheme or fund to manage its risk by transferring some of the liabilities to others, for example insurance and reinsurance companies, so we may share personal data with them for that purpose.

For some private sector pension schemes, one of our qualified actuaries may be personally appointed by the trustees as the scheme actuary. This is a special position under the Pensions Act 1995. Although the scheme actuary works for Hymans Robertson, he or she provides advice independently to the trustees.

We process your personal data for our legitimate interests, which are to provide services to the scheme or fund.

The trustees or administering authority also have a legitimate interest or legal obligation to manage the scheme or fund and its liabilities to comply with the law and to ensure members get their benefits.

If we process special category data (for example, relating to health), we rely on the exemptions under the Data Protection Act 2018 in connection with health and social protection (which includes pensions) and in connection with occupational pension schemes.

If you would like more information about these responsibilities, please read this document if you’re in a private sector pension scheme or this document if you’re in a local government pension fund.

Record keeping

We’ll retain a copy of the personal data provided to us by the scheme’s trustees or fund’s administering authority after our services agreement with them ends.

This includes a copy of all membership information, records of transactions and processes carried out on their behalf, and the work we do for them.

Your scheme or fund privacy notice describes in more detail the information that we may hold on behalf of the scheme or fund.

Please also see the section headed “How long will you keep my personal data?”

We’ll keep records to meet our audit, professional and regulatory obligations. For example, we may need to provide evidence to an auditor or regulator about something that’s happened in the past.

We may also need this information to help us defend against legal claims about something that’s happened in the past.

We’ll keep this information because it’s in our legitimate interests to do so.

These are to meet our audit, professional and regulatory obligations and to defend against legal claims.

Dealing with regulators

Your personal data we hold in connection with the pension scheme or fund, as professional advisers or scheme administrators.

Please refer to your scheme or fund privacy notice to understand more about what personal data we hold on behalf of the pension scheme or fund.

Where we receive a request from a regulator, for example the Financial Conduct Authority or the Pensions Regulator, we may disclose to them any of your personal data that we hold in connection with the pension scheme or fund, and which is relevant to the request.

It's in our legitimate interests to deal openly and transparently with regulators and to comply with relevant regulations, rules and guidance.

We may have a legal obligation to disclose your personal data in certain circumstances, for example if a regulator uses a statutory power to request information.