Privacy policy - Retirement Benefits Plan

This policy is split into 9 sections. Each section can be accessed using the links below to find more information. This policy explains:

• 1. Who we are

  Our Privacy Policy applies to personal data collected and used by St Dunstan’s Retirement Benefits Plan (1973).  Under data protection law and regulation, we are a ‘data Controller’ and are registered as such with the Information Commissioner’s Office (Registration Reference Number: (ZA356585).

  The Plan and its Trust was established by St Dunstan’s (now the Blind Veterans UK Group) as the Principal Employer to manage, administer and pay the appropriate scheme benefits to members and nominated beneficiaries.

  References to “the plan”, “the scheme”, “Trust”, “Trustees”, “our’, ‘us’, and "we" means St Dunstan’s Retirement Benefits Plan (1973). 

  For the purposes of the scheme we are Joint Controllers with Blind Veterans UK (UK registered charity 216227) sharing responsibility for determining the purposes and means of the processing of personal data as defined in the UK-GDPR 2020.  Barnett Waddingham is a Data Processor as our scheme administrator.  Additionally, Barnett Waddingham also process personal data as the scheme Actuary, and when exercising that function is a data Controller in their own right.  You should refer to their privacy policies to understand how they process and treat your personal information.  Links to these policies are in Section 9 “How to Contact Us’.

• 2. What personal data we collect and why

  What we need to collect

  The term ‘personal information’ (or ‘data’) means information that relates to you as an identified or identifiable individual.  An individual can be identifiable either directly (name, address, mobile number etc.)  or indirectly (job title, email address, business phone number). Where there is insufficient information to identify an individual that information is not personal data.  We need personal information about our scheme members to allow us to provide you with your appropriate pension and benefits. 

  As a member of the scheme, we will process personal data about you for the purpose of setting up, administering, maintaining, calculating and paying pensions accurately to scheme members and appropriate dependents, while also meeting our legal obligations and pursuing our legitimate interests as your pension plan trustees. 

  This information may include:

  • Postal address, telephone number, email address.
  • Date and place of birth.
  • Gender (Recorded at birth for MHRC purposes)
  • Your national insurance number.
  • Career, unpaid leave, retirement details, membership status (in-service deferred, deferred or pensioner), details of last change in status.
  • Banking, salary, pension payment, AVC contributions, tax details and Guaranteed Minimum Pension entitlement.
  • Spouse and nominated beneficiary details.
  • Health details.

  We will be very clear with you that we wish to collect such information, our reason for collecting such information and we will only do so when we have a lawful basis for processing the information. 

  UK Data protection law and supporting regulation recognises certain information as ‘special category’ data and as being particularly sensitive.  This includes:  racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, certain biometric data, data concerning health or a person's sex life or sexual orientation.  Sometimes we may need to collect or may indirectly obtain such data.  This is most likely to be health details (e.g. in the case of ill health early retirement), where we need to consider discretionary benefits or appropriate pension payments.

  If you provide, either at our request or voluntarily, any sensitive personal information, you explicitly agree that we may collect and use it in order to provide our services in accordance with this Privacy Policy.

  The accuracy of your personal information is really important to us.  If you wish to update or correct any information we hold, please contact us using the contact details in Section 9 of this policy. 

  Why we need it

  We need your personal information in order to perform functions such as:

  • Statutory Requirements. Whether you are a deferred member or a current pension beneficiary, we need to comply with legal, audit and actuarial obligations as required by pension law. 
  • Administer and manage your pension. Whether you are a deferred member, a pension beneficiary or a dependent, the Blind Veterans UK Group payroll systems needs to calculate monthly retirement benefits, the value of pensions and AVCs, other benefits and entitlements such as a trivial commutation, transfers and payment details.  We also need to calculate the value of the pension fund.
  • Communicate with you. To know how you prefer to be contacted and to make adjustments as you specify.  To provide you with specific services, updates and information.  To assist with technical problems related to our services.
  • To improve our services and administration. To ensure the most efficient and appropriate use of the resources we have. 
• 3. How we collect your personal data

  We collect information about you in a variety of ways.  We may collect information you provide directly to us as well as information indirectly available from other sources, such as HMRC or tracking agents.  

  Direct from you

  You will give us personal data directly yourself: during the pension application process and subsequently when managing or amending your pension requirements. You will also give us personal information if you communicate with us or ask us to consider specific individual entitlements or adjustments.  

  Indirectly from other sources

  We may obtain your personal data indirectly when you give permission to others to share it or it is publicly available, such as from:

  • Third party organisations or Individuals. We may obtain information from third parties if you have agreed that they can approach us or we can approach them, for example a legal representative or health care agency.  We may also obtain information about you from official sources as part of enabling your pension services, such as HMRC for tax purposes or for the purpose of paying appropriate pensions using the scheme’s Actuary’s data.  

  Publicly available sources.  Public information may include information from places such as Companies House, the electoral register.  Additionally, the Post Office’s National Change of Address database allows us to keep your information up to date.

• 4. The lawful basis for processing

  Data protection law and regulation require us to have a lawful basis for processing your personal information.  These include:

  • Where you have given explicit consent to do so for notified purpose(s). This may include when we require special category health details to consider benefit entitlements or when considering a transfer in or out of the scheme.  Where we need your consent, it will be clearly identifiable as a consent for a specific purpose.
  • To comply with a legal obligation. For example, where we are ordered to do so by a court or regulatory authority or we are legally required to process information such as tax records, pension payments and actuarial services.
  • In performance of a contract. To fulfil the requirements of the contract such as payment of Additional Voluntary Contributions (AVCs) to a contracted 3^rd party provider. 
  • Where we as a pension scheme have a legitimate interest. Where we have a legitimate interest, we must ensure that we are not harming any of your interests or rights and only use it in a manner that you would reasonably expect us to.  For example, we need to administer and manage your pension scheme; be able to contact and communicate with you for pension purposes; certify your current status and details.

  Where we process special category personal information (such as health) we will ensure we do so in accordance with at least one of the additional conditions required such as having your explicit consent or carrying out our obligations as a pension provider.

• 5. Sharing and Protecting your information

  Protecting your personal data.

  We ensure that there are reasonable and appropriate technical and organisational controls in place to protect your personal details against unauthorised or unlawful processing and against accidental loss, destruction or damage.  We use the Blind Veterans UK Group systems as our Joint Controller.  Their computers, online systems and network are protected and routinely monitored.  We and they have policies and procedures in place which Trustees and staff are expected to comply with and for which they receive training. 

  Managing access and sharing of your personal data

  We undertake regular reviews of who has access to information that we hold to ensure that your information is accessible only by the necessary and appropriately trained trustees and staff and trusted third parties.  Where we share your data with a third-party processor, such as Barnett Waddingham as scheme administrator, our auditors, AVC providers, legal advisors, we require that they have appropriate technical and organisational measures in place to protect your information.  However, we may be compelled by law to disclose your personal data to a third-party, such as law enforcement agencies, courts or government bodies (e.g. HMRC) and have limited control over how it is protected by that party.

  Occasions, other than by law, when we may share your data include:

  • If you have agreed that we may do so.
  • When we use external service providers to process personal data on our behalf, for example, providing pension administration, tracing and actuarial services. A list of data processors used is included at the end of this document.
  • If we believe that we need to protect the rights, property or personal safety of the scheme or Blind Veterans UK and their personnel, scheme members and for other lawful purposes.
  • We may disclose aggregate statistics about our pension to describe our scheme and for audit purposes, but these statistics won’t include any personally identifying information without explicit consent.
  • If we or Blind Veterans UK (as Principal Employer) merge with another organisation or diversify forming a new entity, personal information will be transferred to the new entity.

  We will never rent, share, swop or sell your personal information to other organisations for their own purposes or to make money out of your data.

  Where we store your information

  The personal information you provide to us will be held within the Blind Veterans UK Group’s network / servers.  Where we have contracted with a third party to process your personal data it will also be processed on their IT systems and servers on our behalf.  As a deferred member or a current pension beneficiary your personal information will be processed by CoreHR on behalf of Blind Veterans UK payroll.  All CoreHR processing of client personal data is limited to servers located within the European Economic Area (EEA). 

  The Trustees of the St Dunstan’s Retirement Benefits Plan (1973) and the Blind Veterans UK Group, do not process Plan personal data on servers located outside of the UK.  If the circumstances for the processing of your personal data needed to change, we will put in place, where appropriate, safeguards to protect your data and rights.  If we need to transfer your personal data to a location outside of the UK, we will ensure if there is not an active “Adequacy” agreement in place we will conduct an appropriate risk assessment and put in to place appropriate “additional measures” to safeguard your personal data and your rights, such as the use of Standard Contractual Clauses (SCC). If the transfer is a one off or infrequent we may ask for your explicit consent to validate and conduct the transfer.

• 6. Retaining your information

  We hold your information for only as long as is necessary to fulfil the purposes for which the data was collected and our legitimate interests or in order to comply with legal or regulatory obligations, rules and requirements.

  On your death, we will retain information in order to continue to administer appropriate benefits to any nominated beneficiaries and to meet any legal or regulatory requirements or to protect our legitimate interests and for legal purposes, for example in the event of a dispute. Note: Information related to a deceased person is not subject to data protection legislation, however, information to in the public domain is protected by the common law duty of confidentiality. 

• 7. Your details on the internet and website

  Although the Plan has no website of its own, if you use the Blind Veterans UK Group website, for example to access this privacy policy, you should read their privacy policy to understand what personal information they may gather about you by doing so using such technologies such as cookies.

• 8. What are your rights?

  The UK’s data protection legislation includes the UK-General Data Protection Regulations 2020 (UK-GDPR) and the Data Protection Act 2018, these two authorities are to be jointly considered as the authority of UK data protection law.  This UK legislation gives everyone a number of very important rights.  In abbreviated form these are:

  • The right to be informed. Transparency over how we use your personal information.  This Privacy Policy falls under this right.
  • The right of access. Request information that we hold about you.
  • The right of rectification. Update or amend the information we hold about you if it is incomplete or inaccurate.
  • The right to erase or ‘right to be forgotten'. Ask us to remove your personal information from our records where there is no compelling reason for its continued processing.
  • The right to restrict processing. Ask us to supress the processing of your information.
  • The right to data portability. Obtain and reuse your personal data for your own purposes.
  • The right to object. Object to the processing of your information for certain purposes (such as marketing, research, statistics or our legitimate interests).
  • Rights in relation to automated decision making and profiling.

  If you would like to know more about your rights under the data protection law see the Information Commissioner’s Office (ICO) website which also explains how to contact them.

  Remember, you can exercise your rights in relation to your personal information at any time by contacting us using the contact details set out in the ‘How to contact us’ section of this policy.

  If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law and your rights, you can complain directly to the Information Commissioner’s Office at:

  Post:	Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  Phone:	0303 123 1113.
  Online:	www.ico.org.uk/make-a-complaint/your-personal-information-concerns/

• 9. How to contact us

  If you wish to raise any comments or questions regarding this Privacy Policy or you would like to discuss how we process your information, enquire about your rights or make a complaint, you are very welcome to do so.  You can contact our Data Protection Officer at:

  Post:	Data Protection Officer Blind Veterans UK, 12-14 Harcourt Street, London, W1H 4HD
  Phone:	020 4534 1127 (direct dial)
  Online:	dpo@blindveterans.org.uk

  Other scheme related Controller details

  The scheme Actuary’s (Barnett Waddingham ) privacy policy is at the following link, which includes details of how to contact them if required:  https://privacy.bwllp.co.uk/clients/St-Dunstans-Retirement-plan-GDPR-Privacynotice.pdf

  Appendix 1:  List of data Processors

  Data Processor’s Name	Purpose / service provided	Link to privacy policy
  CoreHR	Personnel, Payroll records,  and recruitment services	Privacy Policy CoreHR
  Office 365/Azure	Online Buinsess software	Privacy Policy statement Microsoft
  Barnett Waddingham	Pension Provider and Acurary	Privacy policy - St-Dunstans-Retirement-plan-