Privacy Notice

This online portal (this "Portal") is operated by Capita Pension Solutions Limited ( "we", "us", "our"), part of Capita plc. We are registered in England and Wales under company number 02260524 and have our registered office situated at First Floor, 2 Kingdom Street, Paddington, London, England, W2 6BD.

We are authorised and regulated by the Financial Conduct Authority under registration number 142484.

Our Data Protection Officer can be contacted at: privacy@capita.com.

We provide pension administration services to your employer and / or pension scheme trustee. As part of these services, they provide us with personal information about you so that we can administer your pension scheme and to allow you to apply for any additional optional benefits that your employer or pension scheme trustees ask us to make available to you.

Your employer and/or the pension scheme trustee are the controllers of your personal information. They decide how and why your personal data is used. We process your personal data on their behalf (as their data processor) when providing pension administration services and related services to them. This privacy notice supplements any privacy notice or policy provided to you by your employer and/or pension scheme trustee.

Personal data means any information that can identify you, either on its own or when combined with other information. We may collect, use, store and transfer different kinds of personal data about you. When your employer and/or pension scheme trustee decides to use our services, they (or their contractors) provide us with your personal details which are necessary to provide you with the benefits and services they are providing or offering you. The exact details may vary depending on the pension options being provided but this may include:

• identity data such as your full name, any previous names, username or similar identifier, marital status, title, gender and date of birth;
• contact data, such as phone number, address, company email address and personal email address;
• financial data, such as bank account details and financial information relating to your pension;
• employment data, such as national insurance number, employee/payroll number, annual salary and employment start date;
• scheme membership details, e.g. the date you enrolled into the pension scheme, contributions, benefits and entitlement and where applicable, dependents and beneficiaries details (e.g. if there is a spouse's pension/death in service/life cover);
• login details.

We also process personal data you provide through the Portal, including:

• updates to your personal details
• messages, queries and requests submitted by you
• forms or documents you upload.

In some cases, we may also process special category data about you, for example, information about your health in connection with ill-health early retirement or disability benefits. Where such data is processed, your employer or pension scheme trustee (as data controller) will rely on an appropriate legal basis under Article 9 of the UK GDPR, such as compliance with employment or social security law obligations, or your explicit consent.

In addition to information provided by your employer or pension scheme trustee, we may also receive or verify your personal data from other sources as part of our administration services. These may include:

• HM Revenue & Customs (HMRC), for example in relation to tax codes or allowance checks;
• tracing agents, where we need to locate members with out-of-date contact details;
• mortality screening services;
• other pension schemes, for example in connection with a transfer of pension benefits to or from your scheme.

When you enrol and visit this Portal you should check the details we hold about you are accurate.

We may ask you for further details in the following circumstances:

• the information provided by your employer/pension scheme trustee is incomplete; or
• an external provider of a particular benefit or service requires more information to provide that benefit or service.

Depending on the service, you may have the option to receive information by SMS e.g. pension investment alerts or instant message. Where you choose this service, you will have the option of providing your mobile phone number.

We may also ask you for details of your spouse, partner or other immediate family member if they are to be included as the nominated beneficiary of your pension. Where you submit such details, you do so on behalf of the relevant family member and you acknowledge and accept that it is your responsibility for letting them know: (i) that you have done so; (ii) what details you have submitted; and (iii) the purpose of submitting the details.

It is your responsibility to keep your personal details and those of any relevant family member updated. If there is any change in your personal details or those of your family members, please let us know the correct details by updating them on this Portal (where possible) or informing your employer and/or pension scheme trustee of such changes.

As we process your personal data on behalf of your employer or the trustee(s) of your pension scheme, we collect and use your personal data to:

• process your enrolment into your employer's pension scheme;
• administer your pension benefits;
• provide you with information and updates about your pension scheme and benefits;
• assist you in applying for further benefits or products and processing those applications (where applicable);
• respond to your queries and requests;
• support the administration of the pension scheme and your pension account more generally;
• support the prevention and detection of fraud, including pension liberation scams;
• facilitate pension transfers to or from your scheme, including sharing your personal data with the receiving or ceding scheme as necessary;
• process claims and benefits following the death of a scheme member, including communicating with beneficiaries, executors or personal representatives;
• communicate with you about your pension scheme and benefits;
• provide our pensions administration services to your employer's pension scheme in general; and
• provide you with information about special features of this Portal or other services.

Your employer and/or pension scheme trustee may have provided your email address to us for the purpose of providing our services. Please be aware that email is not a fully secure method of communication and messages may be intercepted or lost. If you do not want us to contact you by email, please update your contact preferences once logged in to this Portal, or notify your employer and/or pension scheme trustee.

We may also provide you with information by SMS text messaging if you have registered for this service. If you do not want to receive this information, please contact your employer and/or pension scheme trustee.

As we process your personal data on behalf of your employer or the trustee(s) of your pension scheme, they (as data controllers) are responsible for determining the lawful basis for processing your personal data and for providing you with details about this in their own privacy notice. Their lawful basis for processing will typically include legal obligations, the performance of a contract and/or legitimate interests.

We process your personal data solely on their behalf and on their instructions, in accordance with our contractual obligations (including data processing obligations) to them and applicable data protection laws.

We may use automated tools to support the administration of your pension and to help you use this Portal. These tools are designed to assist with tasks such as responding to queries and processing information more efficiently. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

As we process your personal data on behalf of your employer or the trustee(s) of your pension scheme, we will only share your personal data in accordance with:

• their instructions;
• our services contract with them; and
• applicable data protection laws.

Recipients of your personal data may include:

• your employer and/or the pension scheme trustee(s);
• other companies within our group;
• our third party service providers who support the operation of our business;
• our sub-processors and subcontractors who support delivery of services to your employer and/or the pension scheme trustee(s); and
• regulators and other authorities where disclosure is required by law or regulation, including The Pensions Regulator (TPR), HM Revenue & Customs (HMRC), the Pension Protection Fund (PPF), and the Pensions Ombudsman.

As we process your personal data on behalf of your employer or the trustee(s) of your pension scheme, we will only transfer your personal data outside the UK or EEA in accordance with:

• their instructions;
• our contractual obligations to them; and
• applicable data protection laws.

Where such transfers are permitted, we ensure that appropriate safeguards are in place. These may include:

• transfers to countries recognised as providing an adequate level of protection; or
• approved transfer mechanisms, such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (2021) together with the UK Addendum, or the UK–US Data Bridge (a framework that allows certain transfers of personal data to eligible US organisations) (where applicable).

If you would like more information about where your personal data may be transferred, you should contact your employer or the pension scheme trustee(s) (as data controllers).

As we process your personal data on behalf of your employer or the scheme trustee(s), we retain that data in line with:

• their instructions;
• our contractual obligations to them; and
• applicable legal and regulatory requirements.

This will typically include retaining personal data for a period after our services end, to support ongoing pension administration and compliance with legal and regulatory obligations. Unless a different retention period is required or agreed with your employer or the trustee(s), we retain your personal data for up to 7 years after the end of our services contract. Your employer or pension scheme trustee(s) may retain your pension data for longer in accordance with pensions legislation and regulatory requirements.

This Portal may contain links to websites operated by third parties (non-Capita companies). Such links are provided for convenience only and do not constitute any endorsement, approval or representation by Capita in relation to those third party websites or their operators. To the extent permitted by law, Capita accepts no responsibility or liability for the content, availability, security, policies or practices of any third party websites linked to this Portal. Any information you submit to third party websites will be governed by their own terms and privacy notices, and not by this privacy notice.

Under applicable data protection laws, you have a number of rights in relation to your personal data, including the right to:

• request access to your personal data (known as a 'subject access request');
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data in certain circumstances;
• request restriction of processing of your personal data;
• object to the processing of your personal data in certain circumstances;
• request the transfer of your personal data to you or a third party (data portability); and
• withdraw consent, where processing is based on your consent.

As we process your personal data on behalf of your employer or the trustee(s) of your pension scheme, they are responsible (as the data controllers) for responding to any requests to exercise those rights. If you would like to exercise any of these rights, please contact your employer or pension scheme trustee(s) directly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are concerned about how your personal data is being used. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

As we process your personal data on behalf of your employer or the trustee(s) of your pension scheme, we put in place appropriate technical and organisational measures to protect it, within the scope of our services and in line with our contractual obligations to them and applicable data protection laws.

Your employer or the pension scheme trustee(s), as data controller, are responsible for ensuring that appropriate security measures are in place for your personal data overall.

While we take reasonable steps to safeguard information provided through this Portal and in our communications, please note that no data transmission over the internet can be guaranteed to be completely secure.

We use cookies and similar technologies to operate and secure this Portal, including strictly necessary cookies that are essential for the Portal to function. Please see our full Cookie Policy on this Portal for further details.

This privacy notice was last reviewed and updated on the date shown at the top of this page. We may update it from time to time to reflect changes in legal requirements or in how we provide services to your employer or the pension scheme trustee(s). Where changes are material, we will take reasonable steps to notify you, for example by displaying a notice on this Portal. Please check this Portal regularly to ensure you are viewing the latest version.

If you have any questions about how your personal data is used in connection with the services we provide to your employer or the pension scheme trustee(s), or if you wish to exercise your data protection rights in relation to your pension, please contact your employer or the pension scheme trustee(s), as they are the data controllers.