Your privacy is important to us and we are committed to protecting it. We have created this Fair Processing Notice which will explain how we use the information we collect about you and how you can exercise your data protection rights. This fair processing notice will help you understand the following:

1. Who are we?
2. Personal information we collect
3. How we use the information we collect
4. Who we share your personal information with
5. How long will we keep your information?
6. Your data subject rights to your personal data
7. Our Fair Processing Notice
8. How you can contact us about this Fair Processing Notice?
9. How you can lodge a complaint?

We need to collect certain information to effectively manage your pension. This information comes from you directly and from third parties involved in your pension plan.

Information we collect directly from you:

1. Contact Information: Your name, address, email address, and phone number.
2. Demographic Information: Your date of birth, nationality, marital status, dependents, and gender.
3. Identification Information: Details from your passport, driving licence, your National Insurance number and recent utility bills (for verification purposes).
4. Financial Information: Bank account numbers, credit/debit card numbers, benefits information, employment details and history, salary and compensation, intended retirement age, tax liabilities, personal income, assets and liabilities, credit history, expenditure, insurance policies, and pension benefits.
5. Health Information: Information about your general health status and any existing medical conditions.
6. Sexual Orientation: We collect this information to enable us to address you appropriately and respectfully.
7. Investment Information: Your investment needs, priorities, risk profile, and decisions you make regarding your financial and investment portfolio.

We may receive similar information about you from:

1. Insurance Companies: Details about your insurance policies relevant to your pension.
2. Plan Administrators and Vendors: Information about your enrolment in and contributions to your pension plan.
3. Brokers or Agents: Information you have provided to them in relation to your pension.
4. Financial Institutions: Details about your financial accounts if they are linked to your pension.
5. Your Representatives: Information they provide on your behalf, with your consent.
6. Your Employer or Benefit Program Sponsor: Information about your employment, salary, and benefits, including your pension plan.

If you give us personal data about someone else, you are confirming that you have their permission to share this information with us. You are also confirming that they understand why we need their information and how we will use and disclose it. Additionally, you are confirming that they have consented to this use and disclosure. We encourage you to direct them to this fair processing notice so they can understand their rights and how we protect their information.

We will only use your personal data for the purpose(s) it was originally collected unless we reasonably believe another purpose is compatible with the original purpose(s). If we need to use your personal data for an unrelated or incompatible purpose, we will inform you and explain the legal basis for doing so. In some circumstances, where permitted or required by law, we may process your personal data without your knowledge or consent, but this will always be within the bounds of data protection laws and your legal rights.

Service Delivery: 

Purpose: 

• We use your personal data to provide the services you request from us. This includes using your data to provide our core pension administration service.

Lawful Basis: 

• Contractual obligation to fulfil our services.

Marketing and Communications: 

Purpose: 

• This includes using your data, with your consent, to provide updates, offers, and information about products or services that may interest you, including those from our affiliates.

Lawful Basis: 

• Consent, legitimate interest in keeping you informed about relevant products and services.

Regulatory Compliance and Legal Obligations: 

Purpose: 

• This covers using your data to meet legal and regulatory requirements, such as complying with rules from financial authorities, preventing and detecting crime, and cooperating with law enforcement and regulatory bodies.

Lawful Basis: 

• Legal obligation, legitimate interest in complying with legal and regulatory requirements.

Fraud Prevention and Security: 

Purpose: 

• This includes using your data to detect and prevent fraud, suspicious claims, and other illegal activities.

Lawful Basis: 

• Legal obligation, legitimate interest substantial public interest in preventing illegal activities. 

Business Reorganization or Changes: 

Purpose: 

• This covers sharing your data during due diligence processes or following a sale, merger, acquisition, or other business reorganization. 

Lawful Basis: 

• Legitimate interest in facilitating business changes.

Service Improvement and Analysis: 

Purpose: 

• This covers using your data to analyse and improve our products, services, and client experience. This may include website enhancements, marketing analysis, understanding client demographics, and sharing aggregated data with third parties.

Lawful Basis: 

• Legitimate interest to improve our services.

Legal Claims and Disputes: 

Purpose: 

• This covers using your data to investigate, respond to, and defend against legal claims and disputes. Legal obligation, legitimate interest in protecting our rights and interests.

Lawful Basis: 

• Legal Claims and Disputes: This covers using your data to investigate, respond to, and defend against legal claims and disputes. Legal obligation, legitimate interest in protecting our rights and interests.

Client Communication: 

Purpose: 

• This includes using your data to conduct business, respond to client queries, communicate with clients (including informing them of changes to services and products), and handle claims. Legitimate interest to fulfil obligations and manage legal claims.

Lawful Basis: 

• Client Communication: This includes using your data to conduct business, respond to client queries, communicate with clients (including informing them of changes to services and products), and handle claims. Legitimate interest to fulfil obligations and manage legal claims.

We may share your personal information with specific groups, including:

1. Those involved in managing your pension: This includes the trustee(s) of your pension scheme, your current or former employer, and any service providers they use. We will only share information when instructed by them.
2. Legal and regulatory bodies: This includes law enforcement agencies for preventing or detecting criminal activity, public authorities like HMRC for compliance purposes, and relevant parties for handling legal claims.
3. Organisations supporting our operations: This includes third-party suppliers who process data on our behalf, and potential parties involved in a sale or reorganisation of our business. These suppliers may, in turn, share data with further parties as necessary to perform their contractual obligations. Please note that this data sharing will always adhere to applicable data protection laws and regulations.

International data transfers

Your personal information may be transferred to, stored, and processed in countries outside of your jurisdiction. Aptia understands that data protection laws vary globally. Aptia will take appropriate steps to ensure your personal data remains protected in accordance with the relevant legal framework, regardless of where your data is processed.

Aptia has implemented strict safeguards, including contractual agreements, to ensure your data remains protected regardless of where it is processed. These safeguards are designed to meet the stringent requirements of relevant data protection laws in all jurisdictions where Aptia operates.

If you would like more information about the specific safeguards we have in place, the countries your data may be transferred to, or have any other questions, please contact us using the details provided below. We are committed to being transparent about our data handling practices including international data transfers.

We understand that your personal data is important to you, therefore you may request the following from us:

1. Request a copy of the personal data we hold about you.
2. Request your personal data to be deleted where you believe it is no longer required. Please note however, this request will not be valid where retention obligations are imposed on us by law or regulation.
3. Request the electronic version of the personal data you have supplied to us, so it can be provided to another company. We would provide the information in a commonly used electronic format.

4. Request to restrict the use of your data by us, under the following circumstances:

     If you feel that our processing activities are unlawful, and you do not want your data to be deleted.

5. Request your personal data to be rectified, if you feel that the data we hold about you is inaccurate or incomplete.

6. Object to the processing of your data under the following circumstances:

    Where we are processing your data based on consent that you have previously provided and you wish to withdraw your consent (e.g., to send you marketing information), or;

   Where we have told you we are using your data for our legitimate business interests, and you believe we should not be (e.g. you were in the background of a promotional video but you did not agree to be in it).

If you would like to request any of the above, please contact us and submit a written request. To help us verify your identity and process your request securely, please provide us with the following information:

• Your name;
• Address(es);
• Date of birth;
• Any policy IDs or reference numbers.

We aim to respond to your request within one month but if we do not, we will explain why in our response. Please note that submitting a request does not guarantee its fulfilment- we are often bound by law which can prevent us fulfilling some requests in their entirety, but when this is the case, we will explain this to you in our response. For instance, we require trustee approval before disclosing any information in response to a DSAR (Data Subject Access Request), as they act as the data controller.

You have the right to withdraw your consent for us to use your personal data for direct marketing or for processing sensitive personal data (special category data) at any time. However, please be aware that withdrawing your consent may limit our ability to provide certain products or services to you.

If you have any queries regarding our fair processing notice, please contact us and we will be happy to discuss any query with you. Our fair processing notice will be updated from time to time, so please regularly check this page for the latest version of this fair processing notice.

If you any questions or comments about this fair processing notice, please contact:

The Group Data Protection Officer 

Aptia 

40-B 

Tower 42 

25 Old Broad Street 

London

United Kingdom

EC2N 1HQ

You may also email us at dpo@aptia-group.com

If you wish to raise a complaint on how we have handled your personal information, please send an email to pensionuk.aptia-group.com or write to us using the address provided. Our Data Protection Officer will investigate your complaint and will give you additional information about how it will be handled. We aim to respond in a reasonable time, normally 30 days.

If you are not satisfied with our response or believe we are processing your personal information not in compliance with your jurisdiction’s Data Protection law, you can lodge a complaint with your Data Protection Authority.

In the UK, this is the Information Commissioner’s Office: https://ico.org.uk

In the US, this is the Federal Trade Commission: Federal Trade Commission | Protecting America's Consumers