Data protection laws require us to provide you with information about how the ScottishPower Pension Scheme (the “Scheme”), protects and respects your privacy when dealing with your data.
You do not need to take any action in relation to this Privacy Information Notice.
This Privacy Information Notice has been designed to explain clearly what personal data we use, how we use it, the legal reasons why we need to use it in order to provide you with a pension and the limited circumstances in which we share that personal data (for example with service providers like the scheme administrator).
Please read this Privacy Information Notice as it contains important information about how you can contact us if you have any questions.
This Privacy Information Notice and updated versions of this Privacy Information Notice will be available on www.sppensions.com.
You can contact the scheme administrators, Aptia UK Limited, trading as Mercer at:
ScottishPower Pension Scheme
c/o Mercer Limited
Post Handling Centre
St James’s Tower
Charlotte Street
Manchester
M1 4DZ
Phone: 0330 808 1523
Online secure digital portal: https://contact.mercer.com/green
If you have any questions regarding this Privacy Information Notice or about our privacy practices, please contact us by email at pensions@scottishpower.com or by writing to us at the address set out below in ‘Contact Us’ and marking your query for the attention of The Pensions Director.
Who are “we”?
When we say ‘we’ or ‘us’ or “the Trustee(s)” in this Privacy Information Notice, we are referring to the Trustee of the ScottishPower Pension Scheme with our principal office at 320 St. Vincent Street, Glasgow, G2 5AD.
We are a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this Privacy Information Notice.
In order to run the Scheme effectively for our members, we appoint a Scheme Actuary to calculate the value of the Scheme’s assets and liabilities based on its membership profile and to set employer contribution rates based on that information.
The Scheme Actuary is currently Martin Potter of Hymans Robertson LLP. The Scheme Actuary may need to use your personal data in relation to instructions from the Trustee or where the processing relates to their statutory or regulatory obligations. Generally, when the Scheme Actuary is using your personal information in connection with the provision of these actuarial services, the Trustee and the Scheme Actuary will be joint data controllers of your personal data. This means that the Trustee and the Scheme Actuary jointly determine how we hold and use personal information about you.
However, in limited circumstances the Scheme Actuary may be a data controller in his/her own right. In such circumstances, your personal information will only be used in connection with the provision of these actuarial services or in connection with the Scheme Actuary’s statutory or regulatory obligations.
Where the Scheme Actuary is acting as a joint data controller or data controller in his/ her own right in the provision of actuarial services, when we say ‘we’ or ‘us’ in this Privacy Information Notice we are also referring to the Scheme Actuary.
Who do we collect personal data about?
Personal data is information that can be used to uniquely identify or contact a single person. We will collect and process personal information about:
- Contributing members;
- Deferred pensioners;
- Pensioners (including those in receipt of dependants’ or spouses’ pensions);
- Former members/pensioners with no further entitlement under the Scheme;
- Ex-spouse participants;
- Non-members who will or may receive benefits from the Scheme (for example, on the death or divorce of a member);
- Non-members who have received benefits from the Scheme and have no further entitlement;
- Non-members who have submitted enquiries;
- Current and former advisors and service providers;
How might we use your information?
We use information held about you in order to administer the Scheme. In particular, we will use personal data in order to:
- Issue communications and information (whether through us or through third parties);
- Respond to member and third party queries and disputes;
- Calculate and pay benefits (including pensions, lump sums and transfer values) from the Scheme;
- Establish eligibility for benefits (including following divorce or death of a member, or in cases of ill health or early retirement);
- Calculate and perform a reconciliation of contributions;
- Pay tax charges and monitor whether allowances are exceeded and report to HMRC (including compliance with anti- money laundering duties, if applicable);
- Ensure compliance with contracting-out requirements;
- Prepare Scheme accounts, audits and/
- or the Pensions Regulator (TPR) Scheme returns;
- Carry out actuarial valuations and calculations;
- Decide or advise upon the investment of pension Scheme assets and to implement investment decisions;
- Obtain or prepare quotes for annuities or other insurance products;
- Purchase annuities or other insurance products;
- Demonstrate our past compliance with our duties;
- Establish your identity;
- Pay fees and expenses owed; and
- Carry out the general administration functions of the Scheme (for example, to ensure documentation is properly executed and drafted, Trustees are validly appointed, conflicts of interest are identified and managed and/or appropriate records are maintained).
What information do we use?
Personal data processed by us may include, but is not limited to:
- Personal details such as name; membership/reference number; address (including former addresses); contact details (including telephone numbers and e-mail addresses); date of birth; gender (including details of any gender recognition certificate); marital status (including divorce details if, for example, benefits form part of a divorce settlement); family members; beneficiary nominees; Passport or identification card details; birth/adoption certificate details; and death certificate details.
- Employment records including employment history, information regarding periods of pensionable service (including periods of absence), previous salary data.
- Financial details including your bank account details; salary information; tax and National Insurance information.
- Pension information including defined benefits contributions (contributions paid to the Scheme, relating to defined benefits, by or on behalf of a member); defined benefits, whether actual or potential, paid or payable to or in respect of a member; additional voluntary contribution account information; contracting-out records; and death benefit distribution information (including expression of wish forms and information required to assess eligibility for, or allocation of, benefits to potential beneficiaries).
If you are a Trustee or former Trustee of the Scheme we will hold personal data in your capacity as a Trustee including name, address, contact details, bank account details, Passport or identification card details, information relating to actual or potential conflicts of interest, birth/adoption certificate details, death certificate details.
If you are an advisor or service provider to the Scheme we will hold personal data in relation to the provision of services to us including name, address, contact details and bank account details.
Special Categories of Personal Data
Only if required for the consideration and/ or award of benefits, we may also collect and store information about your health, including any medical conditions.
These special categories of personal data will only be processed for the purposes of establishing eligibility for benefits, the calculation and payment of those benefits and demonstrating our past compliance with our duties.
How do we collect your information?
We may collect personal data:
- Directly from you when you correspond with us by phone, e-mail or otherwise or when you provide us with any additional information, for example, through your ScottishPower pensions record online, when you attend worksite presentations, roadshows or other events, when you are appointed as a Trustee, when we appoint you as a service provider;
- From third parties such as our service providers (for example, our scheme administrator (including our former scheme administrators) or scheme actuary), the Principal Employer ScottishPower UK PLC (for example, when contributions are paid into the Scheme) or other Scottish Power group companies that participate in the Scheme, another pension scheme if you have transferred benefits, where a member includes your details in a beneficiary nominee form, from a third party in relation to an event affecting you (for example, in the event of serious ill health), or from third party agencies or publicly accessible sources to try and find you when we have lost contact with you. We also work closely with third parties (including, for example, GPs and consultants);
- From regulatory authorities (such as the Pensions Regulator) or government departments (such as HMRC or the Department for Work and Pensions).
What is our legal basis for using your information?
We must by law provide benefits in line with the Scheme’s governing documents and must also meet other legal requirements when looking after the Scheme. We will use your personal data to comply with these legal obligations, to establish and defend our legal rights, and to prevent and detect crimes such as fraud. We may need to share your personal data with other people for this reason, such as courts and law-enforcement agencies.
We also have a legitimate interest in properly looking after the Scheme. This includes paying benefits as they fall due; buying insurance contracts; direct-debit instruction checks; communicating with you; and ensuring that correct levels of contributions are paid, that benefits are correctly calculated, and that the expected standards of Scheme governance are met (including standards set out in Pensions Regulator guidance).
We also have a legitimate interest to provide you with a high quality service including supporting your retirement journey and monitoring the suitability of the options you are offered at retirement
If we need to use information about your health (or other very personal and private information), we may ask your consent. However, sometimes there may be reasons of public interest or law that enable us to use this information without consent, for example, for the purposes of making a determination in connection with your eligibility for the Scheme or with any benefits that may be payable under the Scheme.
If we have asked for and you have given us your consent, you can withdraw your consent at any time by using the details below in the ‘Contact Us’ section. This may affect what we can do for you unless we have another lawful reason for using your information.
Sometimes your personal data may be used for statistical research but only in a form that no longer identifies you.
How long will we hold your information for?
We will hold your personal data on our systems for as long as is necessary to ensure we can satisfy our legal obligations regarding the Scheme and pay any benefits due to you or concerning you.
We will retain your information for as long as is necessary to ensure that, if a query arises in the future about your benefits, whether from you or your beneficiaries or a third party, we have sufficient information to deal with that query.
We review our retention periods for personal data on a regular basis.
Who we might share your information with
In order to administer the Scheme, we may from time-to-time share your personal data with various entities including: any Scheme Trustees, employers, any Scheme Actuary appointed by us (currently Martin Potter of Hymans Robertson LLP); any scheme administrator appointed by us (currently Aptia UK Limited, trading as Mercer), any employees of ScottishPower UK PLC or other ScottishPower group companies who are appointed to carry out work on behalf of or in relation to the Scheme, our professional advisers, our auditors, our insurers, HMRC, the Pensions Regulator, Ombudsman, and any other service providers we use to support the Scheme who provide services including but not limited to information processing, managing and enhancing member data, providing member services, print and mailing services, investment management, cloud hosting and data analytics.
If your benefits are transferred to another scheme, we will also need to give the administrators of that scheme information about you.
Our service providers may correspond with you directly in order to provide these services.
We may also disclose your personal information to third parties to:
- Comply with any court order or other legal obligation or when data is requested by government or law enforcement authorities;
- Comply with our obligations under any complaints process;
- Protect the rights, property, or safety of us or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
International transfers of personal data
From time to time, we may transfer your personal information outside of the EU to service providers, subcontractors and regulatory authorities for the purposes described in this Privacy Information Notice. For example, for current contributing members data is transferred overseas to insure death in service benefits. If we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law, for example we may use the model contracts in a form approved by regulators or require that your personal data is protected through supplier binding corporate rules.
Your rights
Your rights include:
- Transparency over how we use your data and to make a subject access request (right of access);
- A right to have your personal data updated and corrected (right of correction/ rectification);
- A right to ask us to delete your information (right to be forgotten);
- A right to ask us to stop processing your information (right to restriction);
- A right to object to (i) processing based on our legitimate interests; (ii) processing of your information for direct marketing purposes; and (iii) automated decision making and profiling (right to object);
- A right to receive a copy of your information, or have this sent to a third party (right to data portability); and
- A right to claim compensation for material or non-material damage caused if we breach the data protection rules (right to compensation).
If you would like to exercise any of these rights, please contact us using the details set out below in the ‘Contact Us’ section. If you exercise any of these rights, we may ask for proof of identity and sufficient information about your interactions with us so that we can locate your personal information. If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge except in exceptional circumstances.
If you wish to raise a complaint in relation to our processing of your personal data, you can contact our Pensions Director as set out below in the Contact Us section. If you are not satisfied with our response or believe that we are not processing your personal data in accordance with the law you have the right to lodge a complaint with the data protection regulator, the Information Commissioner’s Office. You can contact the Information Commissioner’s Office at:
https://ico.org.uk/global/contact-us/ or you can call their helpline on 0303 123 1113.
If you would like to find out more about your rights, you can visit the Information Commissioner’s Office website (https://ico.org.uk/for-the-public/).
How you can access and update your information
We strive to maintain accurate, complete, and relevant personal information for the purposes identified in this Privacy Information Notice.
If any of the personal information we hold about you is inaccurate or out of date, you may ask us to correct it. It is important that the personal information we hold about you is accurate and current.
Security precautions in place to protect against the loss, misuse or alteration of your information
We have implemented reasonable measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure. Details of these measures can be obtained on request.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
Our security measures are regularly reviewed.
Contact Us
If you have any questions regarding this Privacy Information Notice or about our privacy practices, if you wish to exercise any of your rights or wish to make a complaint, please contact us as follows:
Pensions Director
ScottishPower Pension Scheme
320 St Vincent Street
Glasgow
G2 5AD
Or by email at: pensions@scottishpower.com