Who we are

As the Trustee Directors of the Nestlé UK Pension Trust Ltd. (the “Trustee”), we hold certain personal information (known as “personal data”) about Nestlé UK Pension Fund (the “Fund”) members (both current and former), and, where applicable, their dependants and beneficiaries. Most of the personal data held and processed by the Trustee in running the Fund will be personal data (in other words, it is information from which you as an individual can be identified). The Trustee is the “data controller” of the Fund’s personal data.

Because he also needs access to the personal data that we hold on you in order to look after the scheme, The Scheme Actuary, Mr JD Jones of Lane Clark and Peacock LLP, is also a “data controller”. You can read more about this at www.lcp.com/en/third-party-privacy-notice.

What information we collect about you

Depending on the circumstances and the stage of your membership, we may hold some or all of the following information about you:

• your name and date of birth;
• your home address and other contact details;
• your gender;
• your National Insurance number;
• your marital status and marital history;
• details of your employment history with Nestlé; or Nestlé Group Company;
• details of your salary during your employment with Nestlé (or Nestlé Group Company); and other forms of remuneration;
• details of your bank account;
• details about your dependants and/or beneficiaries;
• medical and other details about your health;
• your membership details of pension arrangements outside of the Nestlé Group.

How we use that information

The Trustee needs to hold and process information about you because it is needed for us to administer the Fund, calculate and pay benefits and to fulfil our responsibilities relating to funding, investment and other aspects of running the Fund. In legal terms, this means that we have a legitimate interest in holding and processing the above information. We also keep the above information in order to allow us to comply with our obligations towards members under the Fund governing documents, as well as under relevant legislation. We will generally collect your personal data from you or from your employer. However, we may also receive personal data from other parties such as HM Revenue & Customs, the Pensions Ombudsman or someone acting on your behalf, such as an independent financial adviser. If you are receiving a dependant’s benefit from the Scheme, or a benefit resulting from divorce or the dissolution of a civil partnership, we may have been given your personal data by the member or through enquiries we’ve carried out on a member’s death. We will not collect any personal data from you that we do not need.

Personal data relating to the Fund is held on paper and on computer systems. As the “data controller”, the Trustee must process this information fairly and lawfully.

As part of running the Fund, we may also need to hold and process particularly sensitive information about you and/or your dependants and beneficiaries (known as “sensitive personal data”). Under the legislation, details relating to health, racial or ethnic origin, religious or other similar beliefs, sexual orientation and political affiliations are regarded as “sensitive personal data”. Except where the legislation allows it, this information cannot be processed or passed to a third party without your explicit consent.

Who we share it with

We are not allowed to share personal data about you with other organisations and people unless the law allows us to do so, or you have given your consent. As we need to share information with others in order to provide you with benefits, there is a legitimate interest in the Trustee sharing this information. We may also need to share it in order to meet contractual and other legal obligations.

We share personal data with the following:

• your current, past, or future employer which may include Nestlé group companies which are based outside the European Economic Area (EEA). Where data is sent outside the EEA, appropriate safeguards are put in place to ensure that your data is kept secure;
• the Fund’s professional advisers, including the Fund actuary, auditor, medical advisers, investment advisers and lawyers;
• other third parties who are responsible for day-to-day administration of the Fund on behalf of the Trustee (this includes provision of annuity broking services, retirement guidance services, and modelling tools);
• HM Revenue & Customs and other statutory bodies (such as the Pensions Ombudsman and the Pensions Regulator) – the Trustee can be fined and subject to other action if they fail to provide certain information to these authorities;
• the advisers and printers who help us prepare various communications we send to you, such as the annual benefit statement;
• our appointed insurance company or companies for the purposes of life insurance and additional voluntary contributions;
• providers who facilitate the payment of pensions, including our payroll provider and those who assist us when we pay pensions to pensioners who are based overseas, such as BACS transfer (the Bankers' Automated Clearing Service) or CHAPS (the Clearing House Automated Payment System); and
• other service providers, including those who support work relating to understanding demographic information relating to the Fund such as mortality tracing agencies.

How long we keep personal data for

We must keep all personal data safe and only hold it for as long as necessary. To meet the requirements of both UK tax and pensions law, we must keep certain personal data (for example, details about the date a member joins the Fund, their name and address, and details of benefits paid) for a minimum of 6 years.

But, given the nature of pension schemes, the Trustee may be required to keep some of your personal information for the rest of your life so that we have the information we need in order to pay your benefits and to answer queries relating to your benefits.

We review the personal data held in relation to the Fund on a periodic basis in accordance with our data retention policy. If we conclude that certain personal data is no longer needed, we will do what’s reasonable and proportionate to seek to ensure the Fund administrator (Nestlé Pensions) securely destroys or permanently deletes that personal data or (if that’s not possible) puts it beyond use in line with guidance from the Information Commissioner’s Office.

Please note, the Fund's Independent Trustee Director (PAN Trustees UK LLP (“PAN”)) may continue to hold personal data collected through its role as a Trustee Director even when it is no longer a Trustee Director of the Fund. Information about PAN’s approach in this situation to data security as a firm can be found at https://www.pantrustees.co.uk/Scheme-GDPR/.

Your rights

• You have the right to see personal data that is held about you and a right to have a copy provided to you, or someone else on your behalf, in a machine readable (namely, digital) format.
• If at any point you believe that the personal data we hold about you is inaccurate or wrong, you can ask to have it corrected.
• You can require the Trustee to restrict or limit the processing of your personal data in certain circumstances, for example, whilst a complaint about its accuracy is being resolved.
• You can object to your personal data being processed, although the Trustee can override this objection in specific instances.
• Where you have given us your consent to processing your personal data, you can withdraw that consent at any time by notifying us (see “Who to contact” below). However, withdrawing your consent will not affect the processing of any personal data which took place beforehand and it may be possible for the Trustee to continue processing your personal data where this is justified.
• You can request that your personal data is deleted altogether although the Trustee can override this request in certain circumstances.

You should be aware that taking any of the above steps could impact on the payment of your benefits and/or your participation in the Fund.

Information will generally be provided to you free of charge, although the Trustees can charge a reasonable fee in certain circumstances.

Who to contact about your personal data

If you wish to:

• see your personal data or to exercise any of the rights mentioned above;
• request a hard copy of the notice; or
• make a complaint about how we have handled your personal data,

please contact Nestlé Pensions in writing at:

Making a complaint to the Information Commissioner’s Office

If you are not satisfied with our response to any query you raise with us, or you believe we are processing your personal data in a way which is inconsistent with the law, you can complain to the Information Commissioner’s Office whose helpline number is: 0303 123 1113.