Privacy notice for members (their dependants and nominated beneficiaries), employers participating in the Pensions Trust or Pensions Trust 2016 and advisers
Last updated June 2026.
1. Introduction
This privacy notice applies to members and beneficiaries of the Pensions Trust or Pensions Trust 2016 (“the Pension Trusts”), and to individual professional contacts at participating employers and advisory firms.
It explains what personal information Verity Trustees Limited (the “Trustee”) (as trustee of the Pension Trusts) (together “we”, “our” or “us”) collects about you, how we use that personal information, how we store it and with whom we share it.
We are the data controller for the Pensions Trust.
If your pension is administered by TPT Retirement Solutions Limited but the controller is not Verity Trustees Limited, the privacy notice of the relevant trustee for your (or your employees') specific scheme will apply. These notices are available via the Trustee pages on our website, portals, or apps.
The Trustee and the Scheme Actuary, Michael Kelly of Mercer Limited, act as Joint Data Controllers. The Actuary uses your personal data to advise on the financial management of the Trusts, ensuring we meet our legal obligations to pay member benefits. Other professional advisers, such as auditors or legal counsel, may also act as independent data controllers when providing specialised services.
We share your information with the administrator, TPT Retirement Solutions Limited, along with professional advisers and regulatory bodies (such as HMRC, the DWP, and the Pensions Regulator). We ensure all third parties have appropriate security measures in place to protect your data in accordance with data protection law.
If you provide data about others, such as nominated beneficiaries or employees, please ensure you have their permission and direct them to this notice. We also share necessary information with third parties who provide specific member services. Further details are provided in Section 3.
2. Personal Information we collect
2.1. Sources of Personal Information
We collect personal information directly from you and from various third parties as outlined below.
We may also obtain personal information from other third parties, including the following:
- Directly from You: Information provided via applications, forms, correspondence, and your use of our Online Services (websites, portals, and apps), including device and interaction data.
- Employers and Trustees: Current or past employers (including affiliates with shared administration) and trustees of pension schemes from which you have transferred.
- Connected Individuals: Information provided by members about their beneficiaries (e.g., a spouse or dependent nominated for death benefits).
- Professional Advisers: Financial advisers, legal counsel, accountants, healthcare providers, and attorneys acting under a Power of Attorney.
- Specialist Service Providers: Third-party administrators, actuaries, auditors, and firms providing data tracing, identity verification, and fraud prevention services.
- Financial and Fraud Prevention Agencies: Banks, product providers, and agencies or databases used for fraud detection, financial crime prevention, and sanctions checking.
- Government and Regulatory Bodies: Including HMRC, DWP, the Pensions Regulator, FCA, ICO, law enforcement, and the courts.
- Publicly Available Sources: Public registers (e.g., Companies House), the Office for National Statistics, internet searches, social media, and data available under the Open Government Licence.
- Corporate Transactions: Third parties involved in any business acquisition, scheme merger, or transfer of engagement.
2.2. Types of personal information collected
The personal information we hold and process includes:
- Identity & Contact: Name, date of birth, gender, marital status, and contact details (address, email, phone).
- Government Identifiers: National Insurance number, passport, or driving licence.
- Financial & Pension Benefits: Salary, bank details, tax status, contribution levels, and benefit values (including pension sharing orders or transfer details or details of your other pensions savings).
- Employment & Membership: Employment history, job titles, and unique member/employer identifiers.
- Beneficiary & Dependant Data: Information regarding next of kin, spouses, or children named as beneficiaries. Where you provide details of beneficiaries or dependants, you are responsible for informing them their data will be held by the Trust, or we will contact them directly where required.
- Technical & Digital: IP addresses, device identifiers, and website/portal usage data collected via cookies.
- Communications: Recordings of calls, chat transcripts, and records of any complaints or feedback.
- Compliance & Investigations: Information from fraud databases, sanctions lists, and publicly available sources (e.g., news or social media).
Sensitive Personal Information (Special Category Data): We apply extra protections to particularly sensitive data, processed only where legally permitted:
- Health Data: Details of physical/mental conditions or medical history (e.g., for ill-health retirement).
- Criminal Data: Information relating to criminal convictions or offences to prevent financial crime and fraud.
- Other Sensitive Data: In limited cases, information revealing sexual orientation (e.g., via marriage certificates), racial/ethnic origin, or religious beliefs.
2.3. Uses of personal information
The main purposes for which we use your personal information are:
- Scheme Administration: To manage your pension savings, calculate and pay benefits, handle transfers, and perform member tracing if we lose contact with you.
- Communication & Member Support: To handle queries and complaints, manage your data rights, and identify members requiring additional support. This includes tracing other pension arrangements or obtaining valuations via independent providers like Money Labs Limited ("Pension Lab"), who will process your information as an independent controller.
- Business Operations & Analysis: To manage our business, improve our services, carry out internal audits, financial accounting, and data analysis for risk modelling, technology upgrades, and system security.
- Legal, Regulatory & Public Interest: To comply with professional obligations, cooperate with regulators (e.g., FCA, ICO, Pensions Regulator), establish or defend legal claims, and perform mandatory checks for anti-money laundering (AML), fraud prevention, and sanctions screening.
- Scheme Updates & Member Insights: To provide updates on products and services related to your pension and conduct member segmentation to improve scheme engagement.
- Corporate Transactions: To facilitate any sale, transfer, or merger of the Pension Trusts or business assets.
2.4. Lawful bases for uses of personal information
We only use your personal information when the law allows us to. For the Pension Trusts, we primarily rely on the following legal justifications:
- Compliance with a Legal Obligation: To meet our statutory responsibilities to regulators (e.g., FCA, TPR), government bodies, and tax officials (HMRC). This includes mandatory checks for anti-money laundering (AML), fraud prevention, and sanctions screening, as well as our legal duty to provide data to the UK Pensions Dashboards ecosystem.
- Performance of a Contract: To provide services and administer your pension in accordance with the Scheme's governing documents and terms.
- Legitimate Interests: To operate and improve our services, manage commercial risks, and keep you informed. We ensure our interests (or those of a third party) are balanced against your rights. These interests include tracing pension savings, scheme governance, system security, internal management reporting, and facilitating any corporate transactions or restructuring of the Trust.
Processing Sensitive (Special Category) Data: When processing sensitive information (such as health or sexual orientation), we rely on additional legal bases:
- Substantial Public Interest: For the administration of occupational pensions (including determining eligibility for ill-health benefits) and safeguarding the economic well-being of individuals with additional support needs.
- Legal Claims: Where necessary to establish, exercise, or defend legal rights or proceedings.
- Manifestly Made Public by the Data Subject: Where you have clearly and deliberately made the information public yourself.
- Criminal Conviction or Offence Data: For criminal conviction or offence data, we rely on substantial public interest under Schedule 1 of the Data Protection Act 2018 (e.g., fraud prevention and financial crime).
3. Who personal information is shared with
In connection with the purposes set out in Section 2.3, we may share your personal information with:
- Scheme Service Providers: Third parties who help us administer the Schemes, including administrators, IT and hosting providers, payroll providers (to pay benefits), printing and communication services, and archiving specialists.
- Professional Advisers: Actuaries, auditors, accountants, legal advisers, and professional service firms who provide governance, evaluation, and compliance support to the Trustee.
- Your Employer: Your current or past employers (and their affiliates) for audit purposes, corporate transactions, or to help manage scheme participation and pension options.
- Financial Institutions & Insurers: Banks, insurers, and reinsurers who provide longevity hedging or insurance services to the Scheme, as well as financial advisers or intermediaries you have appointed.
- Pensions Dashboards & Tracing Services: Third-party pension providers and ecosystem operators necessary for the UK Pensions Dashboards and Money Labs Limited ("Pension Lab"), who acts as an independent controller for any tracing services provided to you or pension valuations.
- Verification & Data Quality Partners: Agencies that help us maintain accurate data (e.g., tracing members or identifying deceased individuals), mortality analysts, and research agencies for customer feedback.
- Legal & Regulatory Bodies: Regulators (e.g., FCA, TPR, ICO), government agencies, HMRC, the police, courts, and industry bodies to comply with our legal duties or to protect legal rights.
- Financial Crime Prevention: Fraud detection agencies, sanctions-checking providers, and third parties who maintain databases to prevent and investigate financial crime.
- Corporate Transactions: Third parties involved in any sale, transfer, merger, or disposal of any part of our business or the Pension Trusts.
- Your Request: Any third party you explicitly ask us to share information with, such as a new pension provider if you choose to transfer your benefits.
4. Transfers of your information abroad
We, or third parties acting on our behalf, may sometimes need to transfer your personal information outside of the UK. When we do, we ensure that your privacy rights remain protected through at least one of the following safeguards:
- Adequacy Regulations: We transfer data to countries that have been officially deemed by the UK Government to provide an adequate level of protection for personal data.
- Standard Contractual Safeguards: When transferring data to countries without an adequacy regulation, we use specific contracts approved for use in the UK, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses.
- Supplementary Measures: Where required, we conduct transfer risk assessments to ensure the recipient country’s legal system does not undermine the protections afforded by our contracts.
Further details regarding these transfers and the specific safeguards implemented are available upon request using the contact details provided in Section 7.
5. Retention of your information
We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with our legal and regulatory duties.
Given that pension benefits are long-term commitments, we typically retain member records for the duration of your membership and for a significant period thereafter. This extended retention is required to:
- Benefit Accuracy: Ensure we can calculate and pay benefits to you or your beneficiaries correctly, even many years after you have stopped contributing.
- Scheme Governance: Conduct actuarial valuations and manage the long-term funding and liabilities of the Scheme.
- Legal & Regulatory Protection: Respond to future legal claims, Ombudsman complaints, or regulatory inquiries that may arise long after a payment has been made.
We maintain a formal Personal Data Retention Policy with clear schedules for data deletion. Once information is no longer required for these purposes, it is securely destroyed or anonymised.
6. Your rights
You have rights under data protection laws in relation to your personal information. Your rights include:
- Access – Request a copy of your personal data and details of its processing
- Rectification – Request correction of inaccurate or incomplete data
- Objection – Object to processing based on legitimate interests (we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, such as legal obligations to maintain pension records)
- Restriction of processing – Ask us to limit processing in certain circumstances (for example, while we verify accuracy of disputed data)
- Erasure – Request deletion of your data where applicable (for example, after our retention period expires). Note: This right does not apply where we are required by law to retain pension records for statutory purposes
- Portability – Receive certain data in a structured, commonly used format where relevant
How to exercise your rights:
The Trustee (as data controller) may request proof of identity to verify any request. We aim to respond within one month of receiving a valid request. It may take us longer if the request is particularly complicated or you have made several requests. We’ll always let you know if we think a response will take longer than one month. We may also ask you to provide more detail about what you want to receive or are concerned about.
TPT manages the administration system as our processor. To exercise your rights, please see our Contact details in Section 8 below.
You may also contact TPT’s member services, who will coordinate with Trustee to respond to your request. The one-month response timeline begins when your request reaches the Trustee as controller.
Important: We cannot always comply with every request. For example:
- We cannot erase data we are legally required to retain for pension administration
- We cannot restrict processing necessary to pay your benefits
- Legal obligations may require us to continue processing despite an objection
We will always explain our decision and your options if we cannot fully comply with your request.
For further information on each of those rights, including the circumstances in which they apply, see the Information Commissioner Office guidance at - https://ico.org.uk/for-the-public/
7. Contact details
If you would like to exercise any of those rights, please email, call or write using the contact details listed below providing details of your complaint:
Email: privacy@tpt.co.uk
Call: 0113 234 5500
Post: TPT Retirement Solutions, Aire Park, 5th Floor, 3 South Brook Street, Leeds, LS10 1FT
Let us know the information to which your request relates, including any account or reference numbers, if you have them.
8. Complaints
We hope that we can resolve any query or concern you raise about our use of your information. If you consider that data protection legislation has been infringed because of how your personal data has been processed you have a right under the Data Protection Act 2018 to complain to the Trustee as Data Controller. You may raise a complaint with the Trustee using the contact details noted above. Details of your Trustee's formal dispute resolution procedure can be provided to you. You will receive an acknowledgement within 30 days and the data controller will take appropriate steps to respond to the complaint and inform you of the outcome without undue delay.
You also have the right to complain to the Information Commissioner.
The Information Commissioner may be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
We would appreciate the opportunity to resolve any concerns with you directly before you approach the ICO.
8. Changes to this privacy notice
This notice is non-contractual and does not form part of any contract of employment or pension scheme membership. The Trustee reserves the right to update this notice at any time to reflect changes in our processing activities, legal obligations, or the identity of our data controllers.
We will:
- Publish any updated version on our website
- Notify you of material changes via your registered contact details where appropriate
- Update the date at the top of this notice to reflect the last revision.