Who we are

As the Trustee Directors of the Nestlé UK Pension Trust Ltd (the Trustees), we hold certain personal information (known as personal data) about both current and future members of the Nestlé UK Pension Fund (the Fund), and – where applicable – their dependants and beneficiaries.

Most of the personal data held and processed by the Trustees in the running of the Fund is personal data, which means it’s information that could identify you as an individual. The Trustees also act as the data controller of the Fund’s personal data.

The Fund Actuary, Lane Clark & Peacock (LCP) also needs access to the personal data we hold about you to help us look after the Fund. You can read LCP’s privacy policy at www.lcp.com/en/third-party-privacy-notice.

Information we hold about you

Depending on the circumstances, we may hold some or all of the following information about you:

• your name and date of birth
• your home address and other contact details
• your gender
• your National Insurance number
• your marital status and marital history
• details of your employment history with Nestlé or the Nestlé Group Company
• details of your salary during your employment with Nestlé, or the Nestlé Group Company, and other forms of remuneration
• your bank account details
• details about your dependants and/or beneficiaries,
• details about your health, including medical information, and
• membership details of pension arrangements you hold outside the Nestlé Group.

How we use it

The Trustees hold and process information about you because we need it to administer the Fund, calculate and pay benefits and to fulfil our responsibilities relating to funding, investment and other aspects of running the Fund. In legal terms, this means we have a legitimate interest in holding and processing the kind of information listed above. We also keep information like this to allow us to meet our obligations towards members under the Fund’s governing documents, as well as under relevant legislation.

While we generally collect your personal data from you or your employer, it can also come from other parties like HM Revenue & Customs, the Pensions Ombudsman, or someone acting on your behalf, like a financial adviser.

If you’re receiving a dependant’s benefit from the Fund, or a benefit resulting from a divorce from or the dissolution of a civil partnership with a member of the Fund, we may have been given your personal data by that member or through enquiries we’ve carried out on a member’s death. We won’t collect any personal data from you that we don’t need.

Personal data relating to the Fund is held both on paper and digitally. As a data controller, the Trustees must process this information fairly and lawfully.

As part of running the Fund, we may also need to hold and process sensitive information about you and/or your dependants and beneficiaries known as sensitive personal data. By law, details relating to health, racial or ethnic origin, religious or other similar beliefs, sexual orientation and political affiliations are regarded as sensitive personal data. Except where the legislation allows it, we can’t process this information or pass it on to a third party unless you explicitly tell us we can.

Who we share it with

We’re not allowed to share personal data about you with other organisations and people unless the law allows us to, or you’ve told us we can. Because we, the Trustees, need to share information with others to provide you with benefits, we have a legitimate interest in sharing it. We may also need to share it to meet contractual and other legal obligations.

We share personal data about members of the Fund with:

• your current, past, or future employer, which may include Nestlé group companies based outside the European Economic Area (EEA). Where we share data outside the EEA, we put in place appropriate safeguards to ensure your data is kept secure,
• the Fund’s professional advisers, including the Fund Actuary, auditors, medical advisers, investment advisers and lawyers,
• other third parties responsible for the day-to-day administration of the Fund on behalf of the Trustees, including annuity broking services, retirement guidance services, and modelling tools,
• HM Revenue & Customs and other statutory bodies like the Pensions Ombudsman and The Pensions Regulator – the Trustees can be fined and subject to other action if we don’t provide certain information to these authorities,
• the advisers and printers who help us prepare the communications we send to you, like your annual benefit statement,
• our appointed insurance company or companies for the purposes of life insurance and additional voluntary contributions,
• providers who help us pay members’ pensions, this includes our payroll provider and those who help us pay pensions to pensioners based overseas, such as BACS (Bankers' Automated Clearing Service) transfer or CHAPS (Clearing House Automated Payment System), and
• other service providers, including those who help us understand demographic information about members of the Fund, like mortality tracing agencies.

How long we keep it for

We must keep all personal data safe and only hold it for as long as necessary. To meet the requirements of both UK tax and pensions law, we must keep certain personal data for a minimum of six years. This includes details about the date a member joins the Fund, their name and address, and details of any benefits paid.

Given the nature of pension schemes, though, the Trustees may need to keep some of your personal data for the rest of your life because we’ll need it to pay your benefits and to answer any queries about them.

We review the personal data we hold about you regularly in accordance with our data retention policy. If we conclude that we no longer need certain personal data about you, we’ll do what’s reasonable and proportionate to seek to ensure the Fund administrator (Nestlé Pensions) securely destroys or permanently deletes that personal data. If that isn’t possible, they’ll put it beyond use in line with guidance from the Information Commissioner’s Office.

The Fund's Independent Trustee Director, PAN Trustees UK LLP (PAN), may continue to hold personal data collected through its role as a Trustee Director even when it is no longer a Trustee Director of the Fund. You can find out more about PAN’s approach to data security at pantrustees.co.uk/Scheme-GDPR/.

Your rights

• You have the right to see personal data we hold about you and to have a copy provided to you, or someone else on your behalf, in a machine readable (digital) format.
• If you believe the personal data we hold about you is inaccurate or wrong, you can ask us to correct it.
• In certain situations, you can ask the Trustees to restrict or limit the processing of your personal data, for example while we’re resolving a complaint about its accuracy.
• You can object to your personal data being processed, although the Trustees can override this in specific instances.
• If you’ve given us your consent to process your personal data, you can withdraw it at any time by notifying us – see Who to contact. Withdrawing your consent won’t affect the processing of any personal data that has already taken place and it may be possible for the Trustees to continue processing your personal data where this is justified.
• You can ask us to delete your personal data altogether, although the Trustees can override this request in certain circumstances.

Taking any of the above steps could have an impact on the payment of your benefits and/or your participation in the Fund.

While we’ll generally try and provide you with information about your personal data at no cost to you, the Trustees can charge a reasonable fee in certain circumstances.

Who to contact about your personal data

To

• see your personal data or exercise any of the rights mentioned above
• ask for a hard copy of this notice
• make a complaint about how we’ve handled your personal data,

… please write to or email Nestlé Pensions at:

Complaining to the Information Commissioner’s Office

If you’re not happy with how we’ve responded to any query you raise with us about your personal data, or if you believe we’re not processing it within the law, you can make a complaint to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.