Privacy notice

Citrus Pension Plan

Privacy Notice

As you may by now be aware, the General Data Protection Regulation came into force on 25 May 2018. This new data protection law requires a "data controller" to provide a notice which includes the detailed information set out in this Privacy Notice. Citrus Pension Plan Trustee Limited (the "Trustee", "we", "us" or "our") is the data controller for the Trustee of the Citrus Pension Plan (the "Scheme"). This means that we must comply with requirements in relation to what personal information is held, how personal information is used, and the protection of personal information in relation to the Scheme.

This Privacy Notice sets out personal information that is held about members and other beneficiaries of the Scheme is obtained, stored, used and protected. You should share this notice with your family and, where you have provided us with personal information about anyone else, for example in an expression of wish form, with those people.

It also explains how we use your personal information if you are a professional or business contact, client or prospective client.

This Privacy Notice explains:
1. who the "data controller" is and how to make contact;
2. what information we hold and where we collect it from;
3. what we use personal information for;
4. how long we maintain personal information;
5. who we may share personal information with;
6. your rights in relation to personal information that we hold about you;
7. what happens if you fail to provide personal information; and
8. how we keep personal information safe.

1. Who is the data controller and what are the contact details?

The Trustee is the "data controller" in respect of personal information held in relation to the Scheme.

The Trustee is a company registered in England & Wales with company number 10255689.

The Scheme actuaries, Hymans Robertson LLP, and the scheme actuary, currently Graham Jones of Hymans Robertson LLP, are joint data controllers with the Trustee in relation to personal information when providing certain actuarial services. The scheme actuary may change. If you wish to know who the current scheme actuary is, please refer to the most recent scheme accounts, or contact the Trustee.

Club Vita LLP, who provide longevity (life expectancy) analytics and related information to help us calculate the Scheme's liabilities, will also be a data controller in relation to personal information.

Your point of contact for any of the controllers is the Scheme Administrators who can be contacted using the email address [email protected] or in writing to Citrus Pension Plan Admin Team, Hymans Robertson, 20 Waterloo Street, Glasgow, G2 6DB.

2. What information do we hold and where do we collect it from?
The Trustee only holds personal information which it requires in order to administer the Scheme. Information that we may hold includes:

1. personal details such as your name, contact details (your postal address, email address, mobile and telephone numbers), gender, date of birth, and identifiers such as your National Insurance number, pension or member reference number and your employee number (where applicable);
2. family, lifestyle and social circumstances such as details about your marriage or partnership, and dependants;
3. employment details such as your pensionable pay and length of service;
4. other financial details such as tax code and bank account details; and
5. details relating to your benefit calculations such as your membership category.
6. The personal information that we hold is collected from you and your employer and sometimes from third parties such as tracing agencies or public sources, for example if we no longer have an up to date address for you. Some of the data we hold is produced by the administrator from the information collected. For example, we calculate "Final Pensionable Salary" from the salary information provided by your employer.

If you are a professional or business contact, client or prospective client, we’ll collect your contact details, information about your work or personal circumstances and your interests, where you disclose them to anyone who works for us in a professional or business setting, for example at networking events. We’ll also collect information from social media that is available publicly or if you connect with anyone who works for us.

3. What are our grounds for processing your personal information and what is it used for?

The Trustee needs to use your personal information to administer the Scheme in order to comply with its legal obligations as trustee of the Scheme. For example we may use personal information:

1. to calculate benefits, provide estimates and pay benefits;
2. to respond to any queries raised by beneficiaries of the Scheme;
3. to trace your most recent address in order to communicate with you about your benefits;
4. to calculate the funding requirements for the Scheme;
5. for internal record keeping;
6. to comply with any present or future law, rule, regulation, guidance or directive; and
7. to comply with demands or requests made by regulators, governments and law enforcement authorities.

Occasionally, we may process your personal information for 'legitimate interests'.
Certain third parties may have legitimate interests which require the processing of your personal information (e.g. your employer may need information in order to comply with regulatory requirements).

In order to rely on this legal ground, we will:
• consider the impact the processing has on your interests and rights; and
• implement appropriate safeguards to ensure that your privacy is protected as far as possible.

In certain circumstances the Trustee may also process more sensitive personal information about you, for example medical information if you wish to take your benefits under the Scheme early due to ill health. It is necessary for the Trustee to hold and process these special categories of personal information to comply with its legal obligations. Where required by law, your consent will be sought before such information is processed.

The Trustee does not make any automated decisions or profiling using your personal data.

If you are a professional or business contact, client or prospective client, we’ll use your business contact details to send you direct marketing communications which you have subscribed to or which we feel may be relevant and of interest you as well as information about events, thought leadership and topical updates. You can unsubscribe from our communications at any time. To do so, simply:

• click the “unsubscribe” link in the communication that you’ve received from us, or
• get in touch with us via our website or the contact details above.

We may also contact you by post or phone, unless you ask us not to

4. How long will we retain your personal information?

Your data will be retained for so long as it may be necessary for the Trustee to comply with its legal obligations in relation to the Scheme. Processing of your data will only take place where strictly necessary, particularly once you have transferred out of the Scheme or all your benefits have been paid in full.

5. Who is your personal information shared with?

Your data is held by the Scheme's administrators, Hymans Robertson LLP. When providing administration services to the Scheme, Hymans Robertson LLP acts as a data processor and processes member data on behalf of the Trustee.

Additionally, in order to operate the Scheme and administer your benefits, the Trustee may need to disclose your data to other people, such as the Trustee's service providers and professional advisers, auditors, regulators, Government, law enforcement and tax authorities, tracing agents, and insurance companies, to arrange particular entitlements, for instance an annuity policy where relevant.

The Trustee does not share your information with any third party based outside the European Economic Area ("EEA") (or the United Kingdom after it leaves the EEA). Some third party providers may transfer personal data outside the EEA in connection with the provision of services. Where this is the case, the Trustee will take appropriate steps to ensure that all third party providers are transferring personal information in accordance with data protection legislation.

We will take appropriate legal, organisational and technical measures to protect personal information in accordance with applicable data protection laws and undertake to instruct all third party providers to do the same.

6. Your rights regarding personal information we hold about you

You have the right:
1. to request information about the processing of your personal information, including the right to be provided with a copy of the personal information that we hold about you;
2. to request the correction of your personal information;
3. to request the deletion of your personal information;
4. to object to the processing of your personal information; and
5. where relevant, to withdraw your consent to the processing of sensitive information where we have advised you that we are relying on your consent to process that information

There may be circumstances where the Trustee is not able to accede to a request, for example, if it would mean the Trustee was unable to meet its legal obligations.
It is important to inform the Trustee of any changes in your personal details to ensure the information held is accurate and kept up to date. If you need to do this, or wish to know more about the information held by the Trustee or the purposes for which it is held, please contact Citrus using the contact details set out above.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is the UK's independent body set up to uphold information rights. You can find out more about the ICO on its website.

The ICO can be contacted on 0303 123 1113, or by writing to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Or visit the section of the ICO’s website for more information.

This privacy notice is current as at 27 March 2023. We may make changes from time to time and you should regularly check for updates.