As Trustee of the Scheme, we (Kingfisher Pension Trustee Limited) are committed to protecting your privacy and other rights under the data protection legislation, including the new EU General Data Protection Regulation (GDPR) which comes into force on 25 May 2018.
We are “data controllers” for the purpose the legislation.
This statement explains how we may collect, use and share your personal data.
Information we may collect from you
We may collect and process personal data which you provide to us in connection with the Scheme. This may include your contact details; information as to your date of birth, gender, and marital status; information as to your contributions to and options exercised under the Scheme; information as to your family members and dependants; and (where benefits are payable to you) your bank details.
In addition, we may in some circumstances hold and process personal data about you which is deemed “sensitive” for the purpose of the legislation – such as information about your health or sexual orientation. For example, we may hold and process information about your health if you apply for incapacity benefits.
Information which we may collect from others
We may collect and process personal data about you from the Kingfisher group or third parties. This may include information relating to your employment, salary and benefit rights, to the extent relevant for the purpose of the Scheme. We may on occasions collect personal data relating to you from third parties such as HM Revenue & Customs and other regulatory authorities.
Processing your personal data
We will process your personal data and the personal data of other people (such as your dependants) provided by you, for the purpose of the governance and administration of the Scheme, including in particular the calculation, funding, securing and payment of benefits.
We will normally rely upon the “legitimate interests” ground as the legal basis for processing your personal data. This means that we will process personal data for the purpose of legitimate interests which we as Trustee (or a third party to whom we disclose the data in accordance with this statement) are pursuing – namely the governance and administration of the Scheme. The legislation permits this, provided that our legitimate interests are not overridden by the interests or fundamental rights and freedom of Scheme members.
If we are required to process sensitive personal data (see above), we will approach you or the relevant individuals for specific consent to the processing.
Retention of personal data
We will hold personal data of for as long as may be necessary in order to administer benefits and to maintain a record of steps which we have taken. This means that we may retain personal data for very long periods, including after entitlement to receive benefits has ceased. [You can obtain a copy of our policy as regards data retention by writing us at the address below].
We will keep our retention policy under review having regard to matters such as the period over which questions or claims as to benefits could realistically emerge.
Disclosure of personal data
In connection with the administration of the Scheme, we may engage or transact with pensions administrators, actuaries, accountants, lawyers, investment advisers, insurers (e.g. with a view to securing Scheme benefits via insurance), investment providers and other similar external advisers, service providers and actual or proposed counterparties. We may disclose your personal data to these third parties in connection with the services which the third parties provide to us or otherwise for the purpose of the relevant transaction. We will ensure that personal data is processed in accordance with our instructions and in circumstances which require the recipient to observe industry standard security measures in respect of the personal data.
We may in any case disclose your personal data to a third party where necessary in order to comply with a legal obligation. We will not disclose personal data to third parties for the purposes of marketing.
International transfers of personal data
As required by data protection legislation, we have strict security procedures regarding the storage and disclosure of personal data. The personal data that we collect about you may be transferred to, and stored at, or processed in one or more countries outside the European Economic Area (EEA) which have not yet been deemed by the European Commission to offer adequate data protection. The personal data may also be processed by staff operating outside the EEA who work for us or for our third parties. In such cases, we will take appropriate steps to ensure an adequate level of data protection in the country of the recipient as required under the GDPR. We will supply details of any such steps on request. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside the EEA if you have consented to the transfer.
Automated decision-making
We do not envisage that any decisions will be taken about you using automated means.
Your rights under the GDPR
You have rights under the GDPR including:
- the right to access your personal data;
- the right to have your personal data rectified if it is inaccurate or incomplete;
- the right to have your personal data deleted or removed if there is no reason for its continued storage and processing;
- the right to object to your personal data being processed and to restrict the processing of your personal data in certain circumstances;
- the right to request the transfer of your personal data to another party; and
- where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent.
If you wish to exercise any of these rights, please contact us as explained below.
Our right to make changes We reserve the right to make changes to this statement and to our data protection policies and procedures. Where we do, the changes will extend to personal data obtained by us prior to the date of the change, unless we decide otherwise. If we change the statement, the revised version will be posted here.
Please visit the website regularly and review the statement, so that you understand the purposes for which we process your personal data.
Complaints
Where you are dissatisfied with any aspect of our handling of your personal data you have a right to lodge a complaint with the Information Commissioner’s Office:
Address: Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Tel: 0303 123 1113 or 01625 545 745
Email: casework@ico.org.uk
Further information
If you have any questions about the matters covered by this statement or if you would like to update your details or ask for a copy of your personal information, please contact Kingfisher Pension Trustee Limited by one of the following means:
3 Sheldon Square, Paddington, London, W2 6PX
pensions@kingfisher.com
0303 334 7080
