Privacy notice

Privacy notice

This privacy notice explains how Railpen Limited collects and processes your information.

Data controllership

Who are we

We are the Railways Pension Trustee Company Limited, RAILPEN Limited, Railway Pension Investments Limited (each with its registered address at 7 Devonshire Square, London EC2M 4YH) and each is registered with the Information Commissioner’s Office (ICO) as a separate "data controller" in respect of personal information handled for the Railways Pension Scheme. We are also a data processor for personal information handled on behalf of our clients in pension schemes such as Zurich, United Utilities and Schneider.

This privacy notice is intended to give you a clear picture of how we handle and protect your personal information. It describes what we collect about you, why, how it is handled, with whom we share it, and where and how long we handle it before it is securely destroyed.

Scope

Whose personal information we handle

We handle and protect personal information relating to:

• Users of our websites

• Members of the public

Justification for data handling

Why we use personal information

For data protection purposes we justify the handling of any personal information we receive based on:

• our legitimate interests - handling your personal information for ours or a third party’s legitimate business interests provided e.g. to improve our products and services and how we present them on our websites and other material. they do not override your rights or freedoms

• your consent – users visiting our website can give and withdraw their consent to the use of all non-essential cookies at any time via our website or their Internet Browser.

• substantial public interests – such as but not limited to, to establish, exercise or defend our legal rights or for the purpose of legal proceedings

• our legal obligations - we may have to handle your personal information to comply with legislation or regulatory instruction from time to time.

Cookies deployed on our websites

In order to handle your personal information for the above reasons we may collect and use the following types of personal information about you or those visiting our websites or otherwise engaging with us:

Data sources

Where we get your personal information from

We obtain information from users of our website from you by you providing it or us or third parties we work with analysing how you arrived at our website or how you behave whilst on our website.

Data sharing

With whom we share your personal information

From time to time, we may need to share your information with other parties. Where this is necessary, we are required to comply with all relevant data protection legislation. The types of third parties we may need to share some of your information with include:

IT suppliers: Companies that provide services to us, such as IT and communication providers, including providers of cloud services and cyber security services

Professional advisory services: Third parties in order to verify your identity as well as to prevent and detect fraud

Other third parties: If we sell any part of our business or our assets, in which case we may need to disclose your personal information to the prospective buyer for due diligence purposes or continued use of your personal information.

Law enforcement, judicial and local authorities: If we are under a duty to disclose or share your personal information in order to comply with any legal obligations, or any lawful request from any legal or regulatory authority; and/or to respond to any claims, and to establish, exercise or defend our legal rights.

Most third parties with whom we share your personal information are limited (by law and by contract) in their ability to use your personal information for the specific purposes identified by us.

Sharing your personal information overseas

Our core systems, data, and administration services are all carried out and stored within the UK.

Where it is necessary to transfer your personal information outside the UK, we will ensure that the correct safeguard is used so that your personal information is protected to an equivalent extent, as it would be if it remained in the UK. This is usually by transferring to a country that is approved as having essentially equivalent data protections under the UK Adequacy Regulations or by carrying out a Transfer Risk Assessment, and where appropriate, the receiving party putting in place an International Data Transfer Agreement designed by the ICO.

Data security and access

How do we keep your personal information secure

We are committed to protecting your personal information from loss, misuse, disclosure, alteration, unauthorised access, and destruction. We take all reasonable precautions to safeguard the confidentiality, integrity, and availability of personal information.

Although we make every effort to protect your personal information, the transmission of information over the Internet is not completely secure. As such, you acknowledge that we cannot guarantee the security of personal information transmitted to us over the internet and that any such transmission is at your own risk.

Once we have received your personal information, we will use strict procedures and security features to prevent unauthorised access (and take steps to ensure that any third parties with whom we share your personal information do the same).

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Data retention

How long we keep your personal information

We will only retain your personal information for as long as necessary. Necessity will be based on our legal obligations, regulatory guidance, and industry good practice. We have documented how long we keep records containing personal information and why in polices and standards on retention and destruction.

In some circumstances, we may anonymise your personal information instead of destroying it so that it can no longer be associated with you but where the anonymised data can be used to add value to our products and services.

Our standard policy is for information to be kept for only as long as necessary for the purposes set out above. It is then disposed of in a managed and secure way.

Rights and obligations

Your rights

You have several rights under data protection law. These include the right to:

• receive a copy of the personal information we hold about you

• request personal information to be amended if it is inaccurate or incomplete

• request the deletion or removal of personal information where there is no compelling reason for its continued use

• block or restrict the processing of your personal information

• object to the handling of your personal information

There is also a right under GDPR (General Data Protection Regulation) to receive your personal information (in a structured, commonly used, and machine-readable format) and to transfer it to another service provider or data controller. This right applies where your personal information is being handled on the basis of your consent or in line with a contract to which you are party. Please note that, for the majority of pension scheme members, this is not applicable as we rely on our legitimate business interest to protect and handle your personal information rather than individual consent or contracts.

You also have the right to appeal against any profiling or automated decision-making. Please note that, as defined by data protection law, Railpen does not create profiles nor make any automated decision making, i.e.have processes where you interact only with a computer that then makes a decision about you AND you can’t even ask a human to review to review the computer’s decision.

In order to exercise any of the above rights please contact our DPO (Data Protection Officer) as per the email or postal address below.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to provide our services to you or we may be prevented from complying with our legal obligations (such as to prevent fraud).

Your rights to lodge a complaint with the Regulator

At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113. Of course, we hope that we can resolve your issue quickly and fairly ourselves.

Data protection team

Our data protection team oversees compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact our data protection team at: dataprotectionteam@railpen.com or you can write to us at: Railpen, 7 Devonshire Square, London EC2M 4YH.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.