ESPS Privacy notice

Use of your data (Privacy Notice)

This notice is issued by UU (ESPS) Pensions Trustee Limited (the “Trustee”) as Trustee of the United Utilities PLC Group of the ESPS (the “Scheme”).

We are issuing this notice to comply with the data protection laws. This notice sets out:

• Why we hold personal data
• What data we hold about you
• What we will do with the data
• Who we will share your data with
• How long we will hold it
• How we keep it safe
• What your rights are in respect of the data we hold
• Who to contact about your personal data

You do not need to take any action - the notice is for your information. You may want to keep it with your pension details.

Why we hold your data

You are a member of the Scheme or you are in receipt of benefits as a dependant of a Scheme member which means we are obliged to hold data about you. Even when all your benefits have been paid out, we are obliged to hold data about you, your benefits and how they were settled. This can also assist us in resolving queries you may have in the future. Most of the data held and processed by the Trustee in running the Scheme will be personal data (in other words, it is information from which you as an individual can be identified).

For legal purposes, the Trustee is known as the ‘data controller’ as we decide the purpose and means by which the personal data held is processed. The Trustee’s actuarial advisers, currently Aon, are also data controllers in relation to some of your personal data that the Trustee holds. There is a short note from them at the end of this notice, explaining a bit more about their role as data controller.

What data do we hold about you

Depending on the circumstances and the stage of your membership, we may hold some or all of the following information about you.

Data about who you are:

• Name
• Date of Birth
• Address and contact details
• Gender
• Marital status
• National Insurance number
• Spouse’s name and date of birth

Details when benefits are paid out:

• Birth/adoption certificate details
• Marriage certificate details
• Change of name details
• Death certificate details
• Passport/driving license details (for proof of identity)
• Health details (only obtained for the purpose of providing ill health benefits)

We hold this data so that we can identify you and ensure we pay the benefits to the right person.

Details about your pension entitlement from the Scheme that may consist of:

• Salary information
• Investment records
• Pension amounts
• Information relating to divorce cases
• Other information necessary to provide your pension
• If we are paying or have paid you, we may also hold the bank account details related to those payments
• We may hold information that you have given us about your family or dependants and who you would like us to pay in the event of your death
• In order to properly administer the Scheme and to calculate and pay benefits, from time to time we may also need to hold other information about you

What we will do with your data

The Trustee needs to hold and process information about you because it is needed for the administration of the Scheme and to calculate and pay benefits. In legal terms, this means that the Trustee has a legitimate interest in holding and processing the above information. The Trustee also keeps the above information to allow it to comply with its obligations towards members under the Scheme’s governing documents, as well as under relevant legislation. The Trustee will not collect any personal data from you that it does not need.

Personal data relating to the Scheme is held on paper and on computer systems. We may use automated means to calculate the amount of the benefit due to ensure accuracy and consistency of calculations. As the “data controller”, the Trustee must process this information fairly and lawfully.

As part of running the Scheme, the Trustee may also need to hold and process particularly sensitive information about you and/or your dependants and beneficiaries (known as “sensitive personal data”). Under the legislation, details relating to health, racial or ethnic origin, religious or other similar beliefs, sexual orientation and political affiliations are regarded as “sensitive personal data”. Except where the legislation allows it, this information cannot be processed or passed to a third party without your explicit consent.

Who will we share your data with

The Trustee is not allowed to share personal data about you with other organisations and people, unless the law allows us to do so or you have given your consent. As the Trustee needs to share information with others in order to provide you with benefits, there is a legitimate interest in the Trustee sharing this information. The Trustee may also need to share it in order to meet contractual and other legal obligations.

The Trustee shares personal data with the following:

• The United Utilities Pensions Team
• Your current, past or future employer (for example in relation to some exercises which relate to the operation of the Scheme – more details below)
• The Trustee’s professional advisers, including the Scheme actuary, auditor, investment adviser, medical adviser and lawyers
• Scheme administrators and if applicable, insurers
• HMRC and other statutory bodies, such as the Pensions Ombudsman and the Pensions Regulator
• Tracing and identity verification agencies
• Printing services for member communications, including benefit statements
• Various banking systems to facilitate electronic pension payments, including payments to pensioners overseas

If data is provided to, or processed or stored in a country outside the EEA, that transfer will comply with the requirements of data protection legislation. In particular, appropriate safeguards will be put in place to ensure that your data is kept secure. You can find out more about these safeguards by contacting the Scheme administrators, Railpen, using the contact details at the end of this notice.

The identity of the above providers may change from time to time. Data will only be shared as required in respect of the service provided to us.

When would personal data be shared with the employer in relation to exercises relating to the operation of the Scheme?

The Scheme’s employer has a legitimate interest in contacting you about your benefits under the Scheme, and any additional options which may be available to you in relation to those benefits. In such circumstances, we (the Trustee) may share your personal information with the employers so that they can contact you for that purpose. Below we have set out more detail to ensure we are being as transparent as possible, with our responsibilities under data protection laws in mind.

We (the Trustee) are responsible under data protection laws for all your records relevant to the Scheme, including your personal data in those records. The employers cannot run these types of exercises unless we share with them some necessary and relevant personal data about you at the appropriate time. We would only do that sharing where it is permitted by data protection laws. This means we would assess whether the sharing with your employer is justified by what is called ‘legitimate interests’. We would assess whether your own interests, rights and freedoms under data protection laws are such that they outweigh the legitimate interest of the employer in wanting to carry out these types of exercises, noting that the employer would in turn share some limited and necessary personal data about you with the employer’s advisers and independent financial advisers for that same reason of legitimate interests.

If the employer does run these types of exercises it would have to write to you by letter to explain about the particular exercise at the appropriate time.

When would personal data be shared with insurers?

We (the Trustee) have a legitimate interest in properly administering the Scheme. For this reason we will from time to time share your personal data with insurers. We will share some limited personal data when we are looking at purchasing and pricing up insurance contracts called ‘annuities’ (unless that can happen based on anonymized data). We will share additional personal data when we actually purchase that type of insurance contract from the chosen insurer.

We would assess whether your own interests, rights and freedoms under data protection laws are such that they outweigh our own legitimate interest in purchasing these types of insurance contracts to properly administer the Scheme. This would have to be assessed each time we look at purchasing these types of insurance contracts.

We would notify members to explain about the particular annuity policy and who the insurer is at the appropriate time if we do purchase these types of policies.

How long we will hold your data and how we will keep it safe

We may be required to answer questions about your pension for many years as questions can arise at any time even after your death. Therefore, we will keep your data for as long as the Scheme exists. However, we review the personal data we hold on a regular basis. If we conclude that certain personal data is no longer needed, that personal data will generally be destroyed.

We have taken reasonable steps to ensure that your data is kept safe. This includes checking that appropriate physical and technological security processes are in place to protect your data. We have ensured that all service providers have such security in place. We have also ensured that the process for sharing data is sufficiently secure so that the data is protected in transit.

What are your rights

Data protection legislation means that you have the opportunity to enforce your rights on the data we hold:

 You have the right to see personal data that is held about you and a right to have a copy provided to you, or someone else on your behalf, in a machine readable (namely, digital) format.

• If at any point you believe that the personal data we hold about you is inaccurate or wrong, you can ask to have it corrected.
• You can require the Trustee to restrict or limit the processing of your personal data in certain circumstances, for example, whilst a complaint about its accuracy is being resolved.
• You can object to your personal data being processed, although the Trustee can override this objection in specific instances.
• Where you have given the Trustee your consent to processing your personal data, you can withdraw that consent at any time by notifying the Scheme administrators, Railpen (see “Who to contact” overleaf).
• You can request that your personal data is deleted altogether, although the Trustee can override this request in certain circumstances.

You should be aware that taking any of the above steps could impact on the payment of your benefits and/or your participation in the Scheme and/or the Trustee’s ability to answer questions relating to your benefits.

Information in respect of data requests will generally be provided to you free of charge, although the Trustee can charge a reasonable fee in certain circumstances.

Who to contact

The Trustee has delegated day to day record keeping to Railpen. They hold and process your data on behalf of the Trustee. If you wish to see your personal data, exercise any of the rights mentioned above or make a complaint about how we have handled your personal data, please contact Railpen:

Email: enquiries@Railpen.com
Tel: 02476 472583

or

Railpen
Unit 2
Rye Hill Office Park
Birmingham Road
Coventry
CV5 9AB

The Trustee can be contacted in writing at:

UU (ESPS) Pensions Trustee Limited
Clearwater 4
Lingley Mere Business Park
Great Sankey
Warrington
WA5 3LP

To ask for a copy of your data, please contact:

Personal Data Enquiries
Railpen
Unit 2
Rye Hill Office Park
Birmingham Road
Coventry
CV5 9AB

Please quote UU PLC Group of ESPS, your National Insurance Number and Date of Birth.

If you are not satisfied with the response to any query you raise with Railpen, or you believe the Trustee is processing your personal data in a way which is inconsistent with the law, you can complain to the Information Commissioner’s Office:

Email: casework@ICO.org.uk
Tel: 0303 123 1113

or in writing at:

Information Commissioner’s Office Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

Updates to this notice

This notice is the latest version as at July 2020. This notice will be updated from time to time and you can access the most up to date version on the UU pensions website at www.unitedutilities.com/pensions

Aon Hewitt Limited “QUICK READ” PRIVACY NOTICE

Aon Hewitt Limited (and, where appointed, the Scheme Actuary - together "Aon") has been appointed to provide pensions advisory and calculation services that relate to your membership of the pension scheme. In doing so Aon will use personal information about you, such as your name and contact details, information about your pension contributions, age of retirement, and in some limited circumstances information about your health (where this impacts your retirement age) in order to be able to provide these services. The purposes for which we use personal information will include management of the pension scheme and your membership within it, funding the pension scheme (i.e. helping to ensure that the funds within the pension scheme are sufficient to cover the members who are party to it), liability management (that is to say providing advice on the different ways benefits could be determined, and drawn, from the pension scheme), scheme actuary duties (which include assessing individuals who are members of the pension scheme and assessing how the make-up of the membership may affect the amounts payable and when they become payable so as to manage the pension scheme appropriately), regulatory compliance, process and service improvement and benchmarking.

We may pass your personal information to third parties such as financial advisors and benefits providers, insurers, our affiliates and service providers and to certain regulatory bodies where legally required to do so. Depending on the circumstances, this may involve a transfer of data outside the UK and the European Economic Area to countries that have less robust data protection laws. Any such transfer will be made with appropriate safeguards in place.

More detail about Aon’s use of your personal information is set out in our full Privacy Notice. We recommend that you review this notice which is available online at www.aon.com/unitedkingdom/products-and-services/human-capital-consulting/aon-hewitt-actuarial-services-privacy-statement.jsp, or you can request a copy by contacting contact us, including reference to the scheme name, at: Data Protection Officer, Aon Hewitt Limited (Retirement and Investment UK), PO Box 730, Redhill, RH1 9FH

PricewaterhouseCoopers LLP - PRIVACY NOTICE

PricewaterhouseCoopers (PwC) will process your data as an independent Data Controller. PwC’s privacy statement can be accessed here www.pwc.co.uk/who-we-are/privacy-statement.html