DIGI 03124 – Bupa Pension Schemes – Privacy Notice
Bupa Pension Schemes:
Privacy Notice
This notice applies to members and beneficiaries of the following schemes (the “Schemes”):
- The Bupa Pension Scheme
- The Bupa Home Healthcare Limited Pension Scheme
- The Cromwell Hospital Retirement Benefits Plan
The Trustees of the Schemes (“we”, “our” or “us”) are committed to protecting your privacy when dealing with
your personal information. This privacy notice provides details about the information we collect about you, how we
use it and how we protect it. It also provides information about your rights.
If you have any questions about how we handle your information, please contact us at dataprotection@bupa.com.
Notice last updated: June 2021
1. Information about us
2. What this privacy notice covers
3. How we collect personal information
4. Types of personal information
5. What we use your personal information for
6. Legal grounds
7. Legitimate interest
8. Sharing your information
9. How long we keep your personal information
10. Your rights
11. Data protection contacts
12. Trustee contacts
1. Information about us
In this privacy notice, ‘we’, ‘us’ and ‘our’ mean The Trustees of the Schemes. For contact details, see Trustee
contacts below.
The Trustee of the Scheme you are a member or beneficiary of, as shown in your pension documentation, makes
decisions about how your information is handled as a Data Controller. This means that the Trustee decides how
and why your data is used. As Data Controllers, the Trustees collect and process your personal data for the
purposes of administering the Scheme in compliance with their legal obligations and for their other legitimate
interests relating to the operation of the Scheme, such as funding, benefit design and running the Scheme in a
cost-effective way.
In some circumstances, the Trustees are joint controllers with Scheme Actuaries, companies in the Bupa Group
(as employers), legal advisers, and Bupa Independent Medical Advisory Service (IMAS, as medical adviser).
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
This privacy notice contains information on what personal information about you the Scheme collects, who from,
what we do with this information, the lawful basis on which personal information is processed and what rights you
have.
2. What this privacy notice covers
This privacy notice applies to members and beneficiaries of the Schemes which are operated by Bupa Trustees.
If you are a member or beneficiary of a Scheme not managed by a Bupa Trustee (such as NEST or My Bupa
LifeSight Plan), you should read the Privacy Notice provided by the Trustee of that Scheme.
3. How we collect personal information
We collect personal information from you and the people and organisations listed below.
You must provide most of this personal information so that we can meet our obligations, you can enjoy the
benefits that we offer, and we can manage our relationship with you properly. If you do not provide this personal
information, these outcomes may not be possible. If you provide us with information about other people (for
example, your emergency contacts or beneficiaries), you must make sure that they know you are doing
this and do not object to you giving us their information. You should also make them aware of this
privacy notice.
We collect personal information from you if you provide this in the course of your membership of a Scheme, or
as a beneficiary of a Scheme, or through any other interaction with us generally, including by phone, by email,
through our websites, on our apps, by post, by filling in application or other forms, on social media or face-to-face.
We collect personal information from people and organisations such as:
• your agents (for example, a legal representative)
• your employer
• any service providers who work with us in relation to your membership
• your doctor, occupational health provider or other health care professionals to enable us to make
decisions about your rights to benefits where certain medical criteria need to be met (for example,
early retirement due to ill-health)
• our agents (for example, our legal representatives if we are involved in legal proceedings against
you), our advisers, insurers and reinsurers
• public authorities, regulators or government bodies, including when required by law or regulation,
under a code of practice or conduct, or when these authorities or bodies require us to do so; and
• the police and other law-enforcement agencies to help them perform their duties, or with others if
we have to do this by law or under a court order; and
• sources which are available to the public
4. Types of personal information
We process the following types of personal information about you and (where this applies) your dependants.
• Standard personal information (for example, information we use to contact you, identify you or
manage our relationship with you).
• Special categories of information (for example, health information in connection with ill-health
early retirement and ill-health reviews, and where incapacity or similar reasons determine the
benefits paid to you).
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
• Where applicable, we also collect information about your dependants or next of kin. Before
providing us with any such information, you should provide a copy of the information in this notice
to those individuals.
• While much of the data we hold has been provided by members themselves, in some cases, we
will collect personal information about you indirectly from the Bupa entity which is (or was) your
employer and from our service providers (e.g. the Scheme administrator). In certain
circumstances, we receive personal data from other schemes from which members have
transferred, HMRC, the DWP and regulatory bodies and by tracing organisations. We also
receive information from members about their proposed beneficiaries, who may be eligible to
receive benefits on the member's death.
Standard personal information includes:
• contact information (for example, your name, username, address, email address and phone
numbers).
• the country you live in, your age, your date of birth, next of kin, dependants and national
identifiers (for example, your National Insurance number or passport number).
• information relating to your benefits such as your member identifying number (which is assigned
to you by the Scheme), the date you joined or left the Scheme, your earnings and pensionable
earnings, the category and value of benefits that you have built up or receive, and relevant
matters impacting your benefits such as voluntary contributions, fund value, investment choices,
pension sharing orders, tax protections or other adjustments.
• financial details (for example, your National Insurance number, payment details and bank details);
• information provided in order to allow us to assess your entitlement, e.g. copies of passports and
certificates, as well as data received from Her Majesty's Revenue and Customs in order to allow
us to calculate your guaranteed minimum pension.
• some employment information, such as location, department and redundancy details.
Special category information includes:
• information concerning your health (e.g. in the case of ill-health early retirement and ill-health
reviews, and where incapacity or similar reasons determine the benefits paid to you). We will in
most circumstances process this data in the performance of our legal obligations in connection
with employment, social security and social protection (as allowed by legislation).
• information about your race, ethnic origin and religion (where this information may be included in
identity or employment documentation which we process about you).
5. What we use your personal information for:
We process your personal information to:
• manage your membership of your scheme and communicate with you in relation to your benefits
and contributions, handling requests for transfers and allocation of death benefits, dealing with
complaints, and making disclosures at your request such as in relation to transfers to other plans;
• administer the Schemes, such as: to record, calculate and pay benefits; for reviews we or our
administrators conduct for statistical and reference purposes; and for other administrative
activities that may become necessary from time to time (like member tracing) should we happen
to lose contact with you and to prevent fraud;
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
• investigate or prevent crime, to exercise our rights, to defend ourselves from claims and to keep
to laws and regulations that apply to us and the people and organisations we work with;
• improve our processes and our use of technology, including testing and upgrading of systems,
and to learn about other processes we can use to improve the administration of the Scheme; and
• undertake activities from time to time to help us manage the risks and liabilities of the Schemes,
such as longevity hedging, actuarial valuation, insuring Scheme liabilities with an insurer, scheme
mergers, bulk transfers, pension increase exchanges and enhanced transfer value exercises,
including (where relevant) disclosures to administrators for calculating offers made to you in
relation to these activities and disclosures to advice providers to allow you to obtain financial
advice.
• take part in, or be the subject of, any sale, merger or takeover of all or part of the Bupa business;
and
• consider and act upon whistleblowing reports we receive, as set out in our Speak Up Policies
(available by contacting us).
6. Legal grounds
By law, we must have a lawful reason for processing your personal information. These are set out below.
Standard personal information: We process standard personal information about you if:
• it is necessary to meet the obligations set out in a contract or to take steps before entering into a
contract – if we have a contract with you, we will process your personal information to fulfil that
contract.
• it is necessary to meet our legal or regulatory responsibilities, such as to carry out the terms of
the trust, in accordance with its governing documents, and to make disclosures to authorities,
regulators or government bodies.
• it is in our own or a third party’s legitimate interests (see below for more details).
• we have to or are allowed to do so by law.
Special category information: We process special category information about you if:
• in limited circumstances, we obtain your consent from time to time, such as when you ask us to
make disclosures or allocate benefits or where the Scheme rules require you to provide
information which requires consent. Where the processing is based on consent, it can be
withdrawn at any time (which will not affect the lawfulness of processing before such withdrawal).
Please note that if consent to process information is withdrawn, we will not be able to take the
relevant information into account.
• it is necessary for carrying out our obligations and exercising specific rights under employment,
social-security or social-protection law (for example, we process health and disability information
in connection with managing ill-health early retirement and ill-health reviews, and where
incapacity or similar reasons determine the benefits paid to you).
• it is necessary to meet our legal or regulatory obligations or to calculate or pay benefits to you or
your nominated beneficiaries, if we cannot collect this personal data we may be unable to
administer your contributions and benefits or record or calculate or pay your or your beneficiaries’
benefits.
• it is necessary in the vital interests of you or another person.
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
• you have obviously made that personal information public (for example, you publicly share
sensitive personal information on the intranet).
• it is necessary for establishing, exercising or defending legal claims.
• it is in the public interest, in line with local laws.
• it is necessary for the purposes of occupational medicine, including to assess whether you are
able to work.
7. Legitimate interest
Legitimate interest is one of the legal reasons why we may process your personal information. Taking into
account your interests, rights and freedoms, the types of legitimate interest which allow us to process your
personal information include:
• to provide our members and beneficiaries with support on a full range of pension related matters,
and to otherwise manage our relationship with you, our business and people and organisations
who provide services on our behalf and administer the Schemes.
• to protect our (or other people’s) rights, property or safety, including to protect the health, safety
and welfare of workers, and to maintain a safe working environment.
• to exercise our rights, to defend ourselves from claims and to keep to laws and regulations that
apply to us and the people and organisations we work with.
• to take part in, or be the subject of, any sale, merger or takeover of all or parts of the Bupa
business.
8. Sharing your information
We share your information, for the purposes set out in this privacy notice, with:
• our suppliers, including the Bupa Group and other providers of services to us and them
• advisers including the Scheme Actuary, Scheme Auditor, investment consultants, medical
advisers, payroll providers, banks, AVC providers, electoral providers for trustee elections, and
consultants.
• our insurers, insurance and reinsurance companies.
• our agents (for example, our legal representatives, translators, interpreters and tax advisers in
line with the law).
• suppliers who help deliver products or services on our behalf.
• people or organisations we have to, or are allowed to, share your personal information with by
law (for example, for fraud-prevention or safeguarding purposes, including with social-security
and tax offices).
• public authorities, regulators or government bodies, including when required by law or regulation,
under a code of practice or conduct, or when these authorities or bodies require us to do so.
• the police and other law-enforcement agencies to help them perform their duties, or with others if
we have to do this by law or under a court order.
• if this applies, potential buyers of all or part of our business.
• other persons from time to time when the disclosure is needed to exercise or protect legal rights,
including those of the Trustee or other stakeholders, or in response to requests from individuals
or their representatives who seek to protect their legal rights or such rights of others (e.g. the
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
Pensions Regulator, the Pensions Ombudsman, HMRC, the police, courts and our legal
advisers/representatives) and legal advisors (to provide us with legal advice).
• proposed beneficiaries, who may become eligible to a benefit on a member’s death.
If we share your personal information, we will make sure appropriate protection is in place in line with
data-protection laws.
Transferring information outside the UK and the European Economic Area (EEA)
The use and disclosure of your information for the purposes referred to in Privacy Notice may involve transferring
your information to countries outside the UK and the EEA (the EU member states plus Norway, Lichtenstein and
Iceland), for the purposes set out in this privacy notice.
In those cases, except where the relevant country has been determined by the relevant public authority to ensure
an adequate level of data protection, the Trustees will ensure that transferred information is appropriately
protected in line with data-protection laws. Often, this protection is set out under a contract with the organisation
who receives that information. For more information about this protection, please contact the relevant Scheme
Trustee.
9. How long we keep your personal information
In general, we will keep your information until after your membership of the Scheme ends. Once your
membership ends, we may decide to delete some or all of the data held in relation to you after 6 years. However,
information will be held for longer where we consider it appropriate in order to deal with any queries which may
arise, and ensure that everyone receives the correct pension and also that, in the event of a member’s death,
their dependants are paid the correct benefit. We will need to hold personal data for many years, probably until
long after your own death and any dependant’s pension ceases.
We use the following criteria to help us decide how long we need to keep your personal information for.
• Whether you are currently a member or beneficiary of the Schemes.
• How long it is reasonable to keep records to show we have met the obligations we have to you
and by law.
• Any periods for keeping information which are set by law or recommended by regulators,
professional bodies or associations.
• Any time limits for making a claim.
• Any tribunal, court or other relevant proceedings that apply.
At the end of the retention period decided, we will securely and permanently delete the personal information in
your file. If you would like more information about how long we will keep your information for, please contact the
relevant Scheme Trustee (see Trustee contacts below).
10. Your rights
Under UK and European data-protection laws, you have the following rights relating to the information we hold
about you in some computer and paper records.
• Right of access: You have the right to make a written request for details of the personal
information we hold about you and a copy of that personal information.
• Right to rectification: You have the right to have inaccurate information about you corrected.
• Right to erasure ('right to be forgotten'): You have the right to have certain personal
information about you deleted from our records.
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
• Right to restriction of processing: You have the right to ask us to use your personal
information for restricted purposes only.
• Right to object: You have the right to object to us using personal information.
• Right to data portability: You have the right to ask us to transfer personal information you have
given us to you or someone else in a format that can be read by computer.
• Right to withdraw consent: We do not normally rely on permission to allow us to process your
personal information. We will only ask for your permission in very limited circumstances and, if we
do so, we will make it obvious to you when we are asking for permission and what it is for. You
have the right to withdraw any permission you have given us to handle your personal information.
If you withdraw your permission, this will not affect the lawfulness of how we used your personal
information before you withdrew your permission.
These rights may not apply in all cases. If we are not able to meet your request, we will explain why. If you make
a request, we will ask you to confirm your identity if we need to, and to provide information that helps us to
understand your request better. If you would like more information about your rights, or to exercise any of your
rights, please contact the relevant Scheme Trustee (see Trustee contacts below).
11. Data-protection contacts
If you have any questions, comments, complaints or suggestions relating to this notice, or any other concerns
about the way in which we process information about you, please contact our Data Protection Officer and Privacy
You also have a right to make a complaint to your local privacy supervisory authority. Our main office is in the UK,
where the local supervisory authority is the Information Commissioner (www.ico.org.uk).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
United Kingdom
SK9 5AF
Phone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
You can also make a complaint with another supervisory authority which is based in the country or
territory where:
• you live;
• you work; or
• the matter you are complaining about took place.
12. Trustee contacts
The Bupa Pension Scheme
The Trustee of the Bupa Scheme
Bupa Pension Scheme Trustees Limited c/o Bupa Pensions
Bupa Place
102 The Quays
Salford Quays
M50 3SP
Tel: 0161 240 4357
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
The Cromwell Hospital Retirement Benefits Plan
Kim Mairs
XPS Pension Group
1
st
Floor
Flax House
83-91 Adelaide Street
Belfast
BT2 8FE
cromwell.admin@xpsgroup.com
The Bupa Home Healthcare Limited Pension Scheme
Valerie Cranston
XPS Pension Group
1
st
Floor
Flax House
83-91 Adelaide Street
Belfast
BT2 8FE
bhh.admin@xpsgroup.com
DIGI 03124 – Bupa Pension Schemes – Privacy Notice
24/02/2023
