Scheme Privacy Notice
This notice explains how the Crystal Trust and the Trustee of Crystal use and protect the personal information that they hold about members and other beneficiaries of Crystal. The Trustee is an independent Corporate Trustee made up of Trustee Directors which change from time to time, but you can find out the names of the current Trustee Directors by using the contact details at the end of this notice.
The Trustee is a "controller"; for the purposes of the data protection laws. The current data protection laws are set out in the General Data Protection Regulation (GDPR) which came into effect from 25 May 2018, together with all other applicable legislation relating to privacy and data in force. We refer to the GDPR as the "Data Protection Laws"; in this Privacy Notice.
You should share this notice with your family and dependants where you have provided us with personal information about them.
What is the legal basis for the Trustee using your personal data?
The Trustee must provide benefits in line with the Scheme's governing documents and meet legal requirements in looking after Crystal.
The Trustee will use data to comply with these legal obligations.
The Trustee has a legitimate interest in looking after Crystal, to ensure benefits are paid when due, ensuring correct contributions are paid, benefits calculated correctly and communicating with Members.
What is personal information?
Personal information broadly means information that identifies (or which could, with other information that we hold or are likely to hold, identify) a living individual.
This includes any information provided to us by or on behalf of you, Crystal's Employers or HM Revenue & Customs in relation to your membership of Crystal.
What types of personal information might we hold about you?
We collect and process the information about you that you provide by filling in forms and by corresponding with us and our service providers by telephone, email or otherwise. We also collect and process information about you that is provided to us by the Crystal's Employers, by HM Revenue & Customs (HMRC) and in response to a survey request.
We may hold and process any or all of the following personal information about you:
- personal details such as your name, gender, age, date of birth, contact details (e.g. your address and postcode, email, telephone and mobile numbers), and identifiers such as your National Insurance number, pension or member reference number and employee number (where applicable);
- details of your family, lifestyle and social circumstances. This could include details about your current marriage or civil partnership, any previous relationships and details of your family and dependants (this data is only requested from you and held at the time it is required e.g. completion of Expression of Wish);
- employment details such as your earnings, length of service, employment and career history;
- other financial details such as any other income, other pension arrangements, bank account details and your tax code (this data is only requested from you and held at the time it is required e.g. to process pension payments);;
- information about your physical or mental health (where there is a legal basis for the processing of such data under the Data Protection Laws - see below); and
- information about criminal convictions if these relate to money owed to Crystal's Employers in circumstances where they are entitled to be reimbursed from your benefits.
Why do we hold this information?
We hold this information because we need it to administer Crystal. Without your personal information, we cannot provide you and your dependants with the correct benefits, at the right time. For example, we may need this information to verify your membership of Crystal, to calculate your pension or to assess whether you are entitled to a specific benefit or how the tax rules apply to you.
We may use unique identifier information, such as your National Insurance number, passport number, pension or member reference number and employee number (where applicable) for the purposes of sending communications to you and verifying your identity.
In some instances, we may need to hold and process information relating to your physical or mental health, for example if you are applying for a pension on grounds of ill-health. We will ask for your explicit consent to this, unless there is an alternative legal basis for processing this information under the Data Protection Laws. Once you have given your consent, you can withdraw it at any time by writing to us using the contact details below.
Using your information in accordance with Data Protection Laws
Data Protection Laws require us to meet certain conditions before we are allowed to use your personal information in the way described in this Privacy Notice.
We rely on a condition that allows us to use your personal information to comply with our legal obligations in relation to Crystal. We also rely on a condition known as 'legitimate interests' in order to use this information in the way described in this Privacy Notice. We have legitimate interests in collecting and processing your personal information as we need this to administer Crystal and to provide benefits for you and your dependants.
We will keep the amount of personal information collected and the extent of any processing to a minimum.
We will only process 'sensitive' or 'special categories' of personal information under the Data Protection Laws (e.g. information about your health) where you have explicitly consented to this or where there is an alternative legal basis for processing this information under the Data Protection Laws. This may mean that you will be asked to sign consent forms in the future. If you don't consent to our processing this information when asked to do so, it may mean that we are unable to pay benefits to you or your dependants. Once you have given your consent, you can withdraw it at any time by writing to us using the contact details below.
We will only process information about criminal convictions if these relate to money owed to Crystal's Employers in circumstances where they are entitled to be reimbursed from your benefits and either you consent to this or the processing is necessary for the exercise of a legal claim.
What do we do with the information?
We may use your personal information for a number of purposes relating to the administration of Crystal, including the following:
- to calculate and pay benefits, including any online functionality that may be used. This includes providing you with details of your benefits and options under Crystal and dealing with any queries that you have about these;
- to carry out our obligations arising from any agreement that we have with, or concerning, you and to provide you with the information, benefits and services that you request from us;
- to notify you about services provided to members of Crystal and any changes to those services or to enable you to access those services;
- for statistical, financial modelling, accounting and reference purposes;
- for internal record keeping;
- for risk management purposes, including the insurance or management of risks or of Crystal's benefits;
- complying with our legal obligations, any relevant industry or professional rules and regulations or any applicable voluntary codes;
- complying with demands or requests made by any relevant regulators, government departments and law enforcement or tax authorities or in connection with any disputes or litigation; or
- in connection with any sale, merger, acquisition, disposal, reorganisation or similar change of Crystal's business.
In addition the Trustee may use information to:
To ensure the website is efficient and compatible with users software and settings;
To analyse and improve the services provided;
To allow use of different resources and materials on the website;
To personalise the way in which the website is presented; and
To give you access to products and services that you have requested.
How long do we keep your information for?
We will hold your personal information on our systems for as long as is necessary for Crystal to provide benefits to you or your dependants.
So, for example, if your pension is paid from Crystal when you retire, we will hold your information for the rest of your life, until your pension ceases on your death. If a pension is payable to any of your dependants after your death, we will then continue to hold your information until their pensions cease. We will then continue to hold your information for an indefinite period after all benefits payable to you and your dependants have ceased, in case there are any further queries about your membership of Crystal.
If you cease to be a member of Crystal (e.g. because you transfer your benefits to another pension arrangement), we will hold your information whilst you are a member and then for an indefinite period after you cease to be a member, in case any further queries arise about your membership of Crystal.
Who do we share the information with?
Where appropriate for the purposes of administering Crystal, we may share your information with:
- Crystal's administrator, which is currently Evolve Pensions Limited. The administrator uses this information to administer Crystal, including to calculate and pay benefits;
- Crystal's professional advisers and auditors. This includes:
- Crystal's actuary (which is currently First Actuarial), the firm that provides actuarial, consultancy and investment advice to the Trustee.
- Crystal's investment consultant (which is currently Dean Wetton Advisory Limited (DWA)), the company that provides investment advice to the Trustee.
- Crystal's legal advisers (which are currently Pinsent Masons), and
- Crystal's auditors (which are currently RSM LLP
- Crystal's accountants (which are currently Burgess Hodgson).
These organisations use the information when advising the Trustee and carrying out their respective professional obligations.
- Crystal's insurers and annuity providers (and other insurers or brokers for the purpose of obtaining quotations relating to Crystal or its benefits), investment managers, banks and other service providers;
- any financial adviser or other organisation appointed by the Trustee or Crystal to advise you about your options under Crystal, or any adviser appointed by you where you have asked us to provide them with details of your benefits under Crystal;
- any other person who is authorised to act on your behalf;
- third parties providing services to Crystal where it is legitimately required by the Trustee in support of administrating the scheme. This will include payroll processing, administration systems and identity verification;
- UK Pensions Dashboards Programme, a service used by individuals to access information about their pensions in a single portal (data processing activities will be carried out by other parties including MaPS);
- regulators, government departments, law enforcement authorities, tax authorities and insurance companies; and
- any relevant ombudsman, dispute resolution body or the courts.
The entities listed above may also share personal data with their own business suppliers, for example in relation to the operation of IT systems or where they outsource part of their services. Where it is in our legitimate interest, Crystal may also share data with a third party to process your information on our behalf (under instruction). Some of these entities may also be controllers under the Data Protection Laws. However, in the first instance you should contact the Trustee using the contact details below if you have any queries about how they use your personal information.Please note that some of Crystal's former service providers may continue to hold information about you for their own record keeping purposes once they have ceased to be involved with Crystal.
Where we store your personal data
The data that we collect from you will be stored inside the UK. However, if you live or work outside of the UK or the EEA, we may need to transfer your personal data outside of the UK or the EEA to respond to any queries that you may have. Where this applies, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice.
Data may also be transferred outside the UK or the EEA where Crystal's service providers host data outside the UK or the EEA. These transfers will be governed by the Data Protection Laws.
Your rights in relation to your personal information
The accuracy of the information that we hold about you is important to us. If any of the information that we hold is inaccurate or out of date, please let us know using the contact details set out at the end of this notice.
You have a number of rights under the Data Protection Laws in relation to the way we process your personal data, namely:
- to be informed;
- to access your data;
- to have your data rectified if it is inaccurate or incomplete;
- in certain circumstances, to have your data deleted or removed;
- in certain circumstances, to restrict the processing of your data; and
- to claim compensation for damages caused by a breach of the Data Protection Laws.
If you wish to exercise any of these rights, please let us know using the contact details set out at the end of this notice.
We will aim to respond to any request received from you within one month from your request.
Access to your data will usually be provided free of charge, although in certain circumstances we may make a small charge where entitled to do so under the Data Protection Laws.
Please note that we may be unable to delete or remove your data whilst we still need this to administer Crystal - see the section 'How long do we keep information for?' above.
Crystal uses procedures and security to safeguard against risks presented in processing personal data. All employees and third parties are required to treat data provided to us confidentially and in line applicable data protection and other legislation.
If you are not happy with the way in which your personal information is held or processed, please contact us using the details below. You also have the right to complain about data protection matters to the Information Commissioner's Office (ICO).
The ICO is the UK's independent body set up to uphold information rights. You can find out more about the ICO on its website (www.ico.org.uk).
The ICO can be contacted by calling 0303 123 1113.
Changes to this Privacy Notice
This Privacy Notice is current as at 27 January 2023.
We keep our Privacy Notice under regular review, and may change it at any time. We will tell you about any significant changes.
If you have any questions about Crystal, queries about this privacy notice, or wish to exercise any of the rights above, please contact:
Evolve Pensions Limited
PO Box 128
To contact the Data Protection Contact, please contact:
Data Protection Contact
Evolve Pensions Limited
PO Box 128
Dated 27 January 2023