Trustees of the First UK Bus Pension Scheme

Fair Processing Notice

Your privacy is important to us. We will process your personal data in accordance with applicable data protection law.

The data controller in respect of the personal data you submit to us either directly or via your employer, FirstGroup, is the Trustee of the First UK Bus Pension Scheme (the “Scheme”) who you can contact via the Scheme administrator Mercer at [email protected]. We use your personal data that is provided to us to administer and manage your pension and pay you or any person in respect of you the benefits provided by the Scheme. When we do so we are regulated under the UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018. We are responsible as ‘controllers’ of that personal information for the purposes of those laws. We process the personal data that you provide to us ( this includes personal details such as your name, date of birth, gender, contact details (ie address, home and mobile phone numbers, email address) and national insurance number, employment details such as your employment history (including any breaks in service or where service has been transferred in), pensionable service records, salary information, contribution records; details about your family and personal circumstances, such as your marital status, details of your spouse/civil partner, dependants, other family members and death benefit nominated beneficiaries, financial details such as your bank account and tax information for the purpose of administering and managing your pension and paying you and/or your spouse and dependants benefits. We may also hold ‘special categories’ of personal data (ie sensitive information which comes with additional safeguards under data protection legislation). This may include information about your health, including any medical conditions. We therefore process your personal data on the legal basis that the processing is necessary for the performance of the contract of employment between you and FirstGroup regarding your participation in the Scheme, to comply with our legal obligations and further to our legitimate interests as Trustee of the Scheme. If you do not provide us with the personal data that we specify is required for administration of the Scheme then we may not be able to administer the benefits provided by it.

The ways you can provide data to us are the following:
when you complete a Scheme related form;

  • by collecting data from your employer;
  • by collecting data from another pension arrangement (if you have transferred benefits into the Scheme);
  • by collecting data from an existing member of the Scheme (if they choose to nominate you for the death benefits that may be due on their death);
  • by collecting data from persons acting on your behalf;
  • by collecting data from service providers who help us trace members with whom we have lost contact.

We will transfer your data to FirstGroup, other participating employers in its group and their advisers, the Scheme's advisers, service providers and partner organisations to the extent that it is necessary for the management and administration of the benefits provided by the Scheme. We may also disclose your information to third parties in order to operate, administer and audit the Scheme responsibly, in the event that FirstGroup sells its business or assets (in which case we may disclose your personal data to the prospective buyer), in the event that we decide to de-risk or insure any of the benefits provided by the Scheme (in which case we may disclose your personal data to the prospective insurer) or where we are under a duty to disclose your personal data in order to comply with any legal obligation or to protect the rights, property, or safety of the Trustee, the members of the Scheme, or others. We may also disclose your data to a third party (e.g.) an independent financial adviser where you are taking advice to allow you to pursue an option in terms of taking your benefits under their Scheme. We do not use your data for marketing or transfer personal data to other organisations for the purpose of marketing their goods or services.

Your personal data may be processed outside of the European Economic Area ("EEA") where required in order for us or FirstGroup to provide benefits to or in respect of you. In each instance, we have ensured that the processing of your personal data outside the EEA is governed by the Standard Contractual Clauses approved by the European Commission.

We will keep your personal data stored on our systems for as long as it takes us to provide the pension and other benefits provided under the rules of the Scheme. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes and enforce our rights. This could mean that your personal data could be kept even after you have ceased to be entitled to Scheme benefits until an appropriate time after the Scheme has been wound-up. We review our data retention policies regularly and will retain your personal data only as long as necessary for the purpose for which we process that data.

Data Protection legislation gives you the right to access information held about you. The Trustee may request a fee only where appropriate in accordance with European Data Protection Legislation (for example, if the requests are manifestly unfounded or excessive, in particular because of their repetitive character) to meet our costs in providing you with details of the information we hold about you. Where we or third parties are processing your personal data on the basis that you have consented to that processing then you are entitled to withdraw your consent. If you do withdraw your consent, we may still be able to process some of the data that you have provided to us on other grounds. However, some data, for example data in relation to your health or personal life, is regarded as ‘special categories of data’. We have to process that special category data to perform our obligations under employment law and the law relating to social protection. Therefore, we do not require your specific consent to process that information. You will be entitled to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another data controller. You can exercise your data protection rights, including your rights to access, restrict, object to the processing of, rectify and erase your personal data by contacting Mercer at [email protected]. If you are unhappy with the way in which your personal data is being processed you have a right to lodge a complaint with the Information Commissioner’s Office. You can report your concerns by telephoning their helpline on 0303 123 1113 or through their website at

Where third parties (such as the Scheme’s advisers) are required to process your personal data in order to assist the Trustee or Company in administering the Scheme, those third parties may themselves act as data controllers in respect of the way in which they process your personal data and produce their own fair processing notices (also referred to as ‘privacy notices’). Various third parties have asked the Trustee to provide you with access to their fair processing notices which explain how they process personal data and meet their compliance obligations under privacy laws. The Trustee will publish any such notices, or links to websites containing those notices, on the Scheme’s Trustee portal.