Trustees of the First UK Bus Pension Scheme

Fair Processing Notice

Your privacy is important to us. We will process your personal data in accordance with applicable data protection law.

The data controller in respect of the personal data you submit to us either directly or via your employer, FirstGroup, is the Trustee of the First UK Bus Pension Scheme (the “Scheme”) who you can contact via the Scheme administrator Mercer at [email protected] . We use your personal data that is provided to us to administer and manage your pension and pay you or any person in respect of you the benefits provided by the Scheme.

 We process the personal data that you provide to us for the purpose of administering and managing your pension and paying you and/or your spouse and dependants benefits. We therefore process your personal data on the legal basis that the processing is necessary for the performance of the contract of employment between you and FirstGroup regarding your participation in the Scheme, to comply with our legal obligations and further to our legitimate interests as Trustee of the Scheme. If you do not provide us with the personal data that we specify is required for administration of the Scheme then we may not be able to administer the benefits provided by it.

We will transfer your data to FirstGroup, other participating employers in its group and their advisers, the Scheme's advisers, service providers and partner organisations to the extent that it is necessary for the management and administration of the benefits provided by the Scheme. We may also disclose your information to third parties in order to operate, administer and audit the Scheme responsibly, in the event that FirstGroup sells its business or assets (in which case we may disclose your personal data to the prospective buyer), in the event that we decide to de-risk or insure any of the benefits provided by the Scheme (in which case we may disclose your personal data to the prospective insurer) or where we are under a duty to disclose your personal data in order to comply with any legal obligation or to protect the rights, property, or safety of the Trustee, the members of the Scheme, or others. We do not use your data for marketing or transfer personal data to other organisations for the purpose of marketing their goods or services.

Your personal data may be processed outside of the European Economic Area ("EEA") where required in order for us or FirstGroup to provide benefits to or in respect of you. In each instance, we have ensured that the processing of your personal data outside the EEA is governed by the Standard Contractual Clauses approved by the European Commission.

We will keep your personal data stored on our systems for as long as it takes us to provide the pension and other benefits provided under the rules of the Scheme. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes and enforce our rights. We review our data retention policies regularly and will retain your personal data only as long as necessary for the purpose for which we process that data.

Data Protection legislation gives you the right to access information held about you. Up to 25 May 2018, any access request may be subject to a fee of £10. After that date, the Trustee may request a fee only where appropriate in accordance with European Data Protection Legislation (for example, if the requests are manifestly unfounded or excessive, in particular because of their repetitive character) to meet our costs in providing you with details of the information we hold about you. Where we or third parties are processing your personal data on the basis that you have consented to that processing then you are entitled to withdraw your consent. If you do withdraw your consent, we may still be able to process some of the data that you have provided to us on other grounds. However, some data, for example data in relation to your health or personal life, is regarded as ‘special categories of data’. We have to process that special category data to perform our obligations under employment law and the law relating to social protection. Therefore, we do not require your specific consent to process that information.

From 25 May 2018, you will be entitled to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another data controller. You can exercise your data protection rights, including your rights to access, restrict, object to the processing of, rectify and erase your personal data by contacting Mercer at [email protected]. If you are unhappy with the way in which your personal data is being processed you have a right to lodge a complaint with the Information Commissioner’s Office. You can report your concerns by telephoning their helpline on 0303 123 1113 or through their website at https://ico.org.uk/concerns.

Where third parties (such as the Scheme’s advisers) are required to process your personal data in order to assist the Trustee or Company in administering the Scheme, those third parties may themselves act as data controllers in respect of the way in which they process your personal data and produce their own fair processing notices (also referred to as ‘privacy notices’).  Various third parties have asked the Trustee to provide you with access to their fair processing notices which explain how they process personal data and meet their compliance obligations under privacy laws. The Trustee will publish any such notices, or links to websites containing those notices, on the Scheme’s Trustee portal.