Privacy Notice
1. Purpose of this Notice
Hughes Price Walker Limited (“HPW”, “we”, “us”, “our”) is committed to protecting your privacy and the information that is entrusted to us.
This Privacy Notice (‘Notice’) provides information regarding your rights under data protection legislation and sets out how we collect and process personal data.
HPW acts as the Data Controller for recruitment, HR and marketing purposes.
Where HPW processes personal data on behalf of our clients and in accordance with our clients’ instructions, we will generally act as the Data Processor and our clients will be the Data Controller.
Where a Scheme Actuary employed by HPW has been appointed by a Trustee or Trustees, the Scheme Actuary will generally act as a joint Data Controller with the Trustee(s); except where they are legally required to act independently they will act as Data Controller in common with our clients. Whilst the Scheme Actuary is in HPW’s employment, they will carry out their respective responsibilities for compliance with data protection legislation in accordance with this Notice. All HPW Scheme Actuaries are registered as Data Controllers with the Information Commissioner’s Office (ICO).
The categories of data subjects for whom this Notice applies to include, but may not be limited to:
For business purposes:
Clients – those for whom we provide services under our terms of agreement
Third parties – those for whom we liaise with in order to provide those services
If you are a member of a pension scheme that we administer, you can obtain that scheme’s specific privacy notice by contacting the trustees of your pension scheme.
For recruitment and HR purposes:
Former employees, prospective employees, work experience students and interns - i.e. personnel who do not, or no longer, form part of an employment contract with HPW. HPW issues a separate privacy notice to current members of staff.
Emergency contacts - whose details have been provided to us by our former employees, work experience students and interns
For marketing and website purposes:
Prospective clients – those for whom we contact for marketing purposes
Website enquiries - anyone contacting us via our website
We process personal data in respect of these individuals for the following purposes:
Business purposes:
To provide our clients with the services detailed in our terms of agreement with them
To manage relationships and complete our contractual obligations to our clients
To comply with any laws and professional obligations that apply to us and our individual members of staff
To undertake necessary checks to prevent illegal activity or protect our interests
Recruitment and HR purposes:
To process applications for any job vacancies and career enquiries you have sent us
To undertake appropriate background checks to protect our interests and fulfil our obligations under any relevant law or regulation
To ensure we appropriately manage any visits to our office by adhering to our security and health and safety policies
To undertake necessary checks to prevent illegal activity or protect our interests
Marketing and website purposes
We may use your personal information for direct marketing purposes (e.g. issuing emails to your corporate email address) but only where we have told you we may do this and you have either consented or you have had the opportunity to ‘opt out’ but not done so
To respond to any query you have sent us
To send you any relevant information regarding our services and the latest news in pensions and investments
Our website does not use tracking cookies to obtain data or monitor the use of the site. We will keep our Notice under review and update it with any changes should they occur.
2. The data we hold
We process personal data that is provided by you or received from other parties. The sources may include clients, pension scheme trustees and employers, referees, recruitment agencies, professional advisers and service providers, public authorities and publicly available sources. Personal data held includes, but may not be limited to:
We process personal data in respect of these individuals for the following purposes:
Personal basic
Name (including former surnames), gender, date of birth, home address (including address history), national identifier, nationality, marital status and signatures
Personal specific
Contact details (email address and phone number), photographic information and proof of address documents, relationships and dependants contact details, bank account details, specific expenditure details such as student loan deductions and job title
Employment related
Salary information, employment and job application details (including employment history, education and qualification details) and pension information
Special and other categories
Relevant health and medical information and any relevant background information relating to criminal offences and convictions. Where we collect these special categories of data from you, we will set out our specific purpose(s) for doing so. We will then only process this data if we have received your explicit consent, unless we are lawfully permitted to process the data due to legal and regulatory obligations.
3. What we do with the data
HPW will process your personal data in accordance with this Notice unless such processing would conflict with any applicable regulation or legislation when these would prevail.
Our lawful bases for holding and processing personal data are:
For business purposes:
Processing is necessary for the performance of a contract and / or letter of appointment to which our clients are party to, or in order to take steps at the request of prospective clients prior to entering into a contract
Processing is necessary for our Scheme Actuaries to act in accordance with their legal and professional obligations, as well as their ethical code; and
Processing is necessary for the purposes of our legitimate interests in carrying out specified services to our clients. These include but may not be limited to those purposes listed in section 1.
For recruitment and HR purposes
Where processing is required for tax or reporting purposes in relation to data subjects whose employment ended during the relevant tax period(s)
Where you have given us your explicit consent to process your data, and HPW agrees that explicit consent is required, you can amend or withdraw at any time using the contact details provided at the end of this Notice; and
Processing is necessary for the purposes of our legitimate interests in respect of recruitment and HR purposes as listed in section 1(ii).
For marketing and website purposes:
Where you have given us your explicit consent to process your data, and HPW agrees that explicit consent is required, you can amend or withdraw at any time using the contact details provided at the end of this Notice.
In the unlikely event that we intend to further process your personal data for a purpose other than that for which your personal data has been collected, we will keep our Notice under review and update it with any changes should they occur.
4. Sharing your data
In certain circumstances we may share your personal data with the following recipients:
For business purposes:
Third parties contracted or obliged to provide services to our clients, for example: other pension providers, auditors, investment managers, legal advisers and any other party our clients may reasonably instruct us to share data with for the purposes of carrying out our services
Third parties instructed by us to carry out subcontracted services as part of the services we provide our clients, for example: banking providers, pensioner payroll providers, professional tracing companies, companies supplying website services
Those parties to whom we must report to for legal and professional reasons, for example: auditors, insurers, external accreditation bodies and HMRC
The recipients for whom we share personal data in respect of our clients’ data subjects (e.g. members of the pension schemes we administer) are different to those listed out above and can be obtained from HPW on a scheme specific basis.
For recruitment and HR purposes
Authorised employees of HPW in order to achieve the purposes set out in section 1(ii)
Companies supplying our computer and information technology services
Any law enforcement agency, government or judicial body or other third party to the extent that we are required to do so by law, or in order to establish, exercise or defend our legal rights
For marketing and website purposes:
We will not share any personal information provided to us by you, via our website, to any other party
Our website may contain links to other websites. Once you use these links to leave our website, HPW does not have any control over these websites. Therefore we cannot be responsible for the protection and privacy of any information you provide to these sites.
Any data held by us and any third party will be treated as confidential. We will not sell your information to any third parties nor will any third party to whom we disclose your information.
Transferring data outside of the EEA
We do not typically transfer personal data outside of the European Economic Area (EEA) unless you request for this to be done. In certain circumstances, your personal data may be transferred outside of the EEA. HPW shall only transfer personal data outside the EEA where:
The recipient of your personal data has entered into European Commission approved standard contract with yourselves, obliging them to take all reasonable steps to safeguard your personal data;
The recipient is approved by the European Commission as offering a sufficient level of protection; or
For an eligible US recipient, HPW relies on the UK Extension to the EUUS Data Privacy Framework.
5. How we store your data
Keeping it safe
Personal data is stored electronically and/or in paper format. We take appropriate organisational and technical security measures and have policies and procedures in place to ensure that the personal data we hold on our computer systems is only accessed by authorised personnel.
When transmitting personal data by email we take all reasonable steps to keep it secure by applying password protection or sending by secure email. However, please be aware that transmitting data by email is not completely secure and if you transmit personal data by email, you do so at your own risk.
We also expect third parties who provide services on our behalf to safeguard personal data in a similar manner and we take reasonable steps to monitor their compliance.
We take every reasonable measure and precaution to protect and secure personal data against unauthorised access, improper use, alteration, destruction or accidental loss or disclosure. Full details of our data security policy are available on request.
HPW is a Cyber Essentials accredited organisation.
Retaining your information
We will retain your personal information for as long as is necessary for the purposes specified in this Notice, unless a longer retention period is required by law or by regulations that apply to us. We have strict data retention policies in place to meet this requirement.
If we no longer require your personal data and deem it appropriate to remove it from our properties, we will do so in a controlled manner, ensuring it is destroyed securely. All paperwork containing personal information is securely disposed of by a company that holds a BS EN 15713 Secure Destruction of Confidential Material Certification and whose members of staff are security vetted to BS7858 standards.
6. Your rights under data protection law
Retaining your information
We will retain your personal information for as long as is necessary for the purposes specified in this Notice, unless a longer retention period is required by law or by regulations that apply to us. We have strict data retention policies in place to meet this requirement.
If we no longer require your personal data and deem it appropriate to remove it from our properties, we will do so in a controlled manner, ensuring it is destroyed securely. All paperwork containing personal information is securely disposed of by a company that holds a BS EN 15713 Secure Destruction of Confidential Material Certification and whose members of staff are security vetted to BS7858 standards.
7. Relevant contact details
ICO helpline:
0303 123 1113 (or 01625 545 700 if calling outside of the UK)
Email:
By visiting the ICO website at https://ico.org.uk/global/contactus/email
Head office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Office line:
0117 427 8900
Website:
Head office:
Data Compliance Officer, Hughes Price Walker Ltd, Pembroke House, 15 Pembroke Road, Clifton, Bristol, BS8 3BA