Section one

About your personal information

What information do we collect and process?
We collect and process your personal information because you are or were a member, or are or were connected to a member of one or more of the Plans. We also collect personal information if you contact us in connection with your membership of the relevant Plan.

We collect and process the following categories of personal information about you:

• personal contact details – names, titles, addresses, telephone numbers and email addresses;
• information about you – dates of birth, sex, marital status, dependents and next of kin;
• payroll information – National Insurance numbers, payroll numbers, bank account details, tax status, salary and employment information; and
• pension benefits – information about the pension benefits that you have accrued, investment choices and death benefit nomination forms.

What sensitive personal information do we collect and process?
We usually only ask for sensitive personal information when it is required to help us make a decision in relation to your rights under one or more of the Plans. For example, we may request:

• health information / medical records – we may ask you to provide health information if you request payment of a benefit that can only be paid if you meet certain medical criteria (e.g. ill health early retirement benefits). In addition to receiving this information from you, we may receive medical information from third parties such as your doctor or a third party occupational health provider; or
• other sensitive personal information – we may ask you to provide other sensitive personal information (e.g. information about your personal relationships) if it is relevant to help us decide on an internal dispute resolution procedure.

In addition, certain categories of sensitive personal information (e.g. race, ethnicity, religious beliefs and sexual orientation) may be revealed on formal documentation that we process in order to identify the recipients of benefits under the Plans (e.g. birth certificates, marriage certificates, driving licenses and passports). You may also decide to provide us with sensitive personal information voluntarily (e.g. when raising queries or making a complaint).

How do we collect your personal information?
When you joined the relevant Plan, you and/or your employer provided personal details so that we could create your membership record.

This information is updated whilst you are a member of the Plan, even if you have since left service with any of the Plans’ employers. Updated information may come from:

• you (e.g. if you get in touch to let us know a new address);
• your employer or former employer (e.g. updated salary and payroll information); and
• other third parties (e.g. if you contact the Plan's administrator to update your personal information or if HMRC provides us with information so that we can deduct the correct level of tax). In addition, we may request additional information in certain circumstances (e.g. if you request to transfer your benefits to another pension scheme, if you apply for ill health benefits or when you ask for your benefits to start being paid).

Why do we process your personal information?
We use this information to:

• set up your membership record for the Plans;
• manage your membership of the Plans;
• send you information that is relevant to your membership of the Plans;
• calculate, pay and settle any benefits that you are entitled to from the Plans;
• comply with our legal and regulatory duties;
• help manage risks and liabilities in the Plans in order to seek to be able to pay full benefits as far as possible;
• help the Plans’ sponsoring employers comply with their legal and regulatory duties;
• communicate with members and their independent financial advisers with information about the Plans; and
• improve our information and knowledge of pension schemes generally.

What are our legal grounds for processing your personal information?

In order to comply with our legal obligations
As the Trustees of the Plans, we are under legal obligations to process your personal information in order to comply with pensions and other relevant legislation, the Plans’ rules, court rulings and Pensions Ombudsman decisions. For example:

• legislation sets out certain things trustees must do (e.g. sending certain information to the Plans’ members); and
• the Trustees are subject to fiduciary duties under trust law to act in line with the Plans’ governing documentation.

It is necessary for us to process your personal information in order to comply with these legal obligations.

In order to fulfil our legitimate interests
Processing your personal information is also lawful if it is based on our 'legitimate interests'. The Trustees have a legitimate interest in running and managing the relevant Plan and managing the Plans’ risks and liabilities. In addition, certain third parties may have legitimate interests which require the processing of your personal information by the Trustees (e.g. your employer may need information in order to comply with regulatory requirements).

In order to rely on this legal ground, we have:

• considered the impact the processing has on your interests and rights; and
• implemented appropriate safeguards to ensure that your privacy is protected as far as possible.

What are our legal grounds for processing your sensitive personal information?
There are three legal grounds that allow us to process your sensitive personal information (sometimes referred to as special categories of personal data):

• when we obtain explicit consent from you (e.g. when you sign one of the Plans’ forms which contains the appropriate consent wording);
• when processing is necessary for carrying out obligations under employment, social security or social protection law. This includes obligations under pensions law; and
• when processing is necessary for reasons of substantial public interest (which, under the Data Protection Act 2018, applies to certain processing by trustees of occupational pension schemes when making decisions about benefits).

What would happen if we did not collect and process your personal information?
If we did not collect and process your personal information then:

• we would not be able to manage or administer the Plans appropriately;
• we would not be able to pay the benefits that you are entitled to under the relevant Plan; and
• we would be in breach of our legal and regulatory duties.

How long do we keep your personal information for?
The Plans were set up to provide benefits over a very long time. The Trustees need to maintain records in order to properly run the Plans, to determine who should receive what level of benefits and when they should receive them, and to respond to any disputes about an individual's rights under the Plans.

As a result, the Trustees will generally keep your personal information for a long period of time i.e until the wind up of the relevant Plan or the death of the last beneficiary, in either case, plus 15 years (which is the longest period of time that someone can bring a claim against any of the Plans). Our service providers (and former service providers) may also have similar valid grounds to keep your personal information for such long periods.

Section three

Your rights and who to contact

What rights do you have in respect of your personal information?
In certain circumstances, you have the following rights in respect of your personal information:

• the right to object to us processing your personal information;
• the right to request access to personal information relating to you;
• the right to request that we correct any mistakes in your personal information;
• rights in relation to automated decision taking;
• the right to request to restrict or prevent processing of your personal information;
• the right to request to have your personal information transferred to another data controller (e.g. if you decide to transfer your pension benefits to another pension scheme); and
• the right to request to have your personal information deleted.

We've set out more information about these rights in part two of the additional information starting on page 9.

How will we respond to your request?
We will usually respond to any request that you make in relation to your rights within a month of receiving your request. If your request is particularly complex, we will let you know that we've received your request and let you know when we aim to respond. You can find out more about your rights under the UK's data protection laws at www.ico.org.uk.

Under the UK's data protection legislation, there are exemptions which mean that, in certain circumstances, we may continue to store, process or transfer your personal information (for example where we need to comply with a legal requirement or have a legally valid legitimate interest in doing so) even if you ask us not to.

What should you do if you have any questions or complaints?
You may be entitled to compensation for damage caused by breach of the Data Protection Legislation. If you do not think that we have processed your data in accordance with this notice, please contact us in the first instance (see 'How to contact us' below). If you are not satisfied, you can complain to the Information Commissioner's Office. Information about how to do this is available on their website at www.ico.org.uk/concerns or by calling their helpline on 0303 123 1113.

How to contact us
Please contact us if you have any questions about this privacy notice or the information we hold about you.

If you wish to contact us, please send an email or a letter to pensions@mbplc.com or The Pensions Department, Mitchells & Butlers plc, 27 Fleet Street, Birmingham B3 1JP. Alternatively, you can call the Pensions Department on 0121 498 5767.

Further information - part two

More about your rights under the gdpr

As a data subject, you have a range of rights under the Data Protection Legislation. These rights are explained in more detail below. If you have any comments, concerns or complaints about our use of your personal information, please contact us directly.

You can email or write to us at:
pensions@mbplc.com or The Pensions Department, Mitchells & Butlers plc, 27 Fleet Street, Birmingham B3 1JP

Alternatively, you can call the Pensions Department on 0121 498 5767

Right to object to our processing of your personal information
You may object to us processing your personal information where we are relying on a legitimate interest as our legal grounds for processing. Our legal grounds for processing are set out in section one of this data protection notice and part one of the Further Information section.

If you have the right to object to processing (i.e. for personal information that we process in order to fulfil our legitimate interests or the legitimate interests of a third party) and you exercise this right, we will no longer be able to process your personal information unless we can demonstrate compelling grounds for continuing to do so. We believe we have demonstrated compelling grounds as set out in section one of this data protection notice and in part one of the further information.
The key point to note is that, if we cannot continue to process your personal information, we would be unable to ensure that we are providing the correct level of benefits in respect of your membership of the Plan. As we are legally required to pay the correct level of benefits to the right people at the right time, in these circumstances we may have to delay or even stop payments / requests until we have sufficient information.

Right to access personal data relating to you
You can ask us to confirm whether we are processing your personal information. If we are, you may ask us to provide the following:

• a copy of your personal information (please note that, if you want more than one copy of your personal information, we reserve the right to charge a reasonable fee based on our administrative costs for the provision of such further copies);
• details of the purpose for which your personal information is being, or is to be, processed;
• details of the recipients or classes of recipients to whom your personal information is, or might be, disclosed, including, if the recipient is based in a country outside of the European Union, what protections are in place in relation to the transfer to that recipient;
• the period for which your personal information is held (or the criteria we use to determine how long it is held);
• any information available about where we obtained your personal information; and
• confirmation as to whether we carry out any automated decision-making (including profiling) and, where we do, information about the logic involved and the envisaged outcome or consequences of that decision or profiling.

Requests for your personal information must be made to us in writing (see ‘How can you contact us?’ above). A copy of your request will be kept on your membership record. To help us find the information easily, please give us as much information as possible about the type of information you would like to see.

If, to comply with your request, we would have to disclose information relating to or identifying another person, we may need to obtain the consent of that person if possible. If we cannot obtain consent, we may need to withhold that information or edit the data to remove the identity of that person if possible.

There are certain types of information which we are not obliged to disclose to you, which include personal information which records our intentions in relation to any negotiations with you where disclosure would be likely to prejudice those negotiations.

Right to correct any mistakes in your information
You can require us to correct any mistakes (including adding missing information) in any of the personal information concerning you which we hold. Please contact us using the contact details set out at the beginning of this section.

Rights in relation to automated decision making/profiling
The Trustees do not use automated decision making or profiling.
Automated decision making occurs when decisions are taken solely on automated processes. Under the Data Protection Legislation, you have the right to ask that, if you are being evaluated (for example, when a bank carried out credit checks before making decisions on issuing loans or credit cards), any decisions are not solely based on automated processes and to have any decision reviewed by a member of staff.

These rights will not apply in all circumstances, for example where the decision is authorised or required by law and steps have been taken to safeguard your interests.

Right to request that we restrict the processing of your personal information
You may request that we restrict the processing of your personal information in any of the following circumstances:

• where you do not think that your personal information is accurate. In this case, we will start processing again once we have checked whether or not your personal information is accurate;
• where the processing is unlawful, but you do not want us to erase your information;
• where we no longer need the personal information for the purposes of our processing, but you need the information to establish, exercise or defend legal claims; or
• where you have objected to processing because you believe that your interests should override our legitimate interests. In this case, we will start processing again once we have checked whether or not our legitimate interests override your interests.

If our processing is restricted in any of the circumstances described above, we will inform you in advance if that restriction is to be lifted.

Right to request that we delete your personal information
You can ask us to delete your personal information where your personal information is being processed on a legal ground other than for complying with a legal obligation and:

• you believe that we no longer need to process it for the purposes set out in this privacy notice;
• you had given us consent to process it, but you withdraw that consent and there is no other legal ground upon which we can process it;
• you have successfully objected to our processing it; or
• it has been processed unlawfully or has not been erased when it should have been.

Right to request transfer of your personal information
You may, in specified circumstances, ask a data controller to provide you with an electronic copy of personal information that you have provided to it, or to have such a copy transmitted directly to another data controller.

Those circumstances do not, however, generally apply in relation our processing of your personal information in connection with the Plans. This is because:

• our legal grounds for processing will not normally be that you have consented to the processing; and
• we do not carry out processing by automated means.

Right to withdraw consent
We usually only request your consent when we ask you for sensitive personal data. You have the right to withdraw any consent you have given us at any point.

However, as highlighted above, the Trustees only request sensitive personal data that is required to make decisions in respect of specific member benefits or complaints. If you withdraw your consent for us to process this information, we may have to delay or even stop payments / requests until we have sufficient information.

What will happen if your rights are breached?
You may be entitled to compensation for damage caused by breach of the Data Protection Legislation. If you do not think that we have processed your information in accordance with this notice, please contact us in the first instance.

If you are not satisfied, you can complain to the Information Commissioner's Office. Information about how to do this is available on their website at www.ico.org.uk/concerns or by calling their helpline on 0303 123 1113..

Further information - part four

Key terms and phrases

Data controller means the natural or legal person or other body who, alone or jointly with others, determines the purposes and means of the processing of personal data. This means that the data controller exercises overall control over the 'why' and 'how' of a data processing activity.

Data Protection Act 1998 is the legislation that currently applies to the processing of personal data in the UK. The Data Protection Bill 2017 – 19 will repeal the Data Protection Act 1998.

Data Protection Legislation means the Data Protection Act 1998, the Data Protection Bill 2017 – 19 and the General Data Protection Regulation, together with regulatory guidance issued by the European Commission (via the Article 29 Working Party) and the Information Commissioner's Office.

Data protection principles means the principles that are set out in the Data Protection Legislation relating to the processing of personal data. In the General Data Protection Regulation, there are six principles:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation; and
• integrity and confidentiality.

In addition, there is an overarching principle of accountability.

Data processor means a natural or legal person or other body who processes personal data on behalf of the data controller.

Data subject means the identified or identifiable living individual to whom personal data relates.

General Data Protection Regulation (GDPR) is the primary EU legislation that, on and from 25 May 2018, will apply to the processing of personal data in all member states of the EU.

Information Commissioner's Office (ICO) is the UK's national data protection authority. It is a public body that is charged with regulating information rights, public sector transparency and individual's privacy in the UK.

Personal data or Personal information means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number etc.

Privacy notice means the information that is provided to inform individuals about what you do with personal data. Under the Data Protection Legislation, data controllers must provide accessible information to individuals about the use of their personal data.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special categories of personal data
(also referred to as sensitive personal data) means:

• personal data that is personal data which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
• the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person;
• data concerning health; or
• data concerning a natural person's sex life or sexual orientation.