GDPR Data Privacy Notice

Issued by the Trustee of the T-Mobile International UK Excepted Life Assurance Scheme (the “Scheme”)

Date: 01 September 2019

Introduction

1. Deutsche Telekom (UK) Limited (the “Company”) is the principal employer and the trustee of the Scheme.  All references to ‘the Trustee’ in this notice are references to the Company acting in its capacity as the trustee of the Scheme.
2. On 25 May 2018, a new law came into force concerning the protection and processing of people’s personal data. The Trustee is providing this notice to you in compliance with its obligations as a ‘controller’ under this new law.
3. The Trustee holds certain personal data about you as a member of the Scheme. This is necessary for the Trustee to operate the Scheme and comply with its legal obligations. The Trustee of the Scheme may change over time and your personal data will be held by any replacement trustees in the same way as it is held by the current Trustee.
4. This notice should help you understand how the Trustee (and anyone acting on its behalf or to whom it has appointed as agent for the purposes of exercising any of its powers or actions) processes your personal data and the arrangements which are in place to protect it. This notice is being provided for your information – you do not need to take any action in response to it.

Collection of personal data

5. As a member of the Scheme, the Trustee will hold certain personal data relating to you. This may include, for example:

• your name, gender, address, date of birth, telephone number and email address;
  ·  your National Insurance number;
  ·  your service history while employed by the Company;
  ·  your marital status and details of any dependants and/or potential beneficiaries;
  ·  in certain cases, information relating to your health (considered “sensitive” personal data);
  ·  benefit information e.g. level of your lump sum death benefit; and
  ·  any other personal data which may be required to calculate the death benefit provided in respect of you from the Scheme or as necessary for the proper running and administration of the Scheme.

6. Some of this data is or will have been collected directly from you (for example, when filling in forms in relation to your membership of the Scheme, or corresponding with the Trustee or a representative of the Trustee by telephone, post, email or otherwise). If you visit the Scheme’s Pension website, it will automatically collect some data about you and your visit, including the Internet protocol address used to connect your device to the Internet and some other data such as your browser type and version and the pages on the site that you visit. We may also collect some data from other sources. For example:

• Some data is or will have been collected from the Company (as your employer / former employer).
  ·  We may also occasionally obtain or have obtained data about you from external sources (for example, the Scheme administrators, the Company’s payroll provider, HM Revenue and Customs and the trustee of the T-Mobile International UK Pension Scheme (the “Pension Scheme Trustee”).
  ·  Except in those cases where it is indicated that the provision of data is purely voluntary, you are required to provide the personal data requested of you so that the Trustee can use it for the purposes set out below. Failure to provide it could lead to the Trustee being unable to process the benefit provided in respect of you from the Scheme. If you have any questions about the Trustee’s need for your information, please raise your questions with the person making the request, DTUK HR or the Pension Scheme Trustee.  

Use of personal data

7. The Trustee may use your personal data to distribute the death benefit provided in respect of you from the Scheme.
8. The Trustee is legally entitled to process your personal data as described in this notice because it needs to do so in order to pursue the purposes described above in the operation of the Scheme.  In some circumstances the processing is also justified because it is necessary so that the Trustee can comply with its regulatory and legal obligations as trustee of the Scheme, or where otherwise required by law. 

Consent

9. The Trustee does not generally rely on your consent to justify processing your personal data.
10. If the Trustee does need your consent in any particular case (for example, they may need your consent in certain cases involving sensitive personal data (e.g. medical information), they will ask you for it separately – you are not obliged to consent and if you do consent, you can withdraw it at any time where the Trustee is relying on your consent to justify their processing (although it may be necessary to retain some or all of the information provided where the Trustee needs to for the defence of legal claims).

Disclosure and International Transfers of Data

11. It is the Trustee’s policy to protect your right to privacy and it will ensure that adequate technical and security measures, confidentiality obligations and compliance procedures are at all times in place to prevent inappropriate access to, alteration or deletion of personal data.
12. The Trustee may share data with the Company (acting other than its capacity as Trustee of the Scheme) or another company in the Company’s Group and to third parties for the above purposes, subject to the policies and procedures it has in place to keep your data safe.
13. In particular, data may be disclosed to the following third parties:

• Anyone to whom the Trustee has appointed as delegate or agent for the purposes of exercising any of its powers or actions (the Trustee has currently appointed the Pension Scheme Trustee as its delegate for the purposes of determining the recipient or recipients of any proceeds payable in respect of you from the Scheme);
  ·  The administrators of the Scheme (the current administrators are Capita);
  ·  The Trustee’s legal and other professional advisers (the current legal advisers are Clifford Chance LLP);
  ·  The insurance company providing the policies assuring the benefits under the Scheme (the current insurers are Unum);
  ·  Any other service providers who hold or process your data on the Trustee’s behalf;
  ·  Third parties to whom the Trustee is required to transfer data by law or regulatory requirements (e.g. government and regulatory authorities);

14. However, personal data will only be disclosed where this is reasonably necessary for the purposes of the proper running and administration of the Scheme, including the provision of benefits in respect of you from the Scheme, or where otherwise required by law or regulatory requirements.
15. These disclosures may involve transferring your personal data overseas. You should be aware that this may include transfers to countries outside the European Economic Area / UK, which do not have similarly strict data privacy laws. In those cases, we will ensure that our arrangements with any relevant third parties are governed by data transfer agreements, designed to ensure that your personal data is protected, on terms approved for this purpose by the European Commission. You can ask for copies of these agreements at any time (see below).

Retention

16. Your personal data will be retained for such period as is reasonably necessary for the proper running and administration of the Scheme and the performance of the Trustee’s legal obligations and the pursuit of its legitimate interests. The Trustee’s current retention policy is that personal data relating to you will be retained by the Scheme for so long as a death benefit has not been paid out in respect of you under the Scheme, and, because trustees of pension schemes can commonly face complaints or questions from beneficiaries or potential beneficiaries many years after a beneficiary has ceased to be prospectively entitled to benefits, some personal data may need to be kept indefinitely. However, the Trustee will not retain personal data for longer than is necessary having regard to the purpose for which it is held. The Trustee will keep this data retention policy subject to review and may update it from time to time to ensure it remains appropriate.

Your rights and who to contact

17. DTUK HR can be contacted at the following email address: DTUK_HR@telekom.comin relation to any questions about this notice.
18. Subject to the relevant legal rules, you have the right to ask the Trustee to: (1) provide you with access to your personal data; (2) rectify any inaccurate personal data; (3) erase your personal data; (4) restrict or stop processing your personal data. However, in certain circumstances the Trustee may be permitted to continue processing your personal data where this is justified. To exercise any of these rights contact DTUK_Privacy@telekom.com. Please note that requesting for your personal data to be erased or for processing to be restricted / stopped could impact your eligibility or continued eligibility for a death benefit to be provided in respect of you under the Scheme.
19. The Trustee would encourage you to use their own internal procedures and informal discussions with Data Protection Officer or Human Resources to resolve any concerns you may have about data privacy in the first instance. However, you do have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk). 
20. In order to enable the Trustee to meet its legal obligations you should notify DTUK_HR@telekom.comof any changes to your personal details (e.g. address or other contact details) as soon as possible.

Miscellaneous

Expressions used in this notice

21. The references in this notice to data “relating to you” or “about you” include references to data about third parties such as your spouse, civil partner, co-habitee and/or children (if any) which you provide to the Trustee on their behalf. Where you provide such data (for example, when completing or updating an expression of wish form / death benefit nomination form), you should inform the third party that you are doing this and share a copy of this notice with them so they also understand how this data is processed.
22. This notice refers to health data as “sensitive” personal data. “Sensitive” personal data covers various categories of personal data identified by law as requiring special treatment. These categories comprise personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, health, sexual life, sexual orientation, biometric data and data relating to criminal convictions and offences or related security measures. In the context of the Scheme, the only sensitive data the Trustee is likely to hold in relation to you (if at all) is data relating to your health.
23. The “Group” means Deutsche Telekom (UK) Limited and its associated companies.

Changes to this policy

Any changes we make to this notice in the future will be posted to the Scheme’s Pension website and available on request from DTUK_HR@telekom.com. Please check for any changes if you are using a printed copy of this notice.