Privacy notice

Valid from 23 June 2025

This privacy notice is for members and beneficiaries of the Plan. It has been prepared by Dun & Bradstreet (UK) Pension Plan Trustee Company Limited (“Trustee”, or “we”) in its capacity as trustee of the Plan.

The Trustee is registered as a controller of personal data with the Information Commissioner’s Office ("ICO").

This notice will also be made available on the Plan's website www.dnbpensionplan.co.uk/

This privacy notice replaces the previous version of this privacy notice that was made on 15 May 2018 and supplements any other notices and statements we issue that are specific to particular data collection / processing activities.

Why we are providing this notice to you

As the trustee of the Plan we hold certain information about you and from which you can be identified (either from the information itself or with other information that we may hold) ("personal data"). In line with the transparency requirements of applicable data protection laws, we are required to give you specified information about the personal data we hold about you, how we use it, and the safeguards that are in place to protect it. This notice is designed to give you that information.

Why we process your personal data

The Trustee processes personal data about you, in its role as controller, for the proper handling of all matters relating to the Plan, including its administration and management, calculating, securing and paying benefits and managing liabilities in relation to it.

Details regarding how and why we process your personal data and the legal bases relied on by the Trustee when carrying out this processing are set out in the Schedule. The Schedule also provides information concerning the conditions that we rely upon when processing "special categories" of particularly sensitive personal data (including personal data concerning health).

What personal data we hold and how we obtain it

Please refer to the Schedule for information concerning the types of personal data we hold and process about you.

We obtain some of this personal data directly from you. We may also obtain data from your current or past employer(s) or companies that succeeded them in business (for example salary information), from a member of the Plan (where you are or could be a beneficiary of the Plan as a consequence of that person's membership), and from a variety of other sources including data tracing agencies, public databases, our advisers, additional voluntary contribution (AVC) arrangement providers, and government or regulatory bodies.

Where you have provided us with personal data about other individuals, such as family members, dependants or potential beneficiaries under the Plan, please ensure that those individuals are aware of the information contained within this notice.

How we will use your personal data

We may use this data to deal with all matters relating to the Plan, including its administration and management. For further information, please refer to the Schedule.

Organisations that we may share your personal data with

From time to time, we will share your personal data with our advisers and service providers so that they can help us carry out our duties, rights and discretions in relation to the Plan.

These include the following advisers and service providers.

The Plan administrator, currently Gallagher. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: www.ajg.com/uk/global-privacy-.../
The DC Scheme administrators, currently Aviva. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: www.aviva.co.uk/privacypolicy....
The legal advisers to the Trustee, currently Squire Patton Boggs (UK) LLP. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: https://www.squirepattonboggs.com/en/footer/privacy
The Plan actuary, currently Stephen Aries of Willis Towers Watson. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: www.willistowerswatson.com/personal-data.
The Actuarial consultants, currently Willis Towers Watson. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: www.willistowerswatson.com/per...
The Plan auditors, currently RSM. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: https://www.rsmuk.com/privacy-...
The Investment advisers currently Willis Towers Watson. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: www.willistowerswatson.com/per...
Communications advisers, currently Gallagher.
Tracing bureaus for mortality screening and locating members and beneficiaries, currently Target Processional Services Ltd. Their privacy policy can be found on their website: www.targetprofessional.co.uk/p...
The Trustee's insurers, currently Just Group Plc. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website www.justretirement.com/defined.../
The Plan's bank, currently Lloyds Bank. Their privacy policy, which sets out how they carry out their obligations in relation to personal data, can be found on their website: www.lloydsbank.com/help-guidan...
Suppliers of IT (including the Plan website and member portal), document production and distribution services, currently Gallagher.
Payroll provider, currently Gallagher.

In some instances, advisers and service providers will be controllers in their own right and will be directly responsible to you for their use of your personal data. They may be obliged under the data protection laws to provide you with additional information regarding the personal data that they hold about you and how and why they process that data. Further information may be provided to you in a separate notice or may be obtained from the advisers and service providers directly, for example, via their websites. Whenever one of our advisers or service providers acts as a joint controller with us in respect of your personal data, because we jointly determine the purposes and means of processing it, we will agree with them how we are each going to meet our respective and collective obligations under the data protection laws. If you would like more information about how such an arrangement works, please contact us using the contact details below.

We may also provide some of your data to the Plan's sponsoring employer Dun & Bradstreet and group companies of the employers, the advisers and potential purchasers of the businesses.

In addition, where we make investments or seek to provide benefits for Plan members and other beneficiaries in other ways, such as through the use of insurance or pension scheme mergers, then we may need to share personal data with providers of investments, insurers and other pension scheme operators.

The advisers, service providers and organisations referred to in the paragraphs above may use personal data to perform their functions as well as for statistical and financial modelling (such as calculating expected average benefit costs and mortality rates) and planning, business administration and regulatory purposes. They may also pass the data to other third parties (for example, insurers may pass personal data to other insurance companies for the purpose of obtaining reinsurance), to the extent they consider it appropriate to do so.

Where requested or if we consider that it is reasonably required, we may also provide your personal data to:

pensions dashboards (for further information about pensions dashboards, please refer to the Money & Pensions Service website (https://maps.org.uk/en/our-wor...);
the Pension Protection Fund; and
government bodies, regulators and dispute resolution and law enforcement organisations (including the courts, the Pensions Regulator, the Pensions Ombudsman, and HMRC).

They may then use the data to carry out their functions.

Transferring personal data outside the UK

In some cases, recipients of your personal data may be outside the UK. This may include the Plan's sponsoring employer and in each case, their professional advisors, as applicable. It may also include affiliates / overseas offices of the Plan's service providers, including Gallagher and Willis Towers Watson. This means your personal data may be transferred outside the UK to a jurisdiction that may not offer an equivalent level of protection as is provided in the UK.

Additional safeguards are in place to protect your personal data when it is transferred outside the UK as we ensure that at least one of the following measures is relied on:

the transfer is to a country that has been deemed to provide an adequate level of protection for personal data by the UK Secretary of State; or
we have put in place standard contractual clauses (approved by the relevant governmental or supervisory authority) with the recipient of the data to ensure that your personal data is safeguarded in accordance with applicable laws.

Please contact the Trustee using the contact details below, if you require further information about the safeguards that have been adopted or would like to request (free of charge) a copy of the standard contractual clauses that we use in relation to the processing of your personal data.

How long we keep your personal data

We will only keep your personal data for as long as we need to in order to fulfil the purposes identified above and detailed further in the Schedule. In practice this means that we will retain your data for such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Plan and for so long afterwards as may be required to deal with any questions, complaints or claims that we may receive about our administration of the Plan. We may also retain your data for a longer period to comply with our legal and regulatory obligations.

Your rights

You have a right to access and obtain a copy of the personal data that the Trustee holds about you, and to ask the Trustee to correct your personal data if there are any errors or it is out of date or incomplete.

You have a right to ask the Trustee to erase your personal data where it is being processed on a legal ground other than for complying with a legal obligation and where:

you believe we no longer need to process the personal data for the purposes identified above and detailed further in the Schedule;
you had given consent to the processing of the personal data but you subsequently withdraw your consent and there is no other lawful basis upon which we can process the personal data;
the personal data has been processed unlawfully or it has not been erased when it should have been; or
you have been successful in objecting to the processing.

In some cases, you may also have a right to request that the processing of your personal data be restricted or to transfer your personal data (for example, to another pension scheme).

In certain circumstances, you also have the right to object to the processing of your personal data, for example:

where we rely on legitimate interests as our lawful basis for processing; in which case, we must carry out an exercise balancing our legitimate interests with your rights and freedoms as a data subject (if you disagree with the outcome of that balancing exercise you have the right to refer the matter to the ICO); or
where the processing is for direct marketing purposes.

Where we rely upon your consent to lawfully process your personal data, including explicit consent, you have the right to withdraw your consent to the processing at any time by notifying the Trustee in writing. Withdrawal of consent will not affect the lawfulness of processing based on your consent before it is withdrawn.

You can obtain further information about these rights from the ICO at: www.ico.org.uk or via its telephone helpline (0303 123 1113).

If you wish to exercise any of these rights or have any queries or concerns regarding the processing of your personal data, please contact the Trustee using the contact details provided below. You can also lodge a complaint in relation to this privacy notice or the Trustee's processing activities with the ICO - you can do this via the ICO's website or telephone helpline.

As explained in this privacy notice, one of the reasons we collect and hold your personal data is to administer your Plan benefits. If you do not provide the information we request, withdraw your consent to the processing, or ask that the personal data we already hold is deleted or that the processing of the personal data be restricted, this may affect our ability to administer your benefits, including the payment of benefits from the Plan. In some cases it could mean the Trustee is unable to put your pension into payment or has to stop your pension (if already in payment).

Updates

We may update this notice periodically. Where we do this, we will inform you of the changes and the date on which the changes take effect.

Contacting us

Please contact the Trustee for further information using the contact details below:

secretary@dnbpensionplan.co.uk

Plan Secretary
Dun & Bradstreet (UK) Pension Plan
The Point
37 North Wharf Road
London
W2 1AF

SCHEDULE

How and why we process your personal data

There are six lawful bases for processing personal data under the UK GDPR and the Trustee ("we", "us" or "our") must rely on at least one of these whenever we process your personal data. The six lawful bases are summarised below.

No	Lawful Basis	Description
1	Consent	You have consented to us processing your personal data for one or more specific purposes.
2	Contract	The processing is necessary for the performance of a contract which you are a party to, or in order to take steps at your request prior to entering into a contract.
3	Legal obligation	The processing is necessary for compliance with our legal obligations as a trustee of an occupational pension scheme.
4	Vital interests	The processing is necessary in order to protect your vital interests or those of another person (vital interests are interests that are essential for someone’s life, for example, emergency medical care).
5	Public task or official authority	The processing is necessary for the performance of a task in the public interest or so that we can exercise any official authority that we have vested in us.
6	Legitimate interest	The processing is necessary for legitimate interests pursued by us or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

Our legal grounds for processing your personal data are set out in the table below. If you have any comments or concerns about our use of your personal data (including as described below) please contact us directly via the contact details listed above.

PRIMARY USE OF YOUR PERSONAL DATA	PERSONAL DATA WE HOLD	EXAMPLE USES OF YOUR PERSONAL DATA	LAWFUL BASIS RELIED ON FOR PROCESSING
Administering and managing the Plan and the liabilities under it	Name, date of birth, sex, gender, address, telephone number, email address, national insurance number, employee and membership/reference numbers and copies of documentation verifying your identity. ("General Information") Bank account details, tax details. ("Financial Information") Information about your family and dependents, including your marital status, dependant details, next of kin, and information about your personal relationships. ("Family Information") Information used to calculate and assess eligibility for benefits, such as details of pension contributions, employment history, length of pensionable service, scheme retirement date, salary/remuneration information, investment choices, preferences regarding the distribution of death benefits, benefits accrued in, paid out or transferred to/from this (and other) pension arrangements, tax and contracting-out records. ("Benefit Information") Additional personal data that we request from you in order to action a request from you to transfer your benefits out of the Plan. ("Transfer Information") Personal data concerning your health, or the health of another who may receive benefits as a consequence of your membership or benefits in the Plan. ("Health Information") Personal data relating to criminal convictions and offences. ("Criminal Information")	To identify you and to create an accurate member record on our systems. To correspond with and answer queries from you and your advisers. To assess eligibility or continuing eligibility for benefits. To calculate, adjust, allocate and pay benefits (including benefits payable in the event of your death). To provide you with certain information which we either: are legally required to provide you with; or consider is relevant to you as a member of the Plan. To report to and liaise with HMRC and facilitate the payment of any tax due in connection with your benefits. Managing the investment of Plan funds and facilitating the investment of any money purchase pension savings you may have which are linked with the Plan (including in AVC arrangements). To assess and, if appropriate, action a request you make to transfer your benefits out of the Plan. To identify your potential benefit options and, where relevant, implement those options. To calculate and reconcile contributions paid or payable. Ensuring compliance with requirements arising from members of the Plan contracting-out of the State Second Pension. Preparation of Plan accounts, valuations and audits. The operation and maintenance of and provision of information via www.dnbpensionplan.co.uk and www.buckhrsolutions.co.uk/flex... To allow alternative ways of delivering your benefits, for example, through the use of insurance products and transfers to or mergers with other pension arrangements. To manage the Plan's liabilities, including the entering into of insurance arrangements, arranging for insurers to take over responsibility for the payment of benefits, and the selection of Plan investments. For statistical and financial modelling and reference purposes. To liaise with, or respond to orders or requests from the Pension Protection Fund; and government bodies and dispute resolution and law enforcement organisations, including the courts, the Pensions Regulator, the Pensions Ombudsman, and HMRC. To comply with our duties in respect of pensions dashboards (for further information about pensions dashboards, please refer to the Money & Pensions Service website (https://maps.org.uk/en/our-work/‌pensions)).	3 We have legal obligations to: provide you (and anyone else with an entitlement) with the correct level of benefits under the Plan; comply with tax and contracting-out legislation and deduct the correct level of tax from benefits; and manage and administer the Plan in accordance with its governing documents and applicable legislation. 6 The processing is necessary for the legitimate interests of administering and managing the Plan and the liabilities under it. Where Health Information is being processed, please refer to Note 1 below. Where Criminal Information is being processed, please refer to Note 2 below. If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, please refer to Note 3 below .
Addressing any actual or potential disputes relating to the Plan or connected with your membership or benefit entitlements under the Plan	General Information Financial Information Family Information Benefit Information Transfer Information Health Information Criminal Information	To respond to or deal with any queries, concerns and disputes which relate to the Plan, your membership of or benefit entitlements under the Plan. This shall include actual or potential disputes raised under the Plan's Internal Dispute Resolution Procedure, or with the Pensions Ombudsman or the courts.	3 We have legal obligations to: put in place and observe a formal procedure and process to investigate and decide upon disputes relating to the Plan, in respect of persons with an interest in the Plan; engage with formalities associated with proceedings brought before judicial bodies, including the Pensions Ombudsman and the courts; and comply with directions or orders of judicial bodies. 6 The processing is necessary for the legitimate interests of investigating, pursuing and/or defending, actual or potential disputes. Where Health Information is being processed, please refer to Note 1 below. Where Criminal Information is being processed, please refer to Note 2 below. If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, please refer to Note 3 below.
Liaison with current or former sponsoring employers of the Plan (including in connection with a corporate transaction)	General Information Financial Information Family Information Benefit Information Health Information Criminal Information	To correspond with the sponsoring employers of the Plan in connection with your employment, their obligations as employers, or changes to the Plan or benefits payable from the Plan. To process your personal data in connection with the sale, merger or corporate reorganisation of the employers that sponsor the Plan and their group companies.	6 Processing is necessary for the legitimate interests of: enabling sponsoring employers to comply with their obligations as employers; and addressing issues arising in relation to corporate transactions and reorganisations. Where Health Information is being processed, please refer to Note 1 below. Where Criminal Information is being processed, please refer to Note 2 below. If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, please refer to Note 3 below.

Note 1

Where Health Information is being processed for the purpose of assessing eligibility for benefits from the Plan, we will rely upon the data subject's explicit consent as the lawful condition for that processing.

Where eligibility has been assessed and Health Information is retained for our own records, we will rely upon the following lawful conditions to carry out the processing, in addition to the lawful bases specified in the table above.

The processing is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security and social protection law.
The processing is necessary for the establishment, exercise or defence of legal claims.

Note 2

Where Criminal Information is being processed, we will rely upon the following lawful conditions to carry out the processing, in addition to the lawful bases specified in the table above.

The processing is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security and social protection law.
The processing is necessary for the purposes of establishing, exercising or defending legal rights.

Note 3

If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, we will rely upon the following lawful conditions to carry out the processing, in addition to the lawful bases specified in the table above.

The processing is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security and social protection law.
The processing is necessary for the establishment, exercise or defence of legal claims.