
Valid from 23 June 2025
This privacy notice is for members and beneficiaries of the Plan. It has been prepared by Dun & Bradstreet (UK) Pension Plan Trustee Company Limited (“Trustee”, or “we”) in its capacity as trustee of the Plan.
The Trustee is registered as a controller of personal data with the Information Commissioner’s Office ("ICO").
This notice will also be made available on the Plan's website www.dnbpensionplan.co.uk/
This privacy notice replaces the previous version of this privacy notice that was made on 15 May 2018 and supplements any other notices and statements we issue that are specific to particular data collection / processing activities.
Why we are providing this notice to you
As the trustee of the Plan we hold certain information about you and from which you can be identified (either from the information itself or with other information that we may hold) ("personal data"). In line with the transparency requirements of applicable data protection laws, we are required to give you specified information about the personal data we hold about you, how we use it, and the safeguards that are in place to protect it. This notice is designed to give you that information.
Why we process your personal data
The Trustee processes personal data about you, in its role as controller, for the proper handling of all matters relating to the Plan, including its administration and management, calculating, securing and paying benefits and managing liabilities in relation to it.
Details regarding how and why we process your personal data and the legal bases relied on by the Trustee when carrying out this processing are set out in the Schedule. The Schedule also provides information concerning the conditions that we rely upon when processing "special categories" of particularly sensitive personal data (including personal data concerning health).
What personal data we hold and how we obtain it
Please refer to the Schedule for information concerning the types of personal data we hold and process about you.
We obtain some of this personal data directly from you. We may also obtain data from your current or past employer(s) or companies that succeeded them in business (for example salary information), from a member of the Plan (where you are or could be a beneficiary of the Plan as a consequence of that person's membership), and from a variety of other sources including data tracing agencies, public databases, our advisers, additional voluntary contribution (AVC) arrangement providers, and government or regulatory bodies.
Where you have provided us with personal data about other individuals, such as family members, dependants or potential beneficiaries under the Plan, please ensure that those individuals are aware of the information contained within this notice.
How we will use your personal data
We may use this data to deal with all matters relating to the Plan, including its administration and management. For further information, please refer to the Schedule.
Organisations that we may share your personal data with
From time to time, we will share your personal data with our advisers and service providers so that they can help us carry out our duties, rights and discretions in relation to the Plan.
These include the following advisers and service providers.
In some instances, advisers and service providers will be controllers in their own right and will be directly responsible to you for their use of your personal data. They may be obliged under the data protection laws to provide you with additional information regarding the personal data that they hold about you and how and why they process that data. Further information may be provided to you in a separate notice or may be obtained from the advisers and service providers directly, for example, via their websites. Whenever one of our advisers or service providers acts as a joint controller with us in respect of your personal data, because we jointly determine the purposes and means of processing it, we will agree with them how we are each going to meet our respective and collective obligations under the data protection laws. If you would like more information about how such an arrangement works, please contact us using the contact details below.
We may also provide some of your data to the Plan's sponsoring employer Dun & Bradstreet and group companies of the employers, the advisers and potential purchasers of the businesses.
In addition, where we make investments or seek to provide benefits for Plan members and other beneficiaries in other ways, such as through the use of insurance or pension scheme mergers, then we may need to share personal data with providers of investments, insurers and other pension scheme operators.
The advisers, service providers and organisations referred to in the paragraphs above may use personal data to perform their functions as well as for statistical and financial modelling (such as calculating expected average benefit costs and mortality rates) and planning, business administration and regulatory purposes. They may also pass the data to other third parties (for example, insurers may pass personal data to other insurance companies for the purpose of obtaining reinsurance), to the extent they consider it appropriate to do so.
Where requested or if we consider that it is reasonably required, we may also provide your personal data to:
They may then use the data to carry out their functions.
Transferring personal data outside the UK
In some cases, recipients of your personal data may be outside the UK. This may include the Plan's sponsoring employer and in each case, their professional advisors, as applicable. It may also include affiliates / overseas offices of the Plan's service providers, including Gallagher and Willis Towers Watson. This means your personal data may be transferred outside the UK to a jurisdiction that may not offer an equivalent level of protection as is provided in the UK.
Additional safeguards are in place to protect your personal data when it is transferred outside the UK as we ensure that at least one of the following measures is relied on:
Please contact the Trustee using the contact details below, if you require further information about the safeguards that have been adopted or would like to request (free of charge) a copy of the standard contractual clauses that we use in relation to the processing of your personal data.
How long we keep your personal data
We will only keep your personal data for as long as we need to in order to fulfil the purposes identified above and detailed further in the Schedule. In practice this means that we will retain your data for such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Plan and for so long afterwards as may be required to deal with any questions, complaints or claims that we may receive about our administration of the Plan. We may also retain your data for a longer period to comply with our legal and regulatory obligations.
Your rights
You have a right to access and obtain a copy of the personal data that the Trustee holds about you, and to ask the Trustee to correct your personal data if there are any errors or it is out of date or incomplete.
You have a right to ask the Trustee to erase your personal data where it is being processed on a legal ground other than for complying with a legal obligation and where:
In some cases, you may also have a right to request that the processing of your personal data be restricted or to transfer your personal data (for example, to another pension scheme).
In certain circumstances, you also have the right to object to the processing of your personal data, for example:
Where we rely upon your consent to lawfully process your personal data, including explicit consent, you have the right to withdraw your consent to the processing at any time by notifying the Trustee in writing. Withdrawal of consent will not affect the lawfulness of processing based on your consent before it is withdrawn.
You can obtain further information about these rights from the ICO at: www.ico.org.uk or via its telephone helpline (0303 123 1113).
If you wish to exercise any of these rights or have any queries or concerns regarding the processing of your personal data, please contact the Trustee using the contact details provided below. You can also lodge a complaint in relation to this privacy notice or the Trustee's processing activities with the ICO - you can do this via the ICO's website or telephone helpline.
As explained in this privacy notice, one of the reasons we collect and hold your personal data is to administer your Plan benefits. If you do not provide the information we request, withdraw your consent to the processing, or ask that the personal data we already hold is deleted or that the processing of the personal data be restricted, this may affect our ability to administer your benefits, including the payment of benefits from the Plan. In some cases it could mean the Trustee is unable to put your pension into payment or has to stop your pension (if already in payment).
Updates
We may update this notice periodically. Where we do this, we will inform you of the changes and the date on which the changes take effect.
Contacting us
Please contact the Trustee for further information using the contact details below:
secretary@dnbpensionplan.co.uk
Plan Secretary
Dun & Bradstreet (UK) Pension Plan
The Point
37 North Wharf Road
London
W2 1AF
SCHEDULE
How and why we process your personal data
There are six lawful bases for processing personal data under the UK GDPR and the Trustee ("we", "us" or "our") must rely on at least one of these whenever we process your personal data. The six lawful bases are summarised below.
No |
Lawful Basis |
Description |
1 |
Consent |
You have consented to us processing your personal data for one or more specific purposes. |
2 |
Contract |
The processing is necessary for the performance of a contract which you are a party to, or in order to take steps at your request prior to entering into a contract. |
3 |
Legal obligation |
The processing is necessary for compliance with our legal obligations as a trustee of an occupational pension scheme. |
4 |
Vital interests |
The processing is necessary in order to protect your vital interests or those of another person (vital interests are interests that are essential for someone’s life, for example, emergency medical care). |
5 |
Public task or official authority |
The processing is necessary for the performance of a task in the public interest or so that we can exercise any official authority that we have vested in us. |
6 |
Legitimate interest |
The processing is necessary for legitimate interests pursued by us or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests. |
Our legal grounds for processing your personal data are set out in the table below. If you have any comments or concerns about our use of your personal data (including as described below) please contact us directly via the contact details listed above.
PRIMARY USE OF YOUR PERSONAL DATA |
PERSONAL DATA WE HOLD |
EXAMPLE USES OF YOUR PERSONAL DATA |
LAWFUL BASIS RELIED ON FOR PROCESSING |
Administering and managing the Plan and the liabilities under it |
Name, date of birth, sex, gender, address, telephone number, email address, national insurance number, employee and membership/reference numbers and copies of documentation verifying your identity. ("General Information") Bank account details, tax details. ("Financial Information") Information about your family and dependents, including your marital status, dependant details, next of kin, and information about your personal relationships. ("Family Information") Information used to calculate and assess eligibility for benefits, such as details of pension contributions, employment history, length of pensionable service, scheme retirement date, salary/remuneration information, investment choices, preferences regarding the distribution of death benefits, benefits accrued in, paid out or transferred to/from this (and other) pension arrangements, tax and contracting-out records. ("Benefit Information") Additional personal data that we request from you in order to action a request from you to transfer your benefits out of the Plan. ("Transfer Information") Personal data concerning your health, or the health of another who may receive benefits as a consequence of your membership or benefits in the Plan. ("Health Information") Personal data relating to criminal convictions and offences. ("Criminal Information") |
|
3 We have legal obligations to:
6 The processing is necessary for the legitimate interests of administering and managing the Plan and the liabilities under it. Where Health Information is being processed, please refer to Note 1 below. Where Criminal Information is being processed, please refer to Note 2 below. If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, please refer to Note 3 below . |
Addressing any actual or potential disputes relating to the Plan or connected with your membership or benefit entitlements under the Plan |
|
To respond to or deal with any queries, concerns and disputes which relate to the Plan, your membership of or benefit entitlements under the Plan. This shall include actual or potential disputes raised under the Plan's Internal Dispute Resolution Procedure, or with the Pensions Ombudsman or the courts. |
3 We have legal obligations to:
6 The processing is necessary for the legitimate interests of investigating, pursuing and/or defending, actual or potential disputes. Where Health Information is being processed, please refer to Note 1 below. Where Criminal Information is being processed, please refer to Note 2 below. If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, please refer to Note 3 below. |
Liaison with current or former sponsoring employers of the Plan (including in connection with a corporate transaction) |
|
To correspond with the sponsoring employers of the Plan in connection with your employment, their obligations as employers, or changes to the Plan or benefits payable from the Plan. To process your personal data in connection with the sale, merger or corporate reorganisation of the employers that sponsor the Plan and their group companies. |
6 Processing is necessary for the legitimate interests of:
Where Health Information is being processed, please refer to Note 1 below. Where Criminal Information is being processed, please refer to Note 2 below. If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, please refer to Note 3 below. |
Note 1
Where Health Information is being processed for the purpose of assessing eligibility for benefits from the Plan, we will rely upon the data subject's explicit consent as the lawful condition for that processing.
Where eligibility has been assessed and Health Information is retained for our own records, we will rely upon the following lawful conditions to carry out the processing, in addition to the lawful bases specified in the table above.
Note 2
Where Criminal Information is being processed, we will rely upon the following lawful conditions to carry out the processing, in addition to the lawful bases specified in the table above.
Note 3
If and to the extent that we are processing personal data regarding a spouse, civil partner or partner and this personal data also reveals an individual’s sexual orientation, we will rely upon the following lawful conditions to carry out the processing, in addition to the lawful bases specified in the table above.