Privacy Policy

MORRISONS RETIREMENT SAVER PLAN (THE “SCHEME”)

Personal information and what we do with it

This data privacy notice explains how your personal information is processed in connection with the Scheme by Wm Morrisons Pension Trustee Limited (the “Trustee”, “we” or “us”). The Trustee of the Scheme needs personal information about you to run the Scheme and pay benefits.

In legal terms, the Trustee is a ‘data controller’ in respect of this information. This means that we need to tell you some things about the personal information we have about you and what your rights are in relation to it.

The Trustee takes your privacy seriously. We are committed to complying with the UK General Data Protection Regulation (“GDPR”) and all other applicable data protection and privacy laws to ensure we properly protect your personal information (i.e. information that relates to you).

We will be the Controller of your personal information (as we are responsible for how your personal information is used) together with some third parties who assist us with the Scheme. The Scheme Actuary (currently Leanne Johnston of Mercer Limited) is also a ‘data controller’ and a Fair Processing Notice is available from the Scheme Actuary upon request (see details at the end of this notice). The Scheme administrator who processes data on behalf of the Trustee for both the Morrisons 1967 Section and the RSP Section is Aptia UK Limited.

Please take the time to read this privacy notice as it explains how we collect, use and store your personal information, and the rights you have in relation to the protection of your personal information (further information on your rights is included below).

If, at any time, you have any concerns about how your personal information is being processed by us, please let the Trustee know – you can find the contact details at the end of this notice.

In this notice, you will see information about what the Trustee does with your personal information. We also describe who to contact if you wish to exercise your rights under data protection laws in relation to the use we make of your information.

What personal information we have

We normally hold some or all of the following types of personal information:

• Your name, date of birth, national insurance number and bank account information (where benefits are in payment).
• Contact details (including your address, phone number and email address).
• If your benefits from the Scheme derive from your employment, details of your employer when you were building up benefits in the Scheme, how long you worked for them and your salary from time to time.
• Whether you are married or in a civil partnership and other information we might need to pay any benefits due on your death.
• Any information you have provided about who you would like to receive any benefits due on your death.
• If your benefits from the Scheme form part of a divorce settlement, details of that settlement.
• We may sometimes use other information about you. This could include information about your health where it is relevant to, for example, early payment of benefits from the Scheme, or details about personal relationships to determine who should receive benefits on your death. We might also, very rarely, have information about criminal convictions and offences, but only where it is relevant to the payment of Scheme benefits.

Some of the information we collect or receive is classed as a special category of personal data. These types of personal information are more sensitive, for example, concerning your health, racial or ethnic origin or sexual orientation. If the Trustee asks you for other personal information in the future (for example, about your health), it will explain whether you have a choice about providing it and the consequences of not providing it. Where your consent is required, you may withdraw your consent at any time.

Where we get personal information from

Some of the information we have comes directly from you. In addition, Aptia UK Limited, who administers the Scheme on behalf of the Trustee, may have obtained information from you and passed it to the Trustee.

Where you provide information about third parties such as your spouse, civil partner, co-habitee and/or children (for example, when completing or updating an expression of wish form / death benefit nomination form), you should inform the relevant person that you are doing this and share a copy of this notice with them so that they also understand how this information is processed.

Sometimes we get information from other sources: for example, from your Scheme employer (for information such as your salary and length of service); from another scheme if you have transferred benefits from that scheme; from government departments such as HMRC and DWP; and from publicly accessible sources (e.g. the electoral roll) if we have lost touch with you and are trying to find you. We may in turn pass this to other data controllers (such as the Scheme Actuary). 2 22 January 2024charlotte hartley-seale (nee surblys-seale)

Why we hold personal information and how we share it

We must by law provide benefits in accordance with the Scheme’s governing documentation and must also meet other legal requirements in relation to the running of the Scheme.

We will use your personal information to comply with these legal obligations, to establish and defend its legal rights, and to prevent and detect crimes such as fraud. We may need to share your personal information with other people for this reason, such as courts and law enforcement agencies.

We also have a legitimate interest in properly administering the Scheme. This includes (but is not limited to): paying benefits as they fall due; checking your identity to comply with the Trustee’s legal and regulatory requirements; purchasing insurance contracts; communicating with you; and ensuring that correct levels of contributions are paid, benefits are correctly calculated and the expected standards of Scheme governance are met (including standards set out in Pensions Regulator guidance).

In order to achieve this, we may share your personal information with various people, including: any new trustees or trustee directors; the Scheme employers; the Scheme administrators; the Trustee’s other professional advisers; the Scheme Actuary; auditors; insurers; HMRC; the Pensions Ombudsman; and IT and data storage providers and other service providers. If your benefits are transferred to another scheme, we will also need to provide the administrators of that scheme with information about you.

The Trustee does not generally rely on your consent as the legal basis for processing your personal information. When we need to use information about your health (or other very personal information), we may ask for your consent. However, sometimes there may be reasons of public interest or law which enable us to use this information without consent, and we will do so where that is necessary to run the Scheme in a sensible way. You can withdraw your consent at any time by contacting us using the contact details given below. This may affect what we can do for you, unless we have another lawful reason for using your information.

We may also share your personal information with someone else where you have given your consent – for example, where you transfer your benefits out of the Scheme.

The Scheme employers hold personal data to comply with their legal obligations as sponsoring employers of the Scheme and to provide support in respect of the Scheme. The employers have a legitimate interest in the Scheme being run in a cost-effective way and may have an interest in offering certain options to Members. The Trustee may share your personal information with the Scheme employers for these legitimate purposes including: for employment administration purposes, payroll purposes, in connection with business audits, compliance with law, and to enable the employers to provide you with information about any additional options which may be available to you in relation to your Scheme benefits.

Scheme Actuary

The Scheme Actuary is appointed by the Trustee to value the Scheme benefits and carry out other calculations in relation to your Scheme benefits. She will use your personal information for this purpose and has a legitimate interest in doing so. The Scheme Actuary will also use your personal information to comply with her own legal obligations, and may need to share your details with other people for legal reasons, such as courts and law enforcement agencies. She may also share it with her own professional advisers, auditors and insurers, IT and data storage providers and other service providers. A Fair Processing Notice setting out when, why and how the Scheme Actuary collects and uses your personal data in carrying out her duties is available on request from the Mercer Limited address provided at the bottom of this notice.

How to contact the other people we give your personal information to

Some of the people mentioned above just use your personal information in the way we tell them. However, others may make their own decisions about the way they use this information to provide their services, perform their functions, or comply with their regulatory requirements. In such a case, they have responsibilities as data controllers in their own right. This means that they are subject to the same legal obligations as us in relation to your information, and the rights you have in relation to your information apply to them, too.

If you want any more information from any of the people who receive your personal information from the Trustee, or to exercise any rights in relation to the information they hold, please contact the Trustee [or our administrator Aptia] using the contact details set out below.

How long we keep your personal information for

We need to keep some of your personal information long enough to make sure that we can satisfy our legal obligations in relation to the Scheme and pay any benefits due to or in respect of you.

We keep your personal information for long enough to ensure that, if a query arises in the future about your benefits, we have enough information to deal with it. The majority of the personal information that we hold will be retained for such period as is reasonably necessary for the proper running and administration of the Scheme and the performance of the Trustee’s legal obligations and the pursuit of its legitimate interests. The Trustee’s current retention policy is that personal information will be retained by the Scheme for so long as you are entitled or may become entitled to benefits under the Scheme, and, because trustees of pension schemes can commonly face 3 22 January 2024charlotte hartley-seale (nee surblys-seale)

complaints or questions from members, former members, other individuals or regulatory authorities many years after a member / beneficiary has ceased to be entitled or prospectively entitled to benefits, some personal information may need to be kept indefinitely. However, the Trustee will not retain personal information for longer than is necessary having regard to the purpose for which it is held. The Trustee will keep this data retention policy subject to review and may update it from time to time to ensure it remains appropriate.

Your rights in relation to your personal information

You have rights in relation to the personal information we have about you. You have the right to:

• make a request to have your personal information corrected if it is inaccurate, and completed if it is incomplete;
• in particular circumstances, restrict the processing of your information;
• in particular circumstances, ask to have your information erased;
• request access to your information and to obtain information about how we process it;
• in particular circumstances, move, copy or transfer your information;
• in particular circumstances, object to us processing your information;
• not be subject to automated decision-making including profiling where it produces legal or other significant effects on you.

You can exercise all of these rights free of charge except in some very limited circumstances, and we will explain these to you where they are relevant.

To exercise these rights, please use the Scheme administrator contact details, which are set out below. The Scheme administrator can also supply more information about these rights to you, on request.

If you wish to exercise your rights against the other advisers in relation to the Scheme who are data controllers (such as the Scheme Actuary) for what they do jointly with your personal information, you should contact the Trustee and we will be able to put you in touch with them.

Keeping your information safe

It is the Trustee’s policy to protect your right to privacy and it will ensure that adequate technical and security measures, confidentiality obligations and compliance procedures are at all times in place to prevent inappropriate access to, alteration or deletion of personal information. While no measure is impenetrable, we do our best to ensure your personal information remains safe.

When we pass your information to a third party, we seek to ensure that they have appropriate security measures in place to keep your information safe and to comply with general principles in relation to data protection.

Some of the people we share your information with may process it overseas. This means that your personal information may on occasion be transferred outside the UK and the European Economic Area. Some countries already provide adequate legal protection for your personal information, but in other countries, additional steps will need to be taken to protect it.

You can contact us for more information about the safeguards we use to ensure that your personal information is adequately protected in these circumstances (including how to obtain copies of this information).

Queries and further information

If you want more information about what we do with your information and what your rights are, please contact:

Scheme Administrator

Aptia UK Limited
40-B, Tower 42
25 Old Broad Street
London
EC2N 1HQ

Scheme Actuary

If you would like to contact the Scheme Actuary for a copy of her Fair Processing Notice setting out when, why and how the Scheme Actuary collects and uses your personal data in carrying out her duties, a copy is available on request from:

Leanne Johnston
Mercer Limited
1 Tower Place West
Tower Place
London 4
EC3R 5BU

Information Commissioner’s Office

If you have concerns about the way we handle your personal information, you can contact the Information Commissioner’s Office or raise a complaint at www.ico.org.uk/concerns, or call its helpline on 0303 123 1113.

Changes to this notice

Any changes we make to this notice in the future will be available on request from Aptia UK Limited [and an up-to-date version will be available on the Scheme’s website which can be accessed here. Please check for any changes if you are using a printed copy of this notice.

Date: 20 February 2024

Issued by WM Morrisons Pension Trustee Limited (the Trustee of the Scheme)