Privacy Policy

This is our privacy policy. It tells you how we collect,use, share, store and protect personal data when you use our services, including where information is provided to us by your employer or another third party. This applies to employer representatives and business contacts as well as pension scheme members.. Please read this policy to understand how we treat your information in line with the Data Protection Act 2018 and the UK General Data Protection Regulation (‘UK GDPR’).

We may update this notice from time to time. If there are any significant changes we will notify you of these directly.

Penfold Savings Limited is the controller responsible for your personal data, and our registered address is The Ministry, 79-81 Borough Road, London SE1 1DN.

We have appointed a Data Protection Officer who oversees our compliance with data protection law. They can be contacted at DPO@getpenfold.com.

We may collect, keep and use the following data about you:

• Recorded information that you have provided us over the telephone, email, webchat service, via our app or post. This includes a record of conversations (written or spoken) that we have with you;
• Identity information, such as: name, national insurance number, date of birth, username, and any identity documents, such as passport, driving licence or selfie, if you supply them to verify your identity;
• Contact information such as: residential address, email address and telephone numbers;
• Amounts of personal pension contributions, how much you have paid into your pension, by what payment method and dates of payments;
• Amounts of pension contributions from your employer, the nature of those contributions (e.g. salary sacrifice) and whether you have opted-out or stopped contributing to your workplace pension;
• Family and beneficiaries: if you provide us with information about your family or nominated beneficiaries it’s important that they are aware that you have done this, and we will treat their information in line with this policy;
• Special category data: in limited circumstances we may collect information requiring additional protection under data protection law. This will most commonly include information about your health, for example where relevant to providing additional support or processing an ill-health benefit claim.;
• Personal circumstances and vulnerability information: information you provide, or which we identify through our interactions with you, that may help us understand whether you require additional support or adjustments.
• Financial Data, which includes bank account and payment card details, if provided by you. This also includes information about other pensions or savings you have if you supply this to use our pensions forecasting tool;
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us;
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website;
• Penfold Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;
• Usage Data includes information about how you use our website, products and services;
• Third-party data: including information provided by your employer, payroll or workplace benefit providers, other pension providers, people you have authorised to act for you, and other organisations involved in providing or administering your pension;
• Public sources: where appropriate, we may collect information about you from sources such as the Electoral Register, Companies House or information published by the press or social media, if required to verify information.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Financial crime and verification information: information obtained or generated through identity verification, fraud prevention, sanctions, screening and other financial crime checks, including information obtained from third-party screening providers and public sources.

We use information about you to:

• Sign you up as a Penfold customer and set up your Penfold account;
• Provide (and monitor and improve) our pension services to you eg. making contributions, fund choices, withdrawals, transfers, customer service, in-App services and website content;
• Perform our key pension administration services such as claiming tax relief, providing you with legal or regulatory communications, dealing with death or serious ill-health cases;
• Ensure your employer is performing their auto-enrolment obligations (e.g. making payments on time, managing opt-outs, assisting with re-enrollment);
• Send you communications we think may be of interest to you or enable you to get full value from your Penfold pension e.g. newsletters, emails;
• Ensure our compliance with key regulatory obligations such as ensuring that we know our customers and prevent financial crime, or other criminal or legal breaches;
• Identify and support customers who may be vulnerable or require additional support, and make appropriate adjustments to how we communicate with or provide services to them.;
• Ensure that our key partners (who are essential to enable us to provide you with a pension service) can carry out their jobs. This includes:
  • our staff in Estonia (employed by Penfold Technologies OU) that assist with the administration of your pension;
  • our identity verification and financial crime screening providers;
  • cloud-server and IT providers);
  • payment processing providers;
  • employers and relevant workplace pension partners.
• Ensure that we have effective risk management and audit arrangements. This means we may share some of your information with professional audit or legal advisers;
• Share with anyone who you have given us permission to share it with e.g. persons who we partner with and may provide financial services to customers, people who you have asked to represent you, like solicitors, financial advisers or relatives;
• We may also share information where required or permitted by law, including with regulators, HMRC and law enforcement authorities.

Where we use service providers to process personal data on our behalf, we require appropriate data protection and security arrangements.

We will normally only use your personal data for the purposes described in this notice. If we need to use it for another purpose, we will only do so where permitted by data protection law and will tell you where required.

Some of the personal information we ask you to provide is necessary for us to set up and administer your pension or meet our legal and regulatory obligations. If you do not provide information we reasonably require, we may be unable to provide some services or, in some circumstances, continue to operate your account.

Data protection law requires us to have a lawful basis for using your personal data. The main legal bases we rely on are set out below.

Legal Grounds: Consent

Your consent must be freely given, informed, specific, unambiguous and by a positive action by you.

Use of your information: Pension account information

Where you ask us to share information with someone acting on your behalf, such as a financial adviser, solicitor or family member, we may ask you to provide appropriate authority before we do so.

Legal Grounds: Necessary for the Performance of a Contract

Personal data that you provide may be used by us when it’s necessary to enter into or perform the contract.

Use of your information: Setting up and operating your Penfold pension

This covers the following, and may involve the transfer of your information to a third-party if it’s necessary for us to perform our contract with you:

• Processing your application and setting up your pension;
• Making and receiving payments;
• Managing changes of personal details eg. address, bank account;
• Responding to your communications or complaints;
• Giving effect to your fund choices;
• Managing cancellation, transfer or withdrawal requests;
• Ensuring the security and integrity of your Penfold account (including the IT infrastructure that enables us to provide our service);
• Processing an ill health or death benefit claim;
• Arranging for tax relief;
• Notifying you of changes to our terms and conditions or other policies; and
• Administering your pension, in any way that is not caught above.

Legal Grounds: To Comply with a Legal Obligation

We use your personal data where necessary to comply with our legal and regulatory obligations, including::

• Verifying your identity, residence and tax status to comply with laws on taxation and the prevention of financial crime, terrorist financing and sanctions compliance;
• Providing you with necessary legal and regulatory communications;
• Providing regulators and HMRC with mandatory returns or information;
• Complying with our regulatory or legal obligations as set out by such bodies as HMRC, the Financial Conduct Authority or The Pensions Regulator;
• Complying with court orders or requests for information from law-enforcement agencies, such as the police;
• To comply with our responsibilities to prevent and detect financial crime.

Legal Grounds: Necessary for Legitimate Interests

We use your information when we have a ‘legitimate interest’, and this interest is not outweighed by your privacy rights. Whenever we use this legal ground we balance the legitimate interest (either ours or another’s) against your reasonable expectations about how we use your data.

Use of your personal data: Use data analytics on customer use of our website or App.

Legitimate interests: Ensuring the security and integrity of our website or App (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data;

Legitimate interests: Maintaining up-to-date and correct records for the purpose of audits, risk-management and financial stability of Penfold;

Use of your personal data: We may contact you to research our products or services, or invite you to take part in a competition. You will receive marketing communications from us if you have requested information from us or opened an account with us and you have not opted out of receiving that marketing.

Legitimate interests: To ensure that we offer relevant and effective products or services that our customers can engage with, to grow our business, develop our brand and ensure good communication with customers.

Use of your personal data: Use data analytics on your use of our website or App to improve our website, products/services, marketing, customer relationships and experiences

Legitimate interests: To study how customers use our products/services, to develop them and make them more effective, to ensure appropriate targeting of customers, to grow our business and to inform our marketing strategy.

Use of your personal data: Where you have been introduced to Penfold through a financial adviser or other referral partner, we may share relevant information with that partner about your Penfold pension and activity, where appropriate in connection with the services they provide to you or their relationship with you.

Legitimate interests: To support our relationships with referral partners, enable them to provide relevant services to their customers, and help us understand and improve how these arrangements work for customers.

Use of personal data: We may use business contact information, including names, work email addresses and publicly available professional information, to manage relationships with employers, identify potential business opportunities and facilitate introductions to prospective employer customers. This may involve using third-party service providers to identify relevant professional connections.

Legitimate interests: To develop our business, maintain employer relationships and identify prospective business customers through relevant professional networks.

Special Category Information

Where we use special category personal data, such as information about your health, we will only do so where an additional condition under data protection law allows us to, including where necessary to safeguard the economic well-being of an individual at economic risk.

Where relevant, for example when considering an ill-health benefit claim, we may ask you to provide medical information or, with your authority, obtain relevant information from your GP or another medical professional.

If you have any requests concerning your personal data or any queries with regard to this notice, please contact us through the Contact Us section of our Website.

We are registered with the Information Commissioner’s Office (ICO); our Registration number: ZA505781.

Information on the Data Protection Act 2018 and the General Data Protection Regulation (the GDPR) is also available on the Information Commissioner’s website at https://ico.org.uk/.

Under UK data protection law, your individual rights in relation to your personal data are as follows:

• the right to be informed about the personal data being processed,
• the right of access to the data,
• the right to rectification,
• the right to erasure,
• the right to restrict processing,
• the right to data portability (to receive electronic copy of your personal data),
• the right to object to processing of your personal data, and
• the right not to be subject to automated decision-making, including profiling.

To make use of your rights please contact us via hello@getpenfold.com. If you are unhappy with how we have handled your personal data, you can make a complaint to the Information Commission (ICO) via Make a complaint | ICO

How Do We Secure Your Personal Data?

We have robust procedures in place within our business:

• to protect data against accidental loss,
• to prevent unauthorised access, use, destruction or disclosure,
• to ensure business continuity and disaster recovery where required,
• to restrict access to personal information,
• to conduct data protection impact assessments where required,
• to train staff and contractors on data security, and
• to manage third party risks, through use of contracts and security reviews.

How Long Do We Keep Personal Data?

We will keep your personal data only for so long as we need to do so, depending upon the nature of the data and our processing, and the grounds upon which we collected it. Your personal data will be deleted if we no longer need it

But, even if you are no longer a Penfold customer, we are obliged to keep certain records of our relationship to comply with rules set out by the Financial Conduct Authority or The Pensions Regulator or for legitimate business purposes. For example some information about pension transfers must be kept indefinitely; we must keep records of opt-outs from workplace pensions for at least 4 years, and, generally, keep your personal details for up to 6 years, once our relationship has ended.

Information we use for marketing purposes will be kept by us until you notify us that you no longer wish to receive this information. If you do notify us that you no longer wish to receive marketing information, we will keep an encrypted version of your contact information to ensure we respect your wishes.

A cookie is a small piece of data (text file) that a website asks your browser to store on your device when you visit it. This helps us remember information about you, such as your language preference or login information. We use a number of different cookies on our site. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.

For more information about the cookies we use, please see our cookie policy.