Privacy Policy

BESTrustees Limited, as Trustee of the ZF UK Pension Plan ("we", "us" or "our"), take privacy and our use of your data seriously and acknowledge the importance of protecting personal information – that is, any information from which a person can be identified, such as names or contact details ("Personal Information").

This Policy sets out how we process Personal Information collected by us when you visit our website, together with other Personal Information you may provide to us or which we acquire through our day-to-day business. For the purposes of the Data Protection Laws (as defined below) we will, ordinarily, hold your Personal Information as a data controller. Please note that we also have a specific policy that applies to members of the ZF UK Pension Plan. If you are a member of the ZF UK Pension Plan, you can contact us to request a copy.

We endeavour to process your Personal Information in accordance with applicable data protection laws, including the UK Data Protection Act 2018, the UK General Data Protection Regulation, the EU General Data Protection Regulation, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case as applicable and including any legally binding regulations, direction and orders issued from time to time under or in connection with any such law (the "Data Protection Laws").

1. Use of your Personal Information

Most commonly, we may process the following Personal Information about you:

• information you provide directly to us when you engage with us, for example, when you complete a form, make an enquiry, enter into a contract with us or prepare to enter into a contract with us (e.g. your name, location, contact details and details of your enquiry);
• if you provide services to us or have a business dealing with us (or are employed or engaged by an entity which provides services or has a business dealing with us), we may acquire certain contact details and employment information;
• if you submit a find request via a pensions dashboard, information that is provided to us when you submit the find request (e.g. your name and contact details), and information that we generate in response to a find request (e.g. your unique pensions identifier), irrespective of whether or not you are a member of a ZF UK Pension Plan; and/or
• a record of any correspondence between us (e.g. emails).

Where you make use of our website, we may collect information about your use of the website (e.g. your IP address). Please see our Cookies Policy for further details.

We may also receive information from third parties who collect Personal Information from you and pass it on to us. Where this is the case, the third party is responsible for informing you that your Personal Information may be transferred to us.

2. How we use your Personal Information

We will only process your Personal Information in accordance with Data Protection Laws and where we have a legal basis for doing so. Our processing of your Personal Information is based on one of the following legal bases:

• the processing is necessary for our legitimate interests or the legitimate interests of a third party, provided that these interests are not outweighed by your rights and freedoms. Our legitimate interests include the carrying out and improving of our business;
• we have your express consent to the processing;
• the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract; and/or
• the processing is necessary for compliance with any legal obligations to which we are subject, including our obligations in respect of pensions dashboards.

We will generally process your Personal Information for one or more of the following purposes:

• to respond to any requests that you make of us, including by completing online forms or requesting information from us;
• to perform any agreement that we have with you or your employer, or to enter into an agreement with you or your employer;
• to provide our services and communicate with you in respect of our services;
• for our internal business purposes, including record keeping; and/or
• to comply with our legal obligations.

Where we need the Personal Information to comply with our legal or contractual obligations, the provision of such Personal Information is mandatory; if it is not provided, we will not be able to meet obligations placed on us. Otherwise, the provision of Personal Information is not mandatory but, if we do not receive it, we may not be able to respond to your request, enter into a contract with you or your employer or otherwise engage with you.

3. How we keep your Personal Information safe

We implement technical and organisational measures to safeguard your Personal Information. Unfortunately, the transmission of information via the internet is not completely secure and, although we will take steps to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted via the website.

4. How long will we store your Personal Information?

We will only keep your Personal Information for as long as we reasonably require (including to comply with the requirements of applicable laws) and, in any event, only for as long as Data Protection Laws and our own internal rules and policies allow.

5. Sharing your Personal Information

We may share your Personal Information with certain third parties who reasonably need it in order to perform a function for you or the business which you represent, or to provide a service to us (such as our third party service providers, appointed representatives and professional advisors). In addition, it may be necessary to disclose your Personal Information if we are under a duty to do so to comply with our legal obligations (such as our obligation to respond to a find request that you submit via a pensions dashboard). Personal Information may also be shared with government authorities, law enforcement agencies, courts and/or similar bodies, for example to enforce our rights under any agreement that we have with you or your employer.

We do not anticipate that we will transfer, store or process your Personal Information in locations outside the UK and/or the European Economic Area (EEA). If we need to transfer your Personal Information to a third party outside the UK or EEA, we will only transfer the Personal Information where: (i) that third party is situated in a country that has been confirmed to provide adequate protection to Personal Information; (ii) that third party has agreed (by way of written contract or by some other form of approved data transfer mechanism) to provide all protections to Personal Information as required by the Data Protection Laws and we have undertaken a transfer risk assessment in respect of the transfer (as required); or (iii) we have your explicit consent to do so (such as where you have requested us to make the transfer). You can request more information about the safeguards for transfers by contacting us.

6. Your rights

You have certain rights in relation to your Personal Information under the Data Protection Laws, including rights to (subject to certain exemptions):

• request access to, and rectification or erasure of, the Personal Information that we hold about you;
• restrict our processing of your Personal Information in certain circumstances;
• object to our processing of your Personal Information in certain circumstances; and
• in some cases, ask us to transfer any Personal Information that we hold about you to you or to a specified third party, in a format that can be read by a computer.

Where we process your Personal Information on the legal basis of consent, you have the right to withdraw consent to our processing at any time. This does not affect the lawfulness of processing based on your consent before it is withdrawn.

Please note that these rights may be limited (e.g. if fulfilling your request to access your Personal Information would reveal Personal Information about another person, or if you ask us to delete Personal Information which we are required by law to keep).

If you wish to exercise any of these rights, or if you have any complaints about how we use your Personal Information, please contact us. Alternatively, you have the right to make a complaint to the Information Commissioner's Office, which is the supervisory body in the UK.

We may amend this Policy at any time, with any updates being posted on our website. You should therefore check this page to ensure that you are aware of any changes.