Privacy policy

Aon UK Limited provides services and products in relation to your employment and membership of your pension scheme and we are committed to protecting your privacy. This commitment reflects the value we place on earning and keeping the trust of our customers, business partners, and others who share their personal information with us.

What does this Privacy Notice do?

This Privacy Notice ("Notice") explains Aon UK Limited’s information processing practices. It applies to any personal information you provide to us and any personal information we collect from other sources. This Notice is a statement of our practices and of your rights regarding your personal information. This is not a contractual document, and it does not create any rights or obligations on either party, beyond those which already exist under data protection laws.

This Notice does not apply to your use of a third party site linked to this website.

Who is responsible for your information?

Throughout this Notice, "Aon" refers to Aon UK Limited including its affiliated companies and subsidiaries (also referred to as "we", "us", or "our"). Aon is responsible for your personal information (and is a controller for the purposes of data protection laws) that we collect from or about you.

When and how do we collect your information?

We collect personal information in the following ways:

• When we perform services for our clients, which may include your employer or former employer and the pension trustees. We may collect information from you, your employer or its service providers (such as payroll processors).
• When you register with or use the Aon Retirement Service website, including third party sites linked to this website.
• When you provide updated information to us or our service providers (eg by telephone or post).
• If you contact us with a complaint or query.

What information do we collect?

Information you provide to us

When we provide the Aon Retirement Service website, we may collect personal information such as:

• Basic personal data: including name, address, postcode, contact details;
• Unique identifiers: such as National Insurance Number or pension scheme reference number;
• Demographic information: such as date of birth, age, gender, marital status;
• Employment information such as date of hire, employment status, pay history, tax withholding information, date of termination;
• Benefits programme participation and cover information: such as benefit elections, pension entitlement information, beneficiary information, claims information, benefit plan account balances or accrued benefits, date of retirement and any relevant matters impacting your benefits such as voluntary contributions, pensions sharing orders, tax protections or other adjustments;
• Financial information: such as salary, tax code, third party deductions, bonus payments, benefits and entitlement data, national insurance contributions details;
• Assets & borrowings information: where you provide details and values or estimated values of any assets and/or borrowings you have in order for those details to be reflected in your personal financial position presented to you;
• Sensitive personal information such as medical information: such as in relation to life, health, or employee benefits programs sponsored by your employer; and where necessary in relation to ill-health early retirement and ill-health reviews to determine the benefits paid to you;

More information about the personal information collected, together with the purpose and legal basis for collecting the information is provided below.

We will not collect any sensitive personal information unless this is required. Sensitive personal information includes a number of types of data relating to: race or ethnic origin; political opinions; religious or other similar beliefs; trade union membership; physical or mental health; sexual life. If you provide us with sensitive personal information, you understand and give your explicit consent that we may collect, use and disclose this information to appropriate third parties for the purposes described in this Notice.

If you provide personal information about other individuals such as dependants, you must obtain their consent prior to your disclosure to us.

Information we collect over the Aon Retirement Service website

For purposes of this Notice, "website" includes our mobile applications.

We may ask you for some or all of the following types of information when you register on the Aon Retirement Service website, request services, manage your account, or access various content and features. This includes, but is not limited to:

• Contact information, such as name, e-mail address, postal address, phone number and mobile number;
• User name, password, password reminder questions and password answers;
• Communication preferences, such as which newsletters you would like to receive;

In some instances, we automatically collect certain types of information when you visit our websites and through e-mails that we may exchange. Automated technologies may include the use of web server logs to collect IP addresses, "cookies" and web beacons. Further information about our use of cookies can be found in our Cookie Notice.

Mobile Devices

If you access our website on your mobile telephone or mobile device, we may also collect your unique device identifier and mobile device IP address, as well as information about your device's operating system, mobile carrier and your location information. We may also ask you to consent to providing your mobile phone number (for example, so that we can send you SMS notifications).

How do we use your personal information?

The following is a summary of the purposes for which we use personal information. More information about the personal information collected for each of our services, together with the purpose and legal basis for collecting the information will be provided to you below.

1. Provision of website: to make the Aon Retirement Service online platform available to you;
2. Plan Management: to help our clients run their pensions arrangements, make disclosures to third parties where legally required to do so or as otherwise requested by you; and for other checks or administrative activities that may become necessary from time to time (like member tracing to ensure the data we use is complete);
3. Liability Management: to undertake activities to help our clients manage their pension liabilities, such as bulk annuity quotations, scheme mergers, and member option exercises, as well as obtaining appropriate insurance coverage as may be required;
4. Regulatory Compliance: for meeting on-going regulatory, legal and compliance obligations including assisting with investigations or prevention of crime, providing you with updated versions of this Privacy Notice (where required);
5. Process and service improvement: to maintain and improve processes used in running the scheme (for example, automated benefit calculation routines), products or services and uses of technology, including testing and upgrading of systems;
6. Anonymisation: we will anonymise personal information (such that it can no longer be reidentified) in order that it can be used with other data for data analysis, modelling, benchmarking and research purposes. We may share aggregated and anonymised data with third parties provided that we shall not publish externally or otherwise disclose any information which might reasonably identify you;
7. Benchmarking, Modelling & Analysis: personal information will (in some instances in identifiable form, in others anonymous form) be processed for data analysis, modelling, benchmarking, and research purposes in order to improve understanding of life expectancy and other demographic aspects relevant for assessing pensions and insured liabilities. We may share limited identifiable data with third party agencies such as existence tracing providers to support these purposes. We will not otherwise publish externally or otherwise disclose any information which might reasonably identify you.

If we wish to use your personal information for a purpose which is not compatible with the purpose for which it was collected for, we will request your consent. In all cases, we balance our legal use of your personal information with your interests, rights, and freedoms in accordance with applicable laws and regulations to make sure that your personal information is not subject to unnecessary risk.

Legal basis

All processing (i.e. use) of your personal information is justified by a "lawful basis" for processing. We rely on the following legal bases to process your information:

1. Necessary to pursue our legitimate commercial interests as set out above e.g. to operate our business, provide the Services and improve our products and services generally. Where we rely on this legal basis to collect and use your personal information we will take appropriate steps to ensure the processing does not infringe the rights and freedoms conferred to you under applicable data privacy law;
2. Pursuant to legal or regulatory obligations, including requirements to make any disclosures to authorities, regulators or government bodies (including HMRC);
3. Necessary for performance of a contract: we will collect and use your personal information where necessary to enable us to take steps to fulfil our obligations in accordance with the terms of your pension scheme agreement and website terms of use; and
4. In limited circumstances, necessary for statistical purposes e.g. to improve understanding of life expectancy and other demographic aspects relevant for assessing pensions and insured liabilities. Where we rely on this legal basis we will take appropriate steps to ensure that any output of our statistical analyses will not include personal information which might reasonably identify you.
5. In limited circumstances, processed with your consent, for example where we require you to provide sensitive information such as medical details that impact your retirement age, or where we are required to obtain your prior consent in order to send you marketing communications. Before collecting and/or using any personal information, or criminal record data, we will establish a lawful basis which will allow us to use that information. This basis will typically be:
   • your explicit consent;
   • the establishment, exercise or defense by us or third parties of legal claims; or
   • a context specific exemption provided for under local laws of eu member states and other countries implementing the gdpr, such as in relation to the processing of personal data for insurance purposes, or for determining benefits under an occupational pension scheme.

How long do we retain your personal information?

How long we retain your personal information depends on the purpose for which it was obtained and its nature. We will keep your personal information for no more than the time required to fulfil the purposes described in this privacy notice unless a longer retention period is permitted by law. We have implemented appropriate measures to ensure your personal information is securely destroyed in a timely and consistent manner when no longer required.

In specific circumstances we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

Do we disclose your personal information?

1. Within Aon: We may share your personal information with other Aon entities, brands, divisions, and subsidiaries to serve you, including for the activities listed above. We do not rent, sell or otherwise disclose personal information with unaffiliated third parties for their own marketing use. We do not share your personal information with third parties except in the following circumstances discussed below.
2. Your employer, and their service providers such as pension administrators and payroll providers;
3. Business Partners: We disclose personal information to business partners who provide certain specialized services to us, or who co-operate with us on projects. These business partners operate as separate controllers, and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices. Examples include:
   • Banking and finance products - credit and fraud reporting agencies, debt collection agencies, insurers, reinsurers, and managed fund organizations for financial planning, investment products and trustee or custodial services in which you invest
   • Insurance broking and insurance products - insurers, reinsurers, other insurance intermediaries, insurance reference bureaus, medical service providers, fraud detection agencies, our advisers such as loss adjusters, lawyers and accountants and others involved in the claims handling process
4. Authorised Service Providers: We may disclose your information to service providers we have retained (as processors) to perform services on our behalf (either in relation to services performed for our clients, or information which we use for our own purposes, such as marketing). These service providers are contractually restricted from using or disclosing the information except as necessary to perform services on our behalf or to comply with legal requirements. These activities could include any of the processing activities that we carry out as described in the above section, ‘How we use your personal information.’ Examples include:
   • Pensions and auto-enrolment providers who administer services that we provide to your employer;
   • IT service providers who manage our IT and back office systems and telecommunications networks;
   • marketing automation providers;
   • contact center providers; and
   • data tracing providers and other professional advisory agencies, where necessary to prevent and detect fraud in the pensions and insurance industry, or to assess and manage risk in relation to the Services.
   These third parties appropriately safeguard your data, and their activities are limited to the purposes for which your data was provided.
5. Authorised third parties: third parties you have authorised us to share information with such as your financial advisor or nominated beneficiaries or third party sites linked to this website;
6. Legal Requirements and Business Transfers: We may disclose personal information (i) if we are required to do so by law, legal process, statute, rule, regulation, or professional standard, or to respond to a subpoena, search warrant, or other legal request. (ii) in response to law enforcement authority or other government official requests, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, (iv) in connection with an investigation of suspected or actual illegal activity or (v) in the event that we are subject to a merger or acquisition to the new owner of the business. Disclosure may also be required for company audits or to investigate a complaint or security threat.

Do we transfer your personal information across geographies?

We are a global organization and may transfer certain personal information across geographical borders to our, authorized service providers or business partners in other countries working on our behalf in accordance with applicable law. Our affiliates and third parties may be based locally or they may be overseas some of which have not been determined by the European Commission to have an adequate level of data protection.

When we do, we use a variety of legal mechanisms to help ensure your rights and protections travel with your data:

• we ensure transfers within are covered by agreements based on the EU Commission's standard contractual clauses, which contractually oblige each member to ensure that personal information receives an adequate and consistent level of protection wherever it resides within;
• where we transfer your personal information outside of us or to third parties who help provide our products and services, we obtain contractual commitments from them to protect your personal information. Some of these assurances are well recognized certification schemes like the EU - US Privacy Shield for the protection of personal information transferred from within the EU to the United States, or the standard contractual clauses; or
• where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information are disclosed.

Examples of countries we transfer personal information to include, but are not limited to, the United States of America, the United Kingdom, Ireland, Poland, Singapore, India and the Philippines.

If you would like further information about whether your information will be disclosed to overseas recipients, please contact us as noted below. You also have a right to contact us for more information about the safeguards we have put in place (including a copy of relevant contractual commitments, which may be redacted for reasons of commercial confidentiality) to ensure the adequate protection of your personal information when this is transferred as mentioned above.

Do we have security measures in place to protect your information?

The security of your personal information is important to us and we have implemented reasonable physical, technical and administrative security standards to protect personal information from loss, misuse, alteration or destruction. We protect your personal information against unauthorized access, use or disclosure, using security technologies and procedures, such as encryption and limited access. Only authorized individuals access your personal information, and they receive training about the importance of protecting personal information.

Our service providers and agents are contractually bound to maintain the confidentiality of personal information and may not use the information for any unauthorized purpose.

What choices do you have about your personal information?

We offer certain choices about how we communicate with you. When you provide us with personal details, if we intend to use those details for marketing purposes, we will provide you with the option of whether you wish to receive promotional email, SMS messages, telephone calls and postal mail from us.

You may also choose not to receive marketing communications from us by clicking on the unsubscribe link or other instructions in our marketing emails, visiting the Profile section on our website, or contacting us as noted below.

How can you update your communication preferences?

You can update your communications preferences by contacting us on 0800 107 0392 or retirement.service@aon.co.uk.

Other rights regarding your data

Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have certain rights in relation to your personal information.

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

You can exercise your rights by contacting us. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others or if we are legally entitled to deal with the request in a different way.

Right to Access

You have right to access personal information which we hold about you. If you have created a profile, you can access that information by visiting your account.

Right to Rectification

You have a right to request us to correct your personal information where it is inaccurate or out of date.

Right to be Forgotten (Right to Erasure)

You have the right under certain circumstances to have your personal information erased. Your information can only be erased if your data is no longer necessary for the purpose for which it was collected, and we have no other legal ground for processing the data.

Right to Restrict Processing

You have the right to restrict the processing of your personal information, but only where:

• its accuracy is contested, to allow us to verify its accuracy; or
• the processing is unlawful, but you do not want it erased; or
• it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
• you have exercised the right to object, and verification of overriding grounds is pending.

Right to Data Portability

You have the right to data portability, which requires us to provide personal information to you or another controller in a commonly used, machine readable format, but only where the processing of that information is based on (i) consent; or (ii) the performance of a contract to which you are a party.

Right to Object to Processing

You have the right to object the processing of your personal information at any time, but only where that processing is has our legitimate interests as its legal basis. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.

International Transfers

As noted above, you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the European Union.

Contact Us

If you have questions about this Privacy Notice or the privacy and security of your information, please send an email to: retirement.service@aon.co.uk.

If you have further questions, would like further information about our privacy and information handling practices, would like to discuss opt-outs or withdrawing consent, or would like to make a complaint about a breach of the law or this Privacy Notice, please contact the Aon Retirement Service, Member Services, Aon UK Limited, Briarcliff House, Farnborough, Hants, GU14 7TE. Email retirement.service@aon.co.uk. Alternatively, you have the right to contact your local Data Protection Authority. Our Data Protection Authority is the Information Commissioner’s Office (www.ico.org.uk).

Changes to this Notice

We may update this Notice from time to time. When we do, we will post the current version on this site, and we will revise the version date located at the bottom of this page.

We encourage you to periodically review this Notice so that you will be aware of our privacy practices.

This Notice was last updated on 10th May 2018.