Bulk Purchase Annuity privacy notice

A bulk purchase annuity is an insurance agreement between defined benefit pension schemes and insurers. It is an investment of the pension scheme, providing guaranteed cashflows from the insurer to the scheme, matching all or part of the scheme’s pension promises to members.

This type of policy supports the security of pension scheme members’ benefits and reduces risk to companies supporting the pension scheme. It is also known as a ‘buy-in’, which is a form of bulk purchase annuity.

If your pension scheme has purchased a buy-in policy with Royal London, you will continue to receive your pension benefits in the usual way from your pension scheme. There will be no change to the way in which your pension scheme benefits are administered, and you should continue to contact your scheme administrator in the usual manner, including if you have any questions about the scheme’s bulk annuity policy.

A ‘buyout’ agreement is an arrangement whereby the bulk annuity policy is converted into individual annuity policies for each member.  This transfers liabilities and responsibilities for paying pensions from the trustees to the insurer.  If your pension scheme has converted to a buyout policy with Royal London, you will receive your pension benefits directly from us. 

Throughout this notice, when we say ‘we’ or ‘us’ we’re referring to the Royal London Mutual Insurance Society Limited, a company registered in England and Wales, and authorised by the FCA. (registration number: 99064, registered office: 80 Fenchurch Street, London, EC3M 4BY).

Personal data is defined under the UK General Data Protection Regulation (UK GDPR) as any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

In essence, personal data is your personal information. Please see section 4 below for the type of personal data that we collect. We collect and process personal data primarily to administer an insurance policy held either by yourself as an individual or by your pension scheme. Section 5 of this privacy notice tells you what you can expect us to do with your personal data as an independent data controller 

We may process the following personal data, as provided to us directly by you or your pension scheme’s trustees:

• Information about you - such as your name, age, gender, date of birth and contact details including address, country of residence and postcode.
• Special category data - this is personal data that needs more protection because it is sensitive.  Where it is relevant to the trustee’s policy, we may process information relating to your medical history and health.
• Employment details such as pensionable pay, length of service and occupation.
• Government identifiers – for example, information from your identification documents, such as National Insurance number, your driving licence or passport.
• Bank account details – required for the processing and payment of pension benefits 
• Benefit information – for example, details about the amount and timing of your benefits due from the pension scheme.
• Family & beneficiaries’ information – for example, your marital status, dependants, next of kin or other nominated beneficiaries, including their date of birth and gender. If you provide information on another individual it’s important you ensure they are aware of the detail you’ve provided to us. Their personal data will be processed in accordance with this Privacy Notice, so please let them know it’s important that they read this policy.
• Audio or video recordings – for example voice recording if you contact us directly regarding your buy out policy or CCTV footage if you visit our offices.  Calls may be recorded for training and monitoring purposes, and your words will be transcribed to text, summarised and checked by a colleague.  This is to help us continually improve our customer service and to protect you and your information.  Artificial Intelligence (AI) will be used to undertake these activities. Please note as described in section 1, you should contact your pension scheme administrator with any enquiries if your pension scheme has purchased a buy-in policy with Royal London.
• Socio-demographic information – for example, employment status, work or profession, education and where you sit within the UK’s social and income groups. 

We use the personal data provided to us by your pension scheme’s trustees for a number of reasons:

• Administering any arrangements between us and your pension scheme trustees in relation to the buy-in, or in the case of a buyout administering the policy we hold directly for you. Administration includes making and receiving payments in respect of your pension benefits.
• Assessing, developing and managing our products, systems, prices, our business and brand. This includes understanding and inferring your socio-demographic group – for example, where you sit within the UK’s social and income groups.
• Verifying your identity, preventing fraud and financial crime.
• Researching our customers’ opinions and exploring new ways to enhance the servicing experience we provide to meet your needs.
• Providing optional tools for you to assess your plan/retirement savings.
• Fulfilling any other legal or regulatory obligations.
• To keep in touch with you and provide marketing communications
  • Certain communications we send you provide information that we must send to you to meet a regulatory requirement.  You can’t opt out of these communications. We call these Regulatory Communications.
  • Some communications give you essential information that we are contractually required to provide to help you understand your products and services. You can’t opt out of these communications. We call these Service Communications.
  • Other communications are intended to support you in making informed decisions, to help you build a strong financial future and get the most value from your existing Royal London products and services.  You can opt out of these communications when you receive them.  We call these Support Communications.
  • We also send communications to help keep you up to date with the latest news, services and products that might interest you. We call these Marketing Communications.  You can opt out of these communications when you receive them, by emailing us at GDPR@Royallondon.com or ringing us on 0345 602 1885.
• No mobile information will be shared with third parties/affiliates for marketing/promotional purposes.  Any marketing communication or support communication you may receive will be from Royal London.
• Telephone calls may be recorded to allow you to give us instructions by phone to analyse, assess and improve our customer service, for training and quality purposes, to manage complaints and to protect you and your information from fraud and financial crime.
• Identifying vulnerable customers to help determine whether we need to take further steps to ensure these customers are not disadvantaged in any way (please refer to section 12 for further information). 
• Monitoring the use of our websites – for further information, please see our  Cookie Policy. 

Additionally, we may use any personal data that you provide through optional financial tools and calculators, which are available on our website. 

Most of the personal data we receive comes directly from your pension scheme trustees, or companies appointed by the pension scheme trustees to manage the scheme on their behalf (for example, your pension scheme administrator).

Personal data can be provided directly from you when you fill in forms or contact us directly for example via phone or email.

We may also obtain personal data about you from:

• Trusted third-party companies that support the management of the bulk annuity product, such as tracing providers (who confirm limited personal or marital information), or sanctions checking providers, to prevent financial crime. 
• ‘Third party’ cookies - collect information on how visitors use our website.  Our Cookie policy can give you more information.

As you’d expect, our employees will access your records for the purposes mentioned above.  However, only those employees who need access to that information are given it. For example, our administration staff need access to your policy details to support management of the policy internally, and our pricing and reporting teams will need access to a subset of your information to perform their analysis.  We regularly check who has access to our systems.

We may also share your personal data with these third parties:

• Trustees – we’ll need to share information with your pension scheme’s trustees (often via your pension scheme’s administrator) so that they can meet their legal obligations in running the pension scheme. 
• Our service providers, e.g. those who perform some underwriting activities for us, offsite storage, confidential waste disposal companies and approved IT specialists who support our technology. 
• Our professional advisers: including auditors, consultants and legal advisers. 
• Identity authentication, law enforcement and fraud prevention agencies. 
• Legal and Regulatory bodies e.g. HM Revenue & Customs, The Financial Conduct Authority, Information Commissioner`s Office and the UK Financial Services Compensation Scheme.
• Companies within the Royal London Group.
• Our Reinsurers, to the extent we use any, who require data including policy details, medical and suspected fraud and other financial crime data. 
• In the event Royal London was to merge or sell any part of its business or assets, it will be necessary to pass your personal data to the prospective buyer/party.

Please note that any third parties will only process your personal data on our instructions and where they have agreed to treat the data confidentially and to keep it secure. 

The UK GDPR and associated legislation set outs specific grounds under which your personal data may be lawfully processed. The legal grounds for the processing of personal data by us will depend on the purpose for which the processing is being carried out.

We’ll only use your personal data when one of these grounds has been satisfied.  You can see how we use your personal data and the legal grounds for processing this: 

We sometimes use third parties located in other countries to provide support services. As a result, your personal information may be processed in countries outside of the United Kingdom and the European Economic Area (EEA).  
 
These services will be carried out by experienced and reputable organisations on terms which safeguard the security of your information and comply with the UK’s data protection requirements. Some countries have been assessed by the UK and the European Commission as being ‘adequate’, which means their legal system offers a level of protection for personal information which is equal to that of the UK’s. Where the country hasn’t been assessed as adequate, we use appropriate transfer mechanisms such as Standard Contractual Clauses with a UK Addendum or an International Data Transfer Agreements. The United Kingdom recognises these mechanisms as offering adequate safeguards to protect your rights and we’ll use these where required to ensure an adequate level of protection for your personal information.  
 
We use these mechanisms for the below activities, to help us provide:

• IT support and technology development
• Reassurance services with our global reassurance
• Services with other providers/suppliers, research partners and administrators 

We will always ensure your personal data is provided with adequate protection and all transfers of personal information outside the UK and EEA are done lawfully.

We have put in place security measures designed to prevent your personal data and special categories of personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We use Transport Layer Security (TLS) to encrypt and protect email traffic with our suppliers and other parties transferring data as part of the management of the bulk annuity policy, as well as other approved Secure File Sharing Platforms. We also use the Clearswift Managed Email Security Service to protect our outgoing email traffic.  However, if your email service doesn’t support TLS or if you do not wish to use our Clearswift Managed Email Security Service, we may not be able to communicate with you by email, and any emails we do send or receive will not be protected by encryption, and could be intercepted. We may also change our Email Security Service provider at any time without notice and without changing the provision in this notice.  

Once we receive your information, we use strict procedures and security features to protect it from unauthorised access. 

In the event of a potential data security breach, we will notify your pension scheme trustees and Information Commissioner’s Office if we are legally required to do so, or if there is a risk to your rights and freedoms as a result of the breach.

We will retain your personal data for as long as it is considered necessary for the purpose for which it was collected, and to comply with our legal and regulatory requirements. This will usually involve retaining your personal data for a reasonable period of time after the benefits payable to you the policy holder or to the pension scheme’s trustees, have ended.

This period will be compliant with any specific legal, regulatory, contractual requirements or technical reasons.

There are a few exceptions to this rule:

• The Financial Conduct Authority requires us to keep some pension transfer information indefinitely.
• Where there is a dispute. 

Automated Decisions

Automated decisions are where a computer makes a decision about you without a person being involved.  This includes profiling pension scheme members, which means we make assumptions about you to help us price our products fairly.

Crime Prevention

We will undertake checks for the prevention and detection of crime as we are required by law to do so. These checks use solely automated means to make decisions about you.  This may result in stopping payments made to you as the policyholder or the trustees in respect of your pension scheme’s benefits.  Please see section 13 “What are my rights?” for further information. 

Vulnerability

The Financial Conduct Authority defines a vulnerable consumer as someone who, due to their personal circumstances, is especially likely to experience disadvantage.  It’s been identified that a lot of people will be vulnerable at some point in their life, so we need to make sure we can identify who these customers are and support them.  

We’ve created our own method, using socio-economic data from Experian and additional research with consumers, to help us assess levels of vulnerability within the UK population.  We then use this information to help identify how many of our customers are likely to be more vulnerable, and ensure our products are designed with this in mind.  For example, we may provide additional information on our statements where we suspect our customers might be less financially capable or less engaged in financial matters.

In the future, we’d like to keep a note of the category you fall into, against your records, so we can tailor our communications to suit you. Before we do this, we’ll assess if this is fair.

Socio-economic profiling

We may analyse your personal data to create a profile so that we can contact you with information relevant to you.  When building a profile, we use Experian software to provide us with insight into our customers.  The software uses a variety of publicly available and market research sources to divide the population into a series of categories.  The categories are a way of grouping people who are likely to have similar social, demographic (i.e. age, location) and financial circumstances.  The results are assessed and combined so we get a picture of our customers as a whole, and tailor the products and services we provide.  Please see section 13 “What are my rights?” for further information.

Again, in the future we’d like to keep a note of the category you fall into, against your records, so we can tailor our communications to suit you.  Before we do this, we’ll assess if this is fair.  

Your rights are outlined below. The easiest way to exercise any of your rights would be to contact our Data Protection Officer at the contact details provided.  We will provide a response within one month, if not sooner.  There is normally no charge for exercising any of your rights. We may ask you for proof of identity when you request to exercise some of these rights to ensure we are dealing with the correct individual.

Access to your personal data

You have the right to find out what personal data we hold about you, in many circumstances. Please see section 16 below for our contact details.

Correcting or adding to your personal data

Your pension scheme trustees are responsible for providing your personal data to us and ensuring that any of your details provided to us (usually via your pension scheme administrator, or another party appointed to manage the scheme) are correct, accurate and complete. Where your scheme has a bulk purchase annuity arrangement with Royal London you should contact your pension scheme administrator in the usual way to correct or add any information.  Where the scheme has been converted to a ‘buyout’ policy, you should contact the Royal London BPA Services team directly at BPAServices@RoyalLondon.com.

Withdrawing your consent

If you have provided consent for us to use your personal data and is stated to be a legal ground in this privacy notice, you have the right to withdraw it at any time.  If you withdraw consent, then we are not allowed to use your personal data going forward.  However, it would not invalidate processing that was carried out before you withdrew consent.

Transferring your personal data to another organisation (Data portability)

In some circumstances, you can ask us to send an electronic copy of the personal data you have provided to us, either to you or to another organisation.

Objecting to the use of your personal data for legitimate interests

You also have the right to object to any processing done under legitimate interests.  We will re-assess the balance between our interests and yours, considering your particular circumstances.  If we have a compelling reason, we may still continue to use your personal data if that interest is not deemed to be outweighed by your privacy rights. However, we will inform you of that decision and reasoning for continuation of processing.

Objecting to automated decision making

You have a right to object if we have made an automated decision, including profiling, which has legal and significant effect against you. You may also have the right to challenge the decision and ask for a human review.  These rights do not apply if we are authorised by the law to make such decisions and appropriate safeguards are in place to protect your rights.

Restricting the use of your personal data

If you are uncertain about the accuracy or our use of your personal data, you can ask us to stop using your personal data until your query is resolved.  We will let you know the outcome before we take any further action in relation to this personal data.

Right to Erasure

You can ask us to delete your personal data in some circumstances, however, it is likely that we will need to retain it in order to correctly manage your individual annuity policy  or the bulk purchase annuity policy held by your scheme’s trustees and perform the necessary activities set out in this privacy notice. If that is the case, we will inform you of that decision and reasoning for continuation of processing.  

If you have any concerns regarding erasure of your data, we would ask that you speak to your pension scheme trustees or scheme administrator in the first instance or if you are an individual annuity policy holder you should contact the BPA Services team. 

If you are dissatisfied with how we are using your personal data, you have the right to complain to the Information Commissioner.  We would encourage you to contact us first so we can deal with your concerns.

The Information Commissioner`s office can be contacted by

• Visiting their website www.ico.org.uk
• Phone on 0303 123 1113
• Write to Information Commissioner`s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Making sure that we keep you up to date with privacy information is a continuous responsibility and we keep this notice under review.  We will update our notice as changes are required.

If we need to use your personal data for a new purpose which we haven’t previously told you about, we will contact you to explain the new use of your personal data. We will set out why we are using it and our legal reasons.

This privacy notice was last updated on 8th September 2026.

If you have any questions or comments regarding this privacy notice, or if you are unhappy about the way Royal London uses your personal data, please contact us using these details:

Post: Data Protection Officer, Royal London, Royal London House, Alderley Park, Congleton Road, Nether Alderley, Macclesfield, SK10 4EL.

Email: GDPR@Royallondon.com