Who we are

John Lewis Partnership Pensions Trust is the trustee (“the Trustee”) of the John Lewis Partnership Trust for Pensions (“the Scheme”). As the Trustee of the Scheme, we hold certain personal information (known as “personal data”) about scheme members and, where applicable, their dependants and beneficiaries. Most of the information held about you and processed by the Trustee in running the Scheme will be personal data.

For legal purposes, the Trustee is known as the data “controller”, as we decide the purposes for, and the means by which, the personal data we hold is processed.

This notice provides information about our processing of your personal data and your rights under the data protection legislation.

What information we collect about you

Depending on the circumstances and the stage of your membership, we may hold some or all of the following information about you:

• your name and date of birth
• your gender
• your marital status
• your address and other contact details
• your national insurance number
• details of your bank account (to pay benefits)
• details about your dependants and/or beneficiaries
• relevant employment information (including current and past salary information and employment dates)
• details about your pension benefits
• medical and other details about your health, if required

In order to properly administer the Scheme and to calculate and pay benefits, from time to time we may also need to hold other information about you.

How the information is used

As a data controller, the Trustee collects and processes the above personal data about you for the purposes of complying with our legal duties to administer the Scheme, and for our or another third party’s other legitimate purposes relating to the operation of the Scheme, which includes:

• the calculation, administration and payment of benefits payable under the Scheme on your retirement or death
• processing ill-health retirement claims
• risk management purposes, including carrying out actuarial valuations and investment of Scheme assets
• purchasing annuities or other insurance products from insurers
• dealing with any queries or complaints regarding benefit entitlements
• processing transfer-out requests from members
• meeting our compliance and regulatory reporting obligations and to take advice on these and our other legal rights and obligations
• complying with our obligations towards members under the Scheme governing documents, as well as under relevant legislation
• complying with the Trustee’s legal duties in respect of pensions dashboards as and when they arise, including to send and receive information from the dashboard, if you are a user of a pensions dashboard and to allow us to search for your pension
• for internal record-keeping purposes.

In some cases, it is necessary us to collect and process your personal data for specific legitimate interests that are recognised in law. These recognised legitimate interests are as follows:

• public task disclosure requests;
• national security, public security and defence;
• detecting, investigating and preventing crime; and/or
• safeguarding vulnerable individuals.

Your personal data will generally be collected directly from you or from your employer. However, we may also receive personal data from other parties such as HM Revenue & Customs, the Pensions Ombudsman, pensions dashboards platforms, tracing organisations or someone acting on your behalf, such as an independent financial adviser. If you are receiving a dependant’s benefit from the Scheme, or a benefit resulting from divorce or the dissolution of a civil partnership, we may have been given your personal data by the principal scheme member or through enquiries undertaken by us on a member’s death. The Trustee will not collect any personal data that is not needed.

Personal data relating to the Scheme is held on paper and on computer systems. As the data controller, the Trustee must process this information fairly and lawfully.

As part of running the Scheme, we may also need to hold and process particularly sensitive information about you and/or your dependants and beneficiaries (known as “sensitive personal data”). Under data protection legislation, details relating to health, racial or ethnic origin, religious or other similar beliefs, sexual orientation and political affiliations are regarded as “sensitive personal data”. We must satisfy a specific condition under UK data protection laws (in addition to one or more of the lawful bases) in order to process this type of data. We will in most circumstances process this data as necessary for the establishment, exercise or defence of legal claims to benefits or in the performance of our legal obligations in connection with employment, social security and social protection (as allowed by legislation). If there are any occasions where we seek your explicit consent to process sensitive data then you can withdraw it at any time.

We do not currently use your personal information to make significant decisions about you by solely automated means. We will let you know if this changes.

What else we might do with personal data

From time to time parameters used in calculating benefits may be reviewed or updated. To ensure that any necessary changes do not have an adverse impact on benefit calculations, existing member data is used to test the changes. Before being passed to our system developers, unique identifiers are first removed so that data used in test cannot be linked to a specific individual.

Who we share personal data with

We are not allowed to disclose personal data about you to other parties except:

• when required for contractual or legal reasons or other specifically identified purposes; or
• where you have given your consent.

However, as the Trustee needs help from various advisers to properly administer the Scheme, we share personal data with the following:

• your current, past or future employer and to the extent necessary their pensions advisers, auditors, and providers of pension illustration modellers
• Trustee Services, the in-house team which supports the Trustee in discharging its obligations
• the Scheme’s professional advisers, including providers of outsourced secretarial and executive support, the Scheme actuary, auditor, medical advisers, investment adviser and lawyers
• Mercer Limited and the Scheme’s actuary currently provide actuarial services for the DB Section of the Scheme. They use personal data about members of the DB section of the Scheme, for example to calculate benefits and advise on the Scheme’s funding position. You can find a link to their privacy notice here: https://www.uk.mercer.com/privacy.html
• the third parties who are responsible for the day-to-day administration of the Scheme on behalf of the Trustee and the connection of data regarding the Trust to the Pensions Dashboard, namely XPS Group, Pension Fusion and Legal & General.
• third parties in relation to the provision of pensions dashboard services (for example, the Money and Pensions Service and its service providers, and our service provider who helps us to connect the Scheme to pensions dashboards)
• Legal & General Assurance Society Limited currently help the Scheme’s Trustee administer the Defined Contribution section of the Scheme. They require personal data about members of the DC Section to do so, for example to invest members’ contributions and to prepare benefit statements. You can find a link to their privacy notice at: www.legalandgeneral.com/workplace/j/jlp/footer-links/privacy-notice/
• XPS Group currently help the Scheme’s Trustee administer the Defined Benefit section of the Scheme and those members who hold both DB and DC benefits (Dual Benefit members). They require personal data about members with these benefits to do so, for example to calculate member benefits and to prepare benefit statements. You can find a link to their privacy notice here: https://www.xpsgroup.com/privacy-policy/
• HM Revenue & Customs and other statutory bodies (such as the Pensions Ombudsman and the Pensions Regulator) – the Trustee can be fined and subject to other action if it fails to provide certain information to these authorities
• the advisers and printers who help us prepare various communications we send to you
• insurance companies used to invest additional voluntary contributions
• insurance companies providing annuities for certain pensioners
• depending upon how we pay pensions, the personal data we have to supply in order to effect a BACS transfer (the Bankers’ Automated Clearing Service) or CHAPS (the Clearing House Automated Payment System) in the UK and/or a payment via Citibank, when pensions are being paid overseas
• mortality tracing agency

The Trustee and parties above may from time to time transfer data to other countries, including outside the United Kingdom (UK). Where such transfers are made, the parties involved will ensure adequate safeguards are in place. Under UK data protection laws, we can only transfer your personal data to another entity in a jurisdiction outside of the UK if:

• the UK government has decided that the particular jurisdiction (or international organisation) ensures an adequate level of protection of personal data (by issuing ‘adequacy regulations’). A list of jurisdictions for which the UK currently has adequacy regulations in place is available on the Information Commissioner’s Office website. This includes all countries in the European Economic Area. We rely on adequacy regulations for transfers of personal data to our providers and suppliers that are based in these countries.
• in cases where there are no applicable adequacy regulations, where there are ‘appropriate safeguards’ in place, such as standard data protection clauses (specified in regulations made by the UK government, or in a document issued by the UK data protection authority) and provided that the level of protection for your personal data following the transfer based on these safeguards will not be materially lower than in the UK; or
• a specific exception (known as a derogation) applies under relevant data protection law in the circumstances. However, we do not routinely rely on derogations in respect of overseas transfers of personal data.

How long we keep personal data for

We must keep all personal data safe and only hold it for as long as necessary. To meet the requirements of both UK tax and pensions law, we must keep certain personal data (for example, details about the date a member joins the Scheme, their name and address, and details of benefits paid) for a minimum of 6 years. But, given the nature of pension schemes, the Trustee may be required to keep some of your personal information for longer than this. Pension benefits are paid over a long period and your right to benefits under the Scheme is based on information which may go back many years. Therefore, the Trustee may be required to keep some of your personal information, and your beneficiaries and/or potential beneficiaries personal information, until you are no longer entitled to benefits under the Scheme. After you are no longer entitled to Scheme benefits, the Trustee may continue to hold your personal data where we consider such processing continues to be necessary to administer the Scheme (for example, to deal with any queries relating to your benefits which may arise in the future).

We review the personal data held in relation to the Scheme on a regular basis in accordance with our data retention schedule. If we conclude that certain personal data is no longer needed, that personal data will generally be destroyed.

Your rights

• Right to be informed – you have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This notice is an example of this right
• Right of access – you have the right to see personal data that is held about you and a right to have a copy provided to you, or someone else on your behalf, in a machine readable (namely, digital) format
• Right to rectification – if at any point you believe that the personal data we hold about you is inaccurate, you can ask to have it corrected
• Right to restrict processing – you can require the Trustee to restrict the processing of your personal data in certain circumstances, for example, whilst a complaint about its accuracy is being resolved
• Right to object to processing – as we are relying on legitimate interests as a reason for processing, you can object to your personal data being processed, although the Trustee can override this objection in certain circumstances
• Right to data portability – you have the right to receive your personal data in a structured, commonly used and machine-readable format and to request that this data is transmitted to another party/controller where this is technically feasible
• Right to lodge a complaint: You have the right to lodge a complaint about our handling or processing of your personal data. (See below for further details)
• Withdrawing consent – where you have given us your consent to processing your personal data, you can withdraw that consent at any time by notifying us (see “Who to contact” below). However, withdrawing your consent will not affect the processing of any personal data which took place beforehand and it may be possible for the Trustee to continue processing your personal data where this is justified
• Right to be forgotten – you can request that your personal data is deleted altogether, although the Trustee can override this request in certain circumstances

You should be aware that taking any of the above steps could impact on the payment of your benefits, your participation in the Scheme, and/or our ability to answer questions relating to your benefits.

Information will generally be provided to you free of charge, although the Trustee can charge a reasonable fee in certain circumstances.

Who to contact about your personal data

If you wish to:

• see your personal data or to exercise any of the rights mentioned above
• request a hard copy of this privacy notice
• make a complaint about how we have handled your personal data (see below) please contact trustee.services@johnlewis.co.uk

Making a complaint

You have the right to complain to us about our processing of your personal data, if you consider that we have breached the UK General Data Protection Regulation (UK GDPR). To make a complaint about how we have handled your information, contact us as at trustee.services@johnlewis.co.uk.

We will acknowledge your complaint within 30 days and investigate your complaint in accordance with our legal obligations.

If you are not satisfied with our response to any query you raise with us, or you believe we are processing your personal data in a way which is inconsistent with the law, you can complain to the UK data protection regulator (currently the Information Commissioner’s Office). Its contact details are:

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone number: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/

Updates to this notice

This notice is the latest version as at 17 June 2026. This notice will be updated from time to time and you can see the current version at any time on the following external website address: https://www.johnlewispartnership.co.uk/meta/jlp-trust-for-pensions.html

Please note that the UK data protection regulator is expected during the course of 2026 to be restructured from a corporation sole, where power is vested in the Information Commissioner, to a body corporate (the Information Commission).