How can we help you?

Personal data is any information about a living person who can be identified from it – either on its own, or when it’s combined with other information we hold. For a pension scheme, that means the obvious things like a name, address and date of birth, but also account and contribution details, and information about someone's financial circumstances.

When running auto-enrolment compliance on your behalf, Cushon acts as a data processor – you, as the data controller, determine how your employees’ data is used, and we process it securely under your instructions, in line with UK data protection legislation and regulatory requirements. If your employees have questions about that processing, the answer sits with you as their employer.

For pension scheme-related processing provided to members, the Cushon Master Trust Trustees act as the data controller. Cushon MT Limited acts as the data processor on behalf of the Trustees. Which Cushon entity is responsible depends on the specific product or service; the detail is set out in our full privacy notice and the relevant product terms.

We only collect what we need to run the scheme and meet our legal obligations. Typically, that includes:

• Basic details – name, address, date of birth, contact details, nationality
• Financial and transactional information, including contributions and benefits
• Employment and business information
• Information about how someone uses our app and website
• Records of communications with us

In limited cases, and only where we’re legally permitted or have explicit consent, we may handle more sensitive information – for example to make our services accessible, to meet regulatory reporting duties, or to prevent fraud and financial crime.

Every use of personal data must have a lawful basis under UK GDPR. We do not sell your employees’ data, and we do not make significant decisions about them by automated means alone. 

Here’s how that works in practice, with some examples:

Anyone whose data we hold as controller has a set of rights under UK data protection law:

• Access – Ask for a copy of the data we hold about them
• Rectification – Ask us to correct anything inaccurate or incomplete
• Erasure – Ask us to delete data, in certain circumstances
• Restriction and objection – Ask us to pause, or object to, certain processing
• Portability – Ask us to transfer their data to another provider
• Withdrawal of consent – Withdraw permission where we’ve relied on it
• Direct marketing – Object at any time to us using their data for direct marketing
• Complaint – Raise a concern with us about how we’ve handled their data – and, if still unhappy, with the Information Commissioner’s Office (ICO)

Members can exercise these by contacting us, and we aim to respond within one calendar month. In some cases, we may reject requests for reasons such as if the request is unlawful or may infringe on trade secrets, intellectual property or the privacy of another individual. If a request is rejected, we’ll explain why within one calendar month.

We are certified to ISO/IEC 27001:2022, the international standard for information security management, and our controls are aligned to UK GDPR, the Data Protection Act 2018, and FCA requirements. Here’s what that means in practice:

Independently certified
Our information security management system is certified to ISO/IEC 27001:2022 and audited internally and externally each year, overseen at director level.

Encrypted, always
Data is encrypted both in transit and at rest. Transfers use only approved encrypted channels – never personal email or consumer cloud apps.

Strict access controls
Access follows least-privilege and need-to know principles, with role-based controls. Privileged accounts are separated, monitored, and reviewed regularly.

Data loss prevention
Dedicated tooling monitors email, file transfers, endpoints and cloud storage, and blocks high-risk transfers by default pending approval.

Secure, resilient hosting
Personal data is processed in secure, approved cloud environments. Backups are encrypted and held separately, and restoration is tested regularly.

Operational controls
Our data protection framework is supported by documented policies and standard operating procedures, ensuring consistent, auditable handling of personal data across the business.

Keeping data in the right place
Your employees’ personal data is stored in the UK or EEA. On the rare occasions data needs to move beyond these regions, we only do so with appropriate safeguards and senior sign-off, including approval from our Data Protection Officer.

We only keep personal data for as long as we need it. For workplace pensions, that means we hold a member’s data for as long as they – or any beneficiary receiving benefits after their death – are connected to the scheme, and for a reasonable period afterwards to handle any questions, complaints or claims. We may also hold data longer where we’re required to by law or regulation.