Our data protection and privacy policies

You have the right to access personal data that we hold and we’ll normally provide your personal data within one month of your request. There’s no fee, but we will ask you to prove your identity. In some circumstances, we may require more time to locate your information. There are also certain situations where material cannot be provided, for example where disclosure may have an adverse impact upon ongoing proceedings or where the personal data of other people is also featured. In these situations, we’ll inform you of any limitations placed upon your right of access as well as providing you with information on your right to appeal to the UK Information Commissioner.

You have the right to request that we cease or limit our processing of your personal data. Please note that this right is unlikely to apply where processing remains necessary in relation to the purposes for which your data was collected.

You have the right to request that we correct or amend our records if you have reason to think we’ve made a mistake in recording or processing your personal data, for example if it’s inaccurate or incomplete.

We collect and process personal data to allow us to administer the pensions, injury benefits and premature retirement compensation arrangements for the devolved public service schemes in Scotland. These are set out in statutory regulations made by the Scottish Ministers, with the consent (as required) of HM Treasury.

For the purposes of scheme administration we collect:

SPPA processes personal data for the purposes of:

• Maintaining records to support the operation of the schemes
• Calculating, authorising and paying pensions, other benefits and any other sums due on retirement and thereafter under schemes' regulations including injury benefits (for NHS, Police and Fire schemes only)
• Calculating, authorising and paying pensions to spouses/partners and dependents on the death of a member/pensioner
• Maintaining systems to support the prompt and accurate payment of sums due
• Processing elections made under the regulations by members
• Calculating and paying refunds of contributions and providing services to support the purchasing of additional pension
• Calculating and paying the transfer of pension rights to and from other pension providers
• Providing information to members and their employers, to their agents and to UK Government Departments such as the Department for Work and Pensions and HMRC
• Maintaining facilities for Additional Voluntary Contributions for scheme members, as laid down in the schemes' regulations
• Collecting sums due to the Scottish Ministers under the regulations (not Police and Fire Schemes)
• Maintaining accounts of income and expenditure under the regulations (not Police and Fire Schemes)
• Preparing budget estimates of income and expenditure and monitoring actual payments against estimates (not Police and Fire Schemes)
• Providing accurate information to other parts of the Scottish Government and to the schemes' actuaries for accounting and valuation purposes
• Liaising with HM Treasury, other UK Departments and bodies regulating and administering public service pensions
• Providing services in support of the governance framework created by the Public Service Pension Act 2013 for the pension schemes for which the Agency has administrative responsibility
• Providing Cash Equivalent Transfer Values for divorce purposes and the implementation of Pension Sharing on Divorce orders for which income is generated.

All information collected for the purposes of scheme administration is stored and processed on our secure servers held within the European Economic Area.

Analytics

When you visit our website or log in to your SPPA account, we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We collect information about:

• the pages you visit and how long you spend on each page
• how you got to SPPA's websites
• what you click on while you're visiting SPPA's websites.

The information we get from Google Analytics doesn’t allow us to identify anyone individually. For example, we never receive your name or address. We don’t make, and don’t allow Google to make, any attempt to find out the identities of people who visit our website.

If you like, you can opt out of Google Analytics at any time.

Cookies

This site places small files, known as 'cookies', onto your computer to collect information about how you browse. These cookies aren't used to identify you personally. You’ll normally receive a message from the site before we store a cookie on your computer.

Find out more about how to manage cookies.

If we need to collect personally identifiable information through our website, we’ll make it clear to you that we’re collecting personal information and we’ll also explain what we intend to do with that information.

Online Services

Secure online services are currently available for our NHS and Teachers members and pensioners. In order to register, users will need to provide the following information that allows us to identify you with the data we hold.

• Email address
• Surname
• Date of Birth
• National Insurance Number
• Superannuation / GTC or Pension Payroll reference number
• Password

Contact us

When online, we encourage our scheme members and pensioners to contact us through our secure member area.

For people who aren’t scheme members, we provide a General Enquiries contact form through which we collect a name and email address. We ask that the General Enquiries form is not used to convey additional personal information.

Surveys

We use third party providers, Questback and Microsoft Forms, to host our online Customer Service Surveys, which we use to better understand where our service is working well, and where there are areas for improvement. We will routinely share summaries and reports with other people working on our pensions service, to help them design better processes and whilst doing so we may also share your exact words so people can understand what is important to you but they won’t be able to identify you.

Survey settings are applied that allow us to collect survey data securely and anonymously and participation with our surveys is completely voluntary. We don’t ask for any personal information though some surveys may include an option to join our research panel. If you decide to join the panel, your survey responses will not be anonymous.

Digital Recordings

On occasion SPPA may create and manage digital content that includes video, audio or transcribed voice to text recordings of those participating in SPPA engagement sessions such as webinars. Where the lawful basis is consent, participants are asked to consent to being recorded and are given the option to opt out. Participants must actively consent by speaking or adding a note. Consent will not be assumed.

Digital recordings undertaken by SPPA are permissible only where there is a legitimate business need as defined by a Digital Recording Policy and relevant Data Protection Assessment.

Those wishing to remove their consent following a recording should contact SPPA via our phone or postal address.

SPPA's established complaints procedure should be used to register dissatisfaction with any of our services. Our procedures comply with the Scottish Public Services Ombudsman's guidance on a model complaints handling procedure.

The Telephony System used by SPPA records all of the calls we make and receive, with recording data stored on SPPA's internal servers. Internal calls between SPPA staff are not recorded.

The Customer Contact Team within the Customer Services Department is the only business area within SPPA that currently uses this call recording functionality.  

Calls where the caller provides details of a payment card for the purpose of making a payment to SPPA will only be recorded in-part to comply with Payment Card Industry Security Standards.

The purpose of call recording is to provide an exact record of the call which can:

• help identify staff training needs and help support training of new and existing staff
• help improve staff performance
• help protect staff from abusive or nuisance calls.

Recordings are selected for review through random sampling of individual staff member's calls.

SPPA staff can draw a particular recording to a team leader's attention if they feel it is useful for training, or is valuable for evidence purposes in the event of persistent/unacceptable caller behaviour.

Occasionally, team leaders will listen to a sample of call recordings to ensure that they are all reviewing recordings to the same standard.

Every caller is informed that the call is recorded and why, before the conversation begins. This will be done by a pre-recorded message, in the SPPA welcome message on the Liberty phone system, before connection is made to the SPPA member of staff.

A caller may request that their call is not recorded. In this situation, the caller will normally be advised to contact SPPA either in writing or by email. In exceptional circumstances a caller who does not wish to be recorded will be transferred to a non-recorded phone line. This decision will be made by a manager, if they judge that not doing so could cause distress to the caller.

Recordings will normally be retained for a maximum of 6 months and then automatically deleted.

Some recordings may be retained for longer than 6 months for the following reasons:

• because they’ve been identified by SPPA managers as valuable for staff training. In this case, we’ll seek permission from the member of staff to use the recording to train others and the recording will be retained until it’s no longer useful for this purpose. We’ll review retained training calls every six months to see if they’re still useful for training and delete any recordings that are deemed to be no longer useful.
• if they’re identified as evidence for the record keeping requirements of SPPA's procedure for dealing with unacceptable behaviour towards staff or unreasonably persistent complainants.

SPPA uses closed-circuit television (CCTV) images to reduce crime and to monitor our building in order to provide a safe and secure environment for staff and visitors, and prevent the loss or damage to SPPA property and assets.

CCTV captures images of people entering and leaving the building, including staff, however monitoring of staff is incidental to the above purpose and not the main intent of the system.

SPPA is responsible for all CCTV operated within its premises and is the data controller in terms of our obligations under Data Protection legislation.

Individuals have the right to request CCTV images relating to themselves under the subject access provisions of Data Protection legislation. SPPA will adhere to the subject access request (SAR) procedure and statutory timescale when responding to these requests. To make a request contact SPPA Facilities on 01896 893122 or by email at SPPAFacilities@gov.scot.

Authorised personnel with an enforcement function, such as Police Scotland, can make requests to access CCTV images for the purposes of the prevention and detection of crime. Procedures outlined by Data Protection legislation must be adhered to when responding to these requests.

CCTV images are retained for 30 days after which time they are deleted from the system. Images may be retained for longer periods if required for disclosure.

SPPA staff are civil servants in the employment of the Scottish Government.

eHR is the system the Scottish Government uses to hold information about staff (which can include contractors and secondees). SPPA's HR Team can access this system in order to maintain employment records (information held on eHR). The table below sets out what this information is, what we use it for and who can see it.

Information is held for the purposes of:

• Maintaining an accurate staff record and to ensure previous records are associated with current records.
• Fulfilling statutory requirements in connection with tax and National Insurance.
• Satisfying certain legal obligations in relation to minimum wage and young workers.
• Assisting in the development of policies that are free from bias and discrimination.
• Contacting staff or a named individual in case of an emergency.
• Recording if staff have elected to waive the 48-hour requirement of the working time directive.
• Recording if staff have requested the Scottish Government to supply child care vouchers.
• Administrating pay.
• Satisfying eligibility for employment and diversity monitoring.
• Administrating staff assignments.
• Staff welfare, health and safety.

Digital Recordings and Telephony System

On occasion it is necessary to create and manage digital content that may include video, audio or transcribed voice to text recordings of employees, suppliers, contractors, agents and representatives, volunteers and temporary staff working for or on behalf of the SPPA. Digital recording within SPPA is permissible only where there is a legitimate business need as defined by a Digital Recording Policy and Data Protection Assessment.
 

The Telephony System used by SPPA records all of the calls we make and receive, with recording data stored on SPPA's internal servers. Internal calls between SPPA staff are not recorded. Please see the Phoning SPPA section above for further details outlining the purpose.

MyCSP

Staff details will be provided to MyCSP who are the administrators of the Civil Service Pension Scheme, of which the Scottish Government is a member organisation. Employees will be auto-enrolled into the pension scheme and details provided to MyCSP will be your name, date of birth, National Insurance number and salary. Bank details will not be passed to MyCSP at this time.