This segment sets out how BAE Systems (as your current or former employer) as well as the trustees of the BAE Systems defined benefit pension schemes use your personal information to administer and manage your membership of the pension scheme.
This notice should be read in conjunction with the Overview. For information on how your personal information is used to administer and manage your membership of the BAE Systems Retirement Savings Plan, the defined contribution pension scheme, please contact Scottish Widows, the administrator of the Mercer Master Trust). Additional information regarding the BAE Systems pension schemes, including relevant contact details, can also be accessed here.
What processing activities do you undertake that include my personal information?
We maintain processes and procedures that allow you to speak up about concerns or issues related to suspected or actual illegal or unethical conduct, or violations of our Code of Conduct or Company policies, and report them for guidance or further investigation.
In support of these processes and our compliance obligations, we operate a third party provided Ethics Reporting line, which allows you to raise any concerns through either telephony or web reporting.
What categories of personal information are included in these processing activities?
To administer and maintain the processes set out above, depending on your relationship with us and the type of concern raised, we process Identity Information, Staff related data, Data related to your engagement with the Company, Recruitment data, Regulatory data, Vetting data, Remuneration and benefits data, Leave information, HR processes data, Monitoring data (to the extent permitted by applicable laws) and Employment claims, complaints and disclosures data.
We may also process special categories of personal information and criminal records information, to the extent you provide these or they form part of the particular concern you have raised.
What is the purpose of these activities?
We carry out these activities to investigate any reports received and take appropriate action in accordance with company or legal requirements, as required.
What are the legal grounds you rely on to carry these out?
This processing is necessary for the compliance with legal obligations to which the Company is subject.
This processing is also necessary for the purpose of the legitimate interests pursued by the Company.
(See “What are the legal grounds for processing personal information?” in the Overview section).
What are the 'legitimate interests' referred to above?
The Company has a legitimate interest in putting in place appropriate processes and procedures enabling individuals to report ethical concerns and questionable practices, which would be in violation of company internal policies and/or legal obligations to which the company is subject. Any investigations carried out in this respect are necessary to establish the facts and take corresponding measures as necessary.
As this processing may include special categories of personal information or information relating to my criminal record, in addition to the above, what are the additional legal grounds you rely on to justify this processing?
In some cases, such as where you choose to share special category data with us about you when reporting an ethics concern, we will process this personal data based on your explicit consent.
In other cases, processing special categories of personal data or criminal convictions data may be necessary for reasons of substantial public interest (for instance, to prevent and detect crimes), or to carry out our employment law obligations.
[See “What are the legal grounds for processing special category personal information?” in the Overview section.)
To the extent that you did not get this personal information from me, how did you collect this information?
Some of the information processed in these activities may be generated by the Company. This would usually include information provided by stakeholders included in the investigation of any concern raised, for example HR, Legal, line management, Security and Compliance (see “Where do you get my personal information from?” in the Overview section).
In addition, we may work with our customers, business partners and suppliers to carry out the activity and as set out in this Notice. We may receive information from other sources as set out in this Notice (see “Where do you get my personal information from?” in the Overview section).
Who do you share this personal information with?
As necessary and appropriate in the circumstances of a particular investigation, your personal information is shared internally (see “When do you share my personal information with others?” in the Overview section). This would usually include our Ethics Officer(s)/Managers and/or Administrators, legal advisers, HR, or other internal investigators or subject matter experts as well as your line management, as may be appropriate in the consideration and/or investigation of an ethics concern raised.
Depending on the nature of the report, we may also share some of your personal information externally with any suppliers or partners as needed (including our external legal advisers, and our Ethics Reporting line provider), external agencies (including the Police or law enforcement, as appropriate) and as otherwise set out in this Notice (see “When you do you share my information with others?” in the Overview section).