1.0 Introduction and Scope

1.1 Pursuant to its statutory mandate of administering the pension of contributors and retirees under the Contributory Pension Scheme (CPS) in Nigeria, Trustfund Pensions Limited collects and keeps in custody, personal data of pension contributors, retirees, and their related persons, such as beneficiaries, next-of-kin, and their employers. The data includes but is not limited to the biometrics and bio-data of contributors, retirees, and related persons.

1.2 This Data Privacy Policy (the Policy) is, therefore, instituted by Trustfund Pensions Limited to inform pension contributors, retirees, and other related persons (“Data Subjects”) of the protection of their personal data collected and stored by the Company pursuant to the performance of its statutory responsibilities. The Policy also explains how personal data is collected, stored, used, transferred, and the rights of the Data Subject, in addition to the limited circumstances where such data may be disclosed.

2.0 Nature and Reason for Collection of Personal Data

2.1 Pursuant to the provisions of the Pension Reform Act (PRA) 2014 and the Nigeria Data Protection Act (NDPA) 2023, Trustfund Pensions Limited collects data of pension contributors, retirees, and their stated related persons. This information may include sensitive personal data such as biometrics, and other personal data including name, gender, marital status, date of birth, nationality, National Identification Number, employment details, and Next-of-Kin information, amongst others.

2.2 Reason for collection of personal data

Trustfund Pensions Limited collects the personal data of a pension contributor to open a Retirement Savings Account (RSA) for him/her and to administer the retirement benefits under the CPS. This is necessary to ensure that uniquely identifiable persons are registered under the CPS and that their data are linked to their various employers. This also facilitates the remittance and accurate computation of pension contributions and other entitlements to the RSAs of contributors and seamless payment of benefits. Collection of data of the next-of-kin and beneficiaries of contributors and retirees further ensures that Trustfund Pensions Limited has contact with their chosen closest relatives.

3.0 Legal Basis for Data Processing

The processing of personal data by Trustfund Pensions Limited is lawful based on the following:

• The consent of the Data Subject.
• The processing is necessary for compliance with a legal obligation to which the Company is subject such as the Pension Reform Act (PRA 2014), NDPA 2023, and other relevant laws.
• The processing is necessary for the performance of a task carried out in the public interest.
• The processing is necessary for the performance of a contract to which the Data Subject is a party.

4.0 Data Subject Consent and Rights

The collection of data of the contributors, retirees, and/or their related persons by Trustfund Pensions Limited shall be subject to the freely given, specific, informed, and unambiguous consent of the Data Subject. Consent is obtained when the Data Subject completes the RSA registration and data recapture forms, including electronic formats, by accepting the terms of this Policy.

 In line with the NDPA 2023, every Data Subject has the following rights:

• The Right to be Informed: To be informed about the collection and use of their personal data.
• The Right to Access: To request and obtain a copy of their personal data held by us.
• The Right to Rectification: To request the correction of inaccurate or incomplete personal data.
• The Right to Erasure (Right to be Forgotten): To request the deletion of their personal data, under certain conditions.
• The Right to Restrict Processing: To request the limitation of how their personal data is processed.
• The Right to Object to Processing: To object to the processing of their personal data, including for direct marketing purposes.
• The Right to Data Portability: To receive their personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another Data Controller.

Data Subjects can exercise these rights by contacting our Data Protection Officer (DPO) or our designated compliance team using the contact details provided in this Policy.

5.0 Processing, Protection, and Security of Personal Data

5.1 Trustfund Pensions Limited shall process personal data only for the purpose for which the data is collected. The Company shall process such data on both electronic and manual platforms, as may be required, in a manner that ensures appropriate security, integrity, and confidentiality. We have implemented robust technical and organizational measures to protect against unauthorized or unlawful processing, access, loss, destruction, or damage to personal data.

5.2 Only authorized officers and employees of Trustfund Pensions Limited shall have access to the personal data collected. Pursuant to Section 113 of the PRA 2014 and the NDPA 2023, all such authorized persons shall include every member of the Board, officer, employee, agent or any other person engaged or authorized by Trustfund Pensions Limited to examine any document or make an inquiry thereto. Such authorized persons are bound by a duty of confidentiality. They shall not disclose or use any personal data obtained directly or indirectly, except as expressly authorized by the Company or as otherwise provided for under this Policy or required by law.

6.0 Storage and Retention of Personal Data

6.1 Trustfund Pensions Limited shall securely store the personal data of pension contributors, retirees, and related persons collected in hard paper copies, computers, servers, and other electronic devices.

6.2 Trustfund Pensions Limited shall retain personal data for as long as is necessary to fulfill the purposes for which it was collected, as well as to comply with our legal and regulatory obligations. The retention period shall not be less than ten (10) years, pursuant to the provisions of the National Archives Act, CAP.N6 Laws of the Federation of Nigeria, 2004. Once the data is no longer required, it will be securely disposed of in a manner that prevents unauthorized access.

7.0 Disclosure and Cross-Border Transfer of Personal Data

7.1 Without prejudice to the foregoing provisions, however, Trustfund Pensions Limited may be obliged to disclose or transfer personal data in its custody in the following circumstances:

• Where disclosure is made in compliance with a statutory obligation or pursuant to a lawful order of a court of competent jurisdiction.
• Where the Data Subject has expressly consented to the disclosure or instructed that their data be fully or partially disclosed to a named person or persons.
• Where the disclosure is made to the Data Subject for his/her personal use or record.
• For the purpose of an audit by a competent authority.
• Where the disclosure is made to a third-party data processor under a legally binding Data Processing Agreement (DPA) that ensures the same level of data protection and compliance.

7.2 The transfer of personal data to a country outside of Nigeria will only occur where there is a determination of adequate data protection laws in that country, or if other legal safeguards are in place in line with the NDPA 2023.

8.0 Violation of Data Privacy and Remedies

8.1 Contributors, retiree, or their related persons (i.e Any Data Subject) whose data privacy rights are violated under this Policy shall report in writing, such violation to National Pension Commission (PENCOM )and Trustfund Pensions Limited for immediate redress. In addition to the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

8.2 Pursuant to the provisions of the PRA 2014 and extant Regulations of the Commission, the Commission shall direct Trustfund Pensions Limited to redress the right of the affected contributor, retiree, or related person immediately. Failure of Trustfund Pensions Limited to restore such rights as appropriate shall entitle the contributor, retiree, or related person to legal remedies, subject to the provisions of the PRA 2014 and NDPA 2023. 

9.0 Governing Laws

9.1 This Data Privacy Policy is issued by Trustfund Pensions Limited pursuant to the provisions of the PRA 2014, and is consistent with Nigeria Data Protection Act (NDPA) 2023.

10.0 Reviews and Enquiries

This Privacy Policy is subject to review by Trustfund Pensions Limited from time to time as the need arises. All enquiries regarding this Policy, including requests to exercise Data Subject rights, should be directed to the email address compliance@Trustfundpensions.com.