Skip to main content

Privacy policy

This notice describes how we collect, store, use and share personal information. It applies to personal information provided to us, both by you or by others on your behalf. It also explains the rights you may have in relation to the personal information that we hold about you.

Download a shortened version of this privacy notice

 Who we are?

When we say ‘we’ or ‘us’ in this notice we’re referring to Royal London Mutual Insurance Society Limited, a company registered in England and Wales (registration number:99064).

 What kinds of personal information do we hold about you?

We may collect and process the following:

  • information about you – for example name, age, gender, date of birth, nationality. We need this information to help us identify you, but also to allow us to contact you at the right time - such as when you’re approaching your retirement date.
  • government identifiers – for example identification document (driving license, passport) information and National Insurance number.
  • contact information - for example email, address, postcode and phone number
  • online information – for example cookies and IP address (your computer’s internet address), if you use our websites
  • financial information – for example salary and bank account details for any payments you make to us or we make to you. If you make a big deposit into your pension we ask where the money has come from to comply with money laundering laws.
  • audio or video recordings – for example voice recording when you contact us, complete a survey at the end of a call to our Customer Services Team or CCTV footage if you visit our offices. Calls maybe recorded for training and monitoring purposes to help us continually improve our customer service and also to protect you and your information.
  • contractual information – for example details about your products and benefits
  • socio-demographic information – for example employment status, work or profession, education and where you sit within the UK’s social and income groups
  • family & beneficiaries information – for example marital status, next of kin or nominated beneficiaries .
  • health information – for example if we need to validate an ill health claim for your pension. When we collect your information, we’ll let you know if any of it is optional. If it is, we’ll explain why it would be useful to us, and you can decide whether it’s something you’re happy for us to have.

 How we use your personal information?

We use the information we obtain directly from you, your adviser or your employer for a number of reasons:

  • setting up and administering your plan
  • completing any requests or claims you make
  • verifying your identity and preventing fraud
  • researching our customers’ opinions and exploring new ways to meet their needs
  • assessing and developing our products, systems, prices and brand
  • fulfilling any legal or regulatory obligations
  • providing optional tools for you to assess your plan/retirement savings
  • sending you marketing information
  • if you’re a member, sending you membership information and managing your rights
  • monitoring the use of our websites

 Where do we get your information from?

Most of the information we receive comes directly from you or your financial adviser or your employer. However, we may also get personal information about you from other sources:

  • tracing companies - if we lose touch with you, we may source information such as contact details so we can get in touch and remind you about your product.
  • medical professionals – for example if we need information to support an ill health claim
  • data brokers (e.g. Experian)
  • if we need contact information (email and phone numbers) to carry out customer research, promote brand awareness or remind you about the benefits of your plan or;
  • to help put our customers into groups for product development and assessment purposes.
  • credit reference agencies - so we can check your identity
  • third party’ cookies - to collect information on how visitors use our website. Our cookie policy can give you more information.
  • comparison services / portals - If your adviser used a comparison service or portal to obtain multiple quotes at once, the portal provider may share your underwriting information with us.
  • Companies House or other companies who provide access to financial accounts - if we need to verify information on your finances, we may obtain copies of Reports and Accounts from Companies House or similar companies.

 What are our legal grounds for using your personal information?

Data Protection gives organisations a number of different conditions to allow us to lawfully process your information. We will only ever use your personal information when one of these conditions has been satisfied.  The uses of your information are shown below along with the legal grounds for processing 

Legal GroundsUse of your information


Your personal information may be processed when we receive your consent

The consent you provide must be freely given, informed, specific, unambiguous and be given with a positive affirmative action.

Your consent can be withdrawn at any time.

Optional tools

We have tools and calculators available on our website designed to help you and / or your adviser to assess your finances.  Any information you submit to these tools and calculators is optional and we explain, in detail,  how it’s used

Buying in information

We may obtain your email address from data brokers if, for example we’d like to use it for a research project.  We’ll always take steps to check the data broker has obtained your consent to the sharing of your information. 


On our website we use ‘third party’ cookies that collect information about how visitors use our website.  Please see our cookie policy for further information.

Necessary for the performance of a contract

The personal information you provide or that of a joint party to the contract may be processed when it is necessary in order to enter into or perform a contract. E.g. where we process your information to assess your application or to provide your policy.

Setting up and administering your policy

This covers:

  • processing your application
  • managing any changes of personal details i.e. change of address or name
  • responding to queries or complaints
  • managing your funds, and deciding what your funds are invested in / what options are available.
  • keeping you updated about your policy, such as sending you regular statements and letting you know when you’re nearing retirement.   We may also highlight  risks to you meeting your financial objectives e.g. if you decide to withdraw  money as it may lead to you using up all your savings earlier than you expected.  We’re providing more of this in the future.
  • pricing workplace pension schemes

 Making payments to you or processing claims

This includes:

  • paying a lump sum 
  • paying a regular income  
  • processing a claim in the unfortunate event of your ill health.

 If we lose touch

We may source information such as contact details so we can get in contact and tell you about your product.  

Necessary for compliance with a legal obligation

Your personal information may be processed where Royal London has a legal obligation to perform such processing. E.g. where we share information with our regulators or the courts

Verifying your identity and preventing fraud

We may need to check your identity when relevant, in an attempt to protect you from risks.  This isn’t a credit check and doesn’t affect your credit rating.

We sometimes need copies of your identification documents, or identification numbers for example passport or driving licence number, if we need to do extra checks. This is to make sure we meet our obligations with anti-money laundering or other laws.


If you’re a member of Royal London, we need to provide you with mandatory information about our Annual General Meeting (AGM) - so you can attend and vote. 

We also have a legal obligation to provide a copy of our members register to anyone who requests it – this includes your name, address and the date you became a member and eligible to vote.

Fulfilling any legal or regulatory obligations

These will vary according to the nature of your product you have taken out. For example we’ll provide yearly statements as required by the Financial Conduct Authority or the Pensions Regulator.

Necessary to protect vital interests

This will usually only apply in "life-or-death" scenarios

We may disclose your information to the police or other authorities if we have serious concerns about your wellbeing.

Necessary for an insurance product

The UK laws that will bring the GDPR in to effect give legal grounds for processing your medical information in connection with an insurance product.

We’ll obtain information from a medical professional if you tell us you’re in serious ill health and claiming under your pension’s ill health protection.

Necessary for legitimate interests

We also use your information when we have a “legitimate interest” and that interest isn’t outweighed by your privacy rights. Each activity is assessed and your rights and freedoms are taken into account to ensure that we’re not being intrusive or doing anything beyond your reasonable expectation.  We’ll assess the information we need, so we only use the minimum.

If you want further information about processing under legitimate interests you can contact us using the details below.

You also have the right to object to any processing done under legitimate interests.  We’ll re-assess the balance between our interests and yours, considering your particular circumstances.  If we have a compelling reason we may still continue to use your information.

We use legitimate interests for the following:

Use of your informationLegitimate interest(s)

Assessing and developing our products, systems, prices and brand

Our products are developed with a particular set of customer needs in mind.  In order to make sure your policy is still suitable for you and is working as we intended, we combine your information with other customers’ to analyse and segment it.    For example, we may look at a segment of the plans that don’t have an adviser or employer attached to see if we need to offer different services to these customers.

We also combine your information with other customers’ to assess how much money we need to have available at any time.   

We need to be able to identify groups of customers who might be interested in any new products or services we’re considering.

We need to develop those products and services, and make sure our product charges are fair.

We need to make sure we’re treating you fairly and check your policy remains suitable for you.

We need to make sure we’re looking after your money.  

Researching our customers’ opinions and new ways to meet our customers’ needs

We may conduct research before we launch new products or before we make changes or improvements to existing products to make sure it’s the right thing to do.  We might also conduct research to ask customers what they think of Royal London, our products and services. 

Where we don’t have your contact details, we may obtain your telephone number from data brokers (e.g. Experian) to contact you for a research project.  However we always take steps to check you haven’t objected to such contact, e.g. by checking the Telephone Preference Service.
We need to make sure our products are suitable for the intended audience and to identify gaps in the market.    
We need to see how many categories of customers we have and to tailor our products and services accordingly.
We need to make sure our communications use the right language and that our products are being sold to the intended set of customers. 
We need to make sure our research is efficient and connects with the right types of people, so we can be confident of any decisions we make based on the results.

We need to make sure our products are suitable for the intended audience and to identify gaps in the market.    

We need to see how many categories of customers we have and to tailor our products and services accordingly.

We need to make sure our communications are easy to understand and that our products are being sold to the correct audience.

We need to make sure our research is efficient and connects with the right types of people, so we can be confident of any decisions we make based on the results.


We don’t currently market other products to you.  We’re looking to start communicating with you more frequently about your policy and also finances generally, with tailored communications that are more relevant to you.  Where these communications are marketing and so optional, we’ll make it clear you can opt out of these.

We’ll send marketing to you as a member of Royal London, which includes updates from our business and helpful information about things that may affect your finances. 

We won’t do this if you have told us not to.

We need to ensure our communications are in line with Royal London’s values as a member-owned organisation.

We also need to grow and sustain our business and develop our brand and communicate effectively with our members.

Monitoring the use of our websites

On our websites we use a variety of technologies that collect information about how visitors use our website.

We need to make sure that our websites are secure and work well.

 Who do we share your personal information with?

As you’d expect, our employees will access your records in order to use your information for the uses mentioned above. However, only those employees who need access to particular information are given it. For example, our customer service staff need access to your policy details to support you when you get in contact, and our research team will need access to a subset of your information to perform their analysis. We regularly check who has access to our systems.

We may also share your personal information with these categories of third parties:

  • Your financial adviser, for example you may have authorised your adviser to:
  • Make changes for you;
  • Told them they can only obtain copies to look after your products.
If you have appointed an adviser they will receive reports on your plan activity.
Your employer - for example they’ll receive reports to help them help you, like an annual report highlighting employees who:
  • have paid more than their tax free allowance into their pension;
  • who aren’t contributing;
  • are investing in high risk funds and may want to seek financial advice/
  • Our service providers and agents e.g. mailing houses for printing, offsite storage companies, confidential waste disposal and IT companies who support our technology.
  • Our professional advisers: auditors; reinsurers; medical agencies and legal advisers;
  • Identity authentication and fraud prevention agencies.
  • HM Revenue & Customs, regulators such as the Financial Conduct Authority and other authorities like the Information Commissioner’s Office;
  • UK Financial Services Compensation Scheme.
  • Market research agencies.
  • Data Brokers (e.g. Experian).
  • Direct debit (DD) scheme - if you use DDs
  • Companies you ask us to share your information with.
We may share your information with advertising partners (e.g. Facebook) to help us identify and market to new customers. We will always consider your rights and freedoms before we do this and assess the balance between our interests and yours.

 Overseas Transfers

We sometimes use third parties located in other countries to provide support services. As a result, your personal information may be processed in countries outside the European Economic Area (EEA).

These services will be carried out by experienced and reputable organisations on terms which safeguard the security of your information and comply with the European data protection requirements. Some countries have been assessed by the EU as being ‘adequate’, which means their legal system offers a level of protection for personal information which is equal to the EU’s protection. Where the country hasn’t been assessed as adequate, the method we have chosen is standard contractual clauses.

The European Commission has recognised ‘standard contractual clauses’ as offering adequate safeguards to protect your rights and we’ll use these where required ensuring adequate protection for your information. The European Commission approved standard contractual clauses are available here.

We use standard contractual clauses for the below activities, to help us provide:

  • IT support and technology development with operations based in India
  • global reassurance partners with operations based in the United States
  • other service providers, research partners and administrators with operations based in India and the United States We always ensure all personal information is provided with adequate protection and all transfers of personal information outside the EEA are done lawfully.


We use Transport Layer Security (TLS) to encrypt and protect email traffic. However if your email service doesn’t support TLS, any emails we send or receive won’t be protected. We recommend you don’t send anything confidential to us by email.

Once we receive your information, we use strict procedures and security features to protect your information from unauthorised access.

 How long do we keep personal information for?

We’ll keep your personal information for as long as it’s considered necessary, for the purpose for which it was collected, and to comply with our legal and regulatory requirements. This will involve keeping your information for a reasonable period of time after your plan or your relationship with us has ended.

In the absence of specific legal, regulatory or contractual requirements, any other personal information is kept for our baseline retention period - this is seven years after your plan has exited.

For pension schemes, we need information for all the payments in and out of the scheme to be kept for seven years after the scheme closes. So your information may be kept for a long time.

We’re also running a programme as part of our need to treat our customers fairly. Until this finishes, we’ll be keeping your information beyond seven years.

 Do we make solely automated decisions about you or profile you?

Automated decisions are where a computer makes a decision about you without a person being involved. We also profile our customers - which means we make assumptions about you to help us treat you fairly.


We use Experian software, to provide us with insight into our customers. The software uses a variety of publicly available and market research sources to divide the UK population into a series of categories. The categories are a way of grouping people who are likely to have similar social, demographic (i.e. age, location) and financial circumstances. The results are assessed and combined so we get a picture of our customers as a whole.

In the future we’d like to keep a note of the category you fall into, against your records, so we can tailor our communications to suit you. Before we do this we’ll assess if this is fair.


The Financial Conduct Authority defines a vulnerable consumer as someone who, due to their personal circumstances, is especially likely to experience disadvantage. It’s been identified a lot of people will be vulnerable at some point in their life, so we need to make sure we can identify who these customers are and support them.

We’ve created our own method, using socio-economic data from Experian and additional research with consumers, to help us assess levels of vulnerability within the UK population. We then use this information to help identify how many of our customers are likely to be more vulnerable, and ensure our products are designed with this in mind. For example, we may provide additional information on our statements where we suspect our customers might be less financially capable or less engaged in financial matters.

In the future we’d like to keep a note of the category you fall into, against your records, so we can tailor our communications to suit you. Before we do this we’ll assess if this is fair.

 What are my rights?

Your rights are outlined below. The easiest way to exercise any of your rights would be to contact our Data Protection Officer at the contact details provided. We’ll provide a response within 30 days, if not sooner. There’s normally no charge for exercising any of your rights.

Accessing your personal information

You have the right to find out what personal information we hold about you, in many circumstances.

Correcting or adding to your personal information

If any of your details are incorrect, inaccurate or incomplete you can ask us to correct them or to add information.

Data portability

In some circumstances you can ask us to send an electronic copy of the personal information you have provided to us, either to you or to another organisation.

Objecting to the use of your personal information for legitimate interests You also have the right to object to any processing done under legitimate interests. We’ll re-assess the balance between our interests and yours, considering your particular circumstances. If we have a compelling reason we may still continue to use your information.

Objecting to direct marketing

You have a specific right to object to our use of your information for direct marketing purposes, which we will always act upon.

Restricting the use of your personal information

If you are uncertain about the accuracy or our use of your information, you can ask us to stop using your information until your query is resolved. We will let you the outcome before we take any further action in relation to this information.

Right to Erasure

You can ask us to delete your personal information in some circumstances, such as if your policy has ended and we do not need to keep your information for legal or regulatory reasons. If we are using consent to process your information and you withdraw it, you can ask us to erase your information.

 Right to complain to the supervisory authority

If you’re unhappy with how we’re using your information, you have the right to complain to the Information Commissioner’s Office. We’d encourage you to contact us first, so we can deal with your concerns. The Information Commissioner’s Office can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 Changes to the way we use your information

If we want to use your personal information for a new purpose which we haven’t previously told you about, we’ll contact you to explain the new use of your information. We’ll set out why we’re using it and our legal reasons.

 Changes to our Privacy Notice

Making sure that we keep you up to date with privacy information is a continuous responsibility and we keep this notice under review. We’ll update our notice as changes are required.

This privacy notice was last updated on the 24th June 2022.

 Contact us

If you have any questions or comments regarding this privacy notice, or if you’re not happy with the way Royal London uses your information, please contact us using the details below.

Post: Data Protection Officer, Royal London House, Alderley Park, Congleton Road, Nether Alderley, Macclesfield, SK10 4EL.