Privacy statement

You participate in our pension scheme. This is set out in the pension agreement you have concluded with your employer. To administer your pension properly, we need your personal data, and often also that of your partner, such as your name, address, and date of birth. We also process, among other things, your citizen service number (BSN) and data relating to your income, employment, and pension.

Achmea Pension Services administers the pension scheme on our behalf and is also responsible for paying out pensions. For this purpose, they use and store (process) your personal data. In doing so, they comply with the General Data Protection Regulation (GDPR) and the Code of Conduct for the Processing of Personal Data by Pension Funds. Shell Pension is responsible for the proper processing and security of your personal data. This also applies if Shell Pension outsources parts of the processing to third parties.

We have agreements with Achmea Pension Services and other organizations regarding the exchange of personal data and the protection of your privacy. These agreements are set out in a data processing agreement, which also specifies how these organizations may process your personal data and what security measures apply. We periodically verify whether the parties with whom we exchange personal data comply with the agreement.

Your personal data is not shared with countries outside the European Economic Area (EEA). If this becomes necessary in the future, it will only occur if it is legally permitted and appropriate safeguards are in place.

We exchange personal data with various parties in the context of your participation in our pension scheme. For example, we receive personal data from your employer when they register you for the pension scheme.

Through the Municipal Personal Records Database (Basisregistratie Personen, BRP), we continuously update certain data. This means that many important changes in your personal situation do not need to be reported to us yourself, for example a move or a divorce. We also receive data from you directly, for example in case of cohabitation or marriage abroad.

If you become incapacitated during your participation, we also process data that shows the degree of your incapacity. For this, we rely on the information you or the UWV provide to us. We do not process any other medical information.

Sometimes we are legally obliged to share your personal data with others, for example with the Tax Authorities or the Pension Register. Apart from this, we do not provide personal data to third parties unless you give Shell Pension written consent.

We manage your pension from accrual through payment, to you or your survivors. You also receive regular information from us about your pension, for example if your pension scheme changes. We only process the personal data necessary for this purpose.

We also process personal data when needed to comply with our legal obligations, such as checking whether you appear on a sanctions list. If we need your personal data for other purposes, we will first ask for your consent.

In some cases, we are legally or contractually obliged to process certain personal data, such as your Citizen Service Number (BSN), bank details, or income information. Without these data, we cannot administer your pension scheme.

We do not make decisions based on automated processing (profiling) that have legal consequences for you or significantly affect you in any other way.

We keep your personal data for your entire lifetime and beyond. This is because (ex-)partners and children may sometimes receive payments from your pension years later. A large part of your data is retained by default for a period of 100 years.

We implement these measures in accordance with applicable legal requirements and guidelines. An example of a technical measure is that we transmit your digital data only in encrypted form, so that only you have access to this data.

An example of an organizational measure is that only authorized employees may view your data. These employees have access to your personal data only to the extent necessary to perform their tasks.

To serve you better, we record when you and Shell Pension have had communication moments. For example, we record phone calls and chats, as well as letters and emails that we send and receive from you.

On our website, we use cookies. A cookie is a file on your computer that remembers what you do on our website. We use these cookies, for example, to improve the website and (depending on the cookies you accept) to see what you do and view on our website. You can read more about cookies in the cookie statement.

We also store click behavior in emails for the newsletter. This allows us to see how often an email has been opened, which articles have been clicked, and which operating system was used. We use this information exclusively for analysis purposes to improve the information we provide to participants.

Your rights are regulated by law. You can make a request to:

• Access your personal data. You can also find many of your data on your personal portal.
• Correct your personal data if it is incorrect. Except for data we receive via the Municipal Personal Records Database (BRP). In that case, you need to update your data directly with the municipality.
• Restrict the processing of your personal data or withdraw your consent.
• Transfer your personal data to another organization, for example if you request a pension value transfer.

Note: We may not always be able to comply with your request, for example if we need your personal data to administer your pension.

Send an email or letter. See the contact details. Before we can process your request, we will verify your identity. We may therefore ask you to provide a copy of your passport, driver's license, or identity card. In that case, please make your Citizen Service Number (BSN) and photo unrecognizable. We keep the copy of your identity document for 2 years.

We respond to your email or letter within 4 weeks, except if it is not possible to respond on time. In that case, we will inform you when you can expect our reply. First, we check your identity, and then we answer your request.

Send us an email or letter, or call us. See the contact details. If we cannot resolve the issue together, you can submit your complaint to the Dutch Data Protection Authority. Visit autoriteitpersoonsgegevens.nl for more information. You can also take your case to court.

This may happen, for example, if laws or regulations change, or if we develop new products or services. You can always find the latest version on our website. The latest version is dated 10 September 2025.