Highstone Privacy Policy
Last updated: 13 October 2026
1. About this policy
Highstone is committed to protecting personal information and handling it responsibly, securely and in accordance with applicable data protection legislation.
This Privacy Policy explains how we collect, use, store and share personal information when providing SSAS trustee and administration services, communicating with members and their professional advisers, responding to enquiries and operating our website.
In this policy, “we”, “us” and “our” refer to the relevant Highstone company or companies, as explained below.
Our legal details
This Privacy Policy applies to:
Highstone SSAS Limited — company number 10722139.
Highstone Trustees Limited — company number 13587639.
Both companies are registered in England and Wales. Their registered office details are:
Registered office: Bellingham House, 2 Huntingdon Street, St. Neots, Cambridgeshire, PE19 1BG
Email: admin@highstonessas.com
Telephone: 01480 595 800
Highstone SSAS Limited provides SSAS administration and related services. Highstone Trustees Limited provides trustee services in connection with relevant pension schemes.
Depending on the services being provided and the circumstances in which personal information is processed, either company may act as a data controller. Each company is responsible for complying with its applicable data protection obligations in relation to the personal information it processes. Where the companies share information or one processes information on behalf of the other, appropriate arrangements will apply.
References to “Highstone” in this policy should be understood in the context of the company and services relevant to the particular processing activity.
2. Whose information do we collect?
We may collect and use personal information relating to:
SSAS members and trustees;
sponsoring employers and their representatives;
accountants, solicitors, financial advisers and other professional contacts;
beneficiaries and other individuals involved in pension scheme administration;
prospective clients and people who contact us through our website, by telephone, email or other means.
We only collect information that is relevant to the purposes for which it is being used.
3. What information do we collect?
Depending on your relationship with us and the services involved, the information we collect may include:
Contact details: name, address, email address, telephone number and business details.
Identity information: information needed to verify identity or meet legal and regulatory requirements.
Pension and financial information: scheme membership details, contributions, transfers, benefits, investments, payments and other records needed to administer a SSAS.
Trustee and employer information: details of appointments, authorities, decisions, transactions and relevant business arrangements.
Professional correspondence: communications and documents received from you, your representatives and other professional advisers.
Website and enquiry information: details submitted through our contact form, how you heard about us and information about your enquiry.
Technical information: information collected through our website or its associated services, such as certain device, usage and cookie information.
In some circumstances, we may receive information about you from another source, such as a scheme member, sponsoring employer, professional adviser, bank, pension provider or public register.
Where information is obtained from another source, we will provide privacy information as required by applicable data protection law.
4. How and why do we use personal information?
We use personal information for the following purposes.
Providing SSAS trustee and administration services
To establish and administer pension schemes, maintain records, process authorised transactions, support trustee decisions and communicate with members and their representatives.
Meeting legal and regulatory obligations
To comply with applicable pension, tax, company, accounting, record-keeping and data protection requirements, and to respond to lawful requests from relevant authorities.
Communicating with you
To respond to enquiries, provide information about our services, manage our working relationships and deal with requests or concerns.
Managing our business
To maintain accurate records, manage our accounts, protect our systems, establish or defend legal claims and operate our business effectively.
Marketing and business updates
Where permitted, we may use relevant business contact information to send occasional updates about Highstone and our services. You can object to direct marketing at any time.
Operating and improving our website
To respond to website enquiries, maintain website security and understand how the website is used, subject to the applicable cookie and privacy requirements.
5. Our lawful bases for processing
Data protection law requires us to have an appropriate lawful basis for using personal information. Depending on the purpose, this may include:
Contract: where processing is necessary to take steps at your request before entering into an agreement, or to perform a contract with you.
Legal obligation: where processing is necessary to comply with a legal requirement.
Legitimate interests: where processing is necessary for our legitimate business interests or those of another organisation, provided those interests are not overridden by your rights and interests.
Consent: where we rely on your consent for a particular purpose and consent is the appropriate lawful basis.
The applicable basis depends on the information and the reason it is being processed. We do not rely on consent as the basis for all our activities.
Where we rely on legitimate interests, these may include managing our business, maintaining professional relationships, protecting our services and responding to relevant enquiries.
Where we process special category information, such as health information, we will identify an applicable condition under data protection law in addition to an appropriate lawful basis. We do not assume that explicit consent is required or appropriate for every such instance.
6. Who do we share personal information with?
We may share relevant personal information where necessary for the purposes described in this policy, including with:
HM Revenue & Customs and other relevant regulatory or public authorities;
banks and financial institutions involved in scheme administration or authorised transactions;
pension providers, investment managers and other service providers where relevant to the scheme;
accountants, solicitors, financial advisers and other professional representatives;
specialist service providers supporting our business, such as IT, cloud storage, website, communications and accounting providers;
insurers, auditors, legal advisers, courts or other parties where reasonably necessary for legal, regulatory or business purposes.
Where relevant, information may be shared between Highstone SSAS Limited and Highstone Trustees Limited to support their respective roles in the administration and trusteeship of pension schemes.
We only share information where there is an appropriate reason to do so and, where applicable, suitable safeguards are in place.
Some organisations will process information on our behalf under appropriate contractual arrangements. Others, such as banks, professional advisers or public authorities, may process information as independent controllers for their own purposes.
We do not sell personal information to third parties.
7. International storage and transfers
Some of the technology and service providers used by Highstone may store or access information outside the United Kingdom.
Where personal information is transferred to a separate organisation outside the UK and the international transfer rules apply, we will ensure that the transfer is covered by an appropriate legal mechanism, such as UK adequacy regulations or suitable safeguards, as required by law.
Further information about relevant safeguards may be requested using the contact details provided in this policy.
The countries involved and the safeguards applicable to particular providers depend on the services we use and must be confirmed against our current supplier arrangements.
8. How long do we keep personal information?
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting and record-keeping obligations and to establish or defend legal claims.
As a general guide, certain business and financial records may need to be retained for at least six years. Different periods may apply to pension scheme records, ongoing schemes, documents relating to transactions or benefits, and records subject to specific legal or regulatory requirements.
The appropriate retention period depends on the type of information, the reason it is held and the circumstances involved. We will securely delete or otherwise dispose of information when it is no longer required.
9. How do we protect personal information?
We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Access to information is restricted to those who need it for legitimate business purposes. We also take steps to manage the security of the systems and service providers used to support our operations.
No method of storing or transmitting information can be guaranteed to be completely secure, but we take the protection of the information entrusted to us seriously.
10. Your data protection rights
Depending on the circumstances and the applicable law, you may have the right to:
Access your personal information and receive a copy.
Correct inaccurate or incomplete information.
Request erasure of personal information where the legal conditions are met.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests, including an absolute right to object to direct marketing.
Request data portability where the relevant legal conditions apply.
Withdraw consent where processing is based on consent. This does not affect the lawfulness of processing carried out before consent was withdrawn.
These rights are subject to legal conditions and exceptions. For example, we may need to retain certain pension or financial records to meet our legal obligations even if you request their deletion.
To exercise a right or ask a question about how we use your information, please contact us using the details in this policy. We may need to verify your identity before responding.
11. Marketing communications
We may occasionally contact relevant business contacts with updates about Highstone or our services where permitted by law.
You can ask us to stop sending marketing communications at any time by using an unsubscribe option where available or contacting us directly.
Stopping marketing communications will not prevent us from sending essential service messages or communications necessary for the administration of a pension scheme or the fulfilment of our legal obligations.
12. Cookies and website services
Our website uses cookies and similar technologies to support its operation, security and functionality and, where you have given your consent, to help us understand how visitors use the website.
Some cookies are necessary for the website to function properly. Others, including those used for website analytics, are optional and are subject to consent where required by law.
When you first visit our website, you can accept all cookies, decline non-essential cookies or manage your choices using our cookie banner.
You can review or change your preferences at any time using the Cookie Preferences option at the bottom of our website. You can also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.
Cookies and similar technologies may be provided by Squarespace or other third-party services used by our website. The cookies used will depend on the website's configuration and the preferences you select.
13. Links to other websites
Our website may contain links to external websites operated by other organisations. We are not responsible for the privacy practices or content of those websites.
You should review the privacy information provided by any external website you visit.
14. Complaints and the Information Commissioner's Office
If you have a concern about how we have handled your personal information, please contact us first so that we can investigate and respond.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Website: https://ico.org.uk/
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, systems, legal obligations or data handling practices.
The latest version will be published on our website, together with the date it was last updated.
16. Contact us
For questions about this Privacy Policy or to exercise your data protection rights, please contact us:
Highstone SSAS Limited and Highstone Trustees Limited
Registered office: Bellingham House, 2 Huntingdon Street, St. Neots, Cambridgeshire, PE19 1BG
Email: admin@highstonessas.com
Telephone: 01480 595 800
Please identify the company or pension scheme your enquiry relates to, where known, so that it can be directed appropriately.