Retention principles
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
Retention periods
- Customer account data: life of the contract + 6 years.
- Client/case data: under customer instruction per the DPA; minimum 6 years post-case for MCOB.
- Marketing data: 24 months from last engagement.
- Support tickets: 3 years.
- Security logs: 13 months.
- Billing records: 7 years for HMRC.
Deletion process
Deletion is automated where practical. Manual deletion is logged and auditable. When an agreement ends, your data is available to export; we then delete it from live systems within 90 days and from backups within 12 months, unless the law requires us to keep it or you have told us it is under a legal hold.