Data Retention Policy

Last Updated: 3 October 2025

1. Introduction

This Data Retention Policy outlines how Antony Bailey DevOps Consulting ("we", "us", "our") manages personal data throughout its lifecycle, from collection to secure deletion. This policy ensures compliance with the General Data Protection Regulation (GDPR), UK Data Protection Act 2018, and other applicable data protection laws.

2. Policy Scope

This policy applies to all personal data processed by our organisation, including:

• Client and prospective client information
• Website visitor data and analytics
• Business contact information
• Marketing and communication data
• Employment and contractor records
• Third-party and supplier data

3. Legal Basis for Data Retention

We retain personal data only when we have a lawful basis to do so, including:

• Contractual obligations: Data necessary for fulfilling contracts with clients
• Legal compliance: Data required to comply with legal and regulatory obligations
• Legitimate interests: Data necessary for our business operations where balanced against individual rights
• Consent: Data processed with explicit consent, retained until consent is withdrawn

4. Data Categories and Retention Periods

4.1 Client Data

Data Type	Retention Period	Legal Basis
Contract documents and project files	7 years after contract completion	Legal compliance (tax and business records)
Financial and invoicing records	7 years after final payment	Legal compliance (HMRC requirements)
Client communication records	3 years after project completion	Legitimate interests (service quality and disputes)
Technical documentation and deliverables	5 years after delivery	Contractual obligations and legitimate interests

4.2 Website and Marketing Data

Data Type	Retention Period	Legal Basis
Website analytics data	26 months from collection	Legitimate interests (website improvement)
Contact form submissions	2 years from submission	Legitimate interests (business enquiries)
Newsletter subscriptions	Until unsubscribed + 30 days	Consent
Cookie consent records	2 years from consent	Legal compliance (evidence of consent)

4.3 Business Operations Data

Data Type	Retention Period	Legal Basis
Supplier and vendor information	7 years after final transaction	Legal compliance (business records)
Professional network contacts	5 years from last contact	Legitimate interests (business relationships)
Recruitment records (unsuccessful)	1 year from application	Legitimate interests (future opportunities)

5. Data Deletion and Destruction

5.1 Secure Deletion Process

When retention periods expire, we securely delete personal data using the following methods:

• Digital data: Secure overwriting and cryptographic erasure
• Physical documents: Secure shredding by certified destruction services
• Cloud storage: Secure deletion according to cloud provider security standards
• Database records: Permanent deletion with verification of removal

5.2 Deletion Verification

We maintain records of data deletion activities, including:

• Date and method of deletion
• Categories of data deleted
• Responsible person or department
• Verification of complete removal

6. Extended Retention Circumstances

We may retain personal data beyond standard retention periods in the following circumstances:

6.1 Legal Holds

Data may be preserved when required for:

• Ongoing legal proceedings or investigations
• Regulatory investigations or audits
• Disputes or potential disputes
• Compliance with court orders or legal notices

6.2 Extended Business Need

With appropriate justification and regular review, data may be retained longer for:

• Ongoing client relationships
• Warranty or support obligations
• Historical reference for similar projects

7. Data Subject Rights

Individuals have the following rights regarding their personal data retention:

7.1 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data when:

• The data is no longer necessary for the original purpose
• You withdraw consent (where consent was the lawful basis)
• The data has been unlawfully processed
• Deletion is required for legal compliance

7.2 Right to Data Portability

Before deletion, you may request a copy of your personal data in a structured, commonly used format.

7.3 Right to Restrict Processing

You can request restriction of processing while deletion requests are being considered.

8. Review and Updates

8.1 Regular Review

We conduct regular reviews of our data retention practices:

• Annual policy review: Complete review of retention periods and procedures
• Quarterly data audits: Review of data approaching retention limits
• Monthly deletion cycles: Regular identification and deletion of expired data

8.2 Policy Updates

This policy may be updated to reflect:

• Changes in applicable laws and regulations
• Updates to business practices and data processing
• Technology changes affecting data management
• Feedback from data protection authorities

9. Third-Party Data Processing

Where we use third-party services for data processing, we ensure:

• Appropriate data processing agreements are in place
• Third parties comply with our retention requirements
• Data deletion is verified across all processing systems
• Regular audits of third-party compliance

10. Data Breach and Retention

In the event of a data breach:

• Affected data will be secured and assessed for continued retention necessity
• Data subjects will be notified of any impact on retention
• Accelerated deletion may be implemented where appropriate
• Breach response documentation will be retained as required by law

11. International Data Transfers

For data transferred internationally, we ensure:

• Adequate protection measures are in place
• Retention periods comply with both UK and destination country requirements
• Transfer documentation is maintained throughout the retention period

12. Contact Information

For questions about data retention or to exercise your rights:

13. Complaints

If you are not satisfied with how we handle your personal data retention:

• Contact us directly using the information above
• Lodge a complaint with the Information Commissioner's Office (ICO)
• Seek legal advice regarding your rights