Data Retention and Erasure Policy & Schedule
| Document Control Information |
| Version |
1.0 |
Author |
GDPRLocal |
| Reviewer |
|
Review Date |
|
| Review Frequency |
12 months |
Next Review Date |
August, 2027 |
The current version of this document is up to date. Any future versions or changes to this document must also be approved by the author and the Executive Team and issued on a version-controlled basis under their signature. This document has been stored at Safe Storage.
Aim
This document aims to define standard data retention periods for different types of data held, stored and maintained by Gym Spa Soho Ltd. It is important to note that the GDPR does not specify data retention periods, and only refers to a storage limitation principle that data can only be stored for as long as needed, as determined by the original purpose of collection and as described to the data subject. This document defines standard, acceptable data retention periods for different data types. Where a specific type of data is not listed the storage limitation principle should be applied. Where a regulator or legal requirement exists, these mandatory requirements should be applied.
Definitions
The General Data Protection Regulations/GDPR – Whenever the terms ‘The General Data Protection Regulations’ or ‘GDPR’ are referred to in this document, it usually pertains to both The Regulation (EU) 2016/679 (EU GDPR) and The Data Protection Act 2018 (UK GDPR). Should there be a need to invoke other regulations, they will be appropriately and distinctly named.
The Regulation (EU) 2016/679 (EU GDPR) Territorial scope – The territorial scope of the GDPR encompasses the processing of personal data by entities established within the European Union, regardless of where the processing occurs, as well as entities outside the EU that either offer goods or services to individuals within the EU or monitor their behavior within the Union. It also applies in situations governed by a Member State’s public international law. This means the GDPR’s reach extends beyond the EU’s borders, affecting organizations globally that interact with EU residents.
The Data Protection Act 2018 (UK GDPR) Territorial Scope – The UK GDPR, which came into effect post-Brexit, maintains similar territorial principles. It applies to the processing of personal data by entities established within the United Kingdom. For entities outside the UK, the UK GDPR applies if they offer goods or services to, or monitor the behavior of, individuals within the UK. It also captures situations dictated by UK international law.
Personal data [personal data] – ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Sensitive Type of Data – Under the General Data Protection Regulation (GDPR), ‘sensitive data’ is defined as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Processing – Any operation or set of operations performed on personal data, whether or not by automated means. This includes collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
Third-Party/Vendor – A natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
Data Retention Approach
Personal data will be retained for no longer than necessary and will be disposed of securely and according to the data classification. A Data Retention Schedule will be produced by Gym Spa Soho Ltd. to demonstrate a generic retention period based on the purpose of the data and data retention guidelines. In the event that the retention of personal data is no longer necessary for the operation of Gym Spa Soho Ltd., the data shall be deleted, and all copies shall be destroyed as per the defined schedule.
Administration
The following Record Retention Schedule is the initial maintenance, retention and disposal schedule for records held by Gym Spa Soho Ltd. This schedule should be reviewed regularly to ensure the data retention policy approach is adhered to.
There are certain occasions when information needs to be preserved beyond any limits set out in the policy. The policy must be SUSPENDED relating to a specific customer or document and the information retained beyond the period specified in this Data Retention Schedule in the following circumstances:
- Legal proceedings or a regulatory or similar investigation, as well as obligation to produce information known to be likely, threatened, or actual;
- A crime is suspected or detected;
- Information is relevant to a company in liquidation, receivership or where a debt is due to the company;
- Information is considered by the owning unit to be of potential historical importance;
- Gym Spa Soho Ltd. has been issued a Subject Access Request or similar request or is subject to a local Regulator or other investigation.
In the case of possible or actual legal proceedings, investigations or crimes occurring, the type of information that needs to be retained relates to any that will help or harm the company or the other side’s case, liability or amount involved. If there is any doubt over whether legal proceedings, an investigation or a crime could occur or what information material is relevant in these circumstances, the company shall take such steps as is necessary to promptly inform all staff of any suspension in the further disposal of documents.
Record Retention Schedule
The data retention policy is based on the following schedule:
| Department |
Function |
| A | Accounting and finance |
| B | Contracts |
| C | Corporate records |
| D | Correspondence and internal memoranda |
| E | Personal information |
| F | Electronic records |
| G | Insurance records |
| H | Legal |
| I | Miscellaneous |
| J | Personnel records |
| K | Tax records |
| L | Operational Records |
Accounting And Finance
| Record Type |
Retention Period |
| Annual audit reports and financial statements | Permanent |
| Annual audit records, including work papers and other documents that relate to the audit | 7 years after completion of an audit |
| Annual plans and budgets | 2 years |
| Bank statements and cancelled cheques | 7 years |
| Employee expense reports | 7 years |
| Interim financial statements | 7 years |
| Credit card records (documents showing customer credit card number) | 2 years |
All records showing customer bank details must be locked in a desk drawer or a filing cabinet when not in immediate use by staff. If it is determined that information on a document, that contains credit card information, is necessary for retention beyond 2 years, then the identifying details will be cut out of the document.
Contracts
| Record type |
Retention Period |
| Contracts and related correspondence (including any proposal that resulted in the contract and all other supporting documentation) | 7 years after expiration or termination |
| Membership Form | At the moment of ending the membership. |
Corporate Records
| Record type |
Retention Period |
| Corporate records (minutes, signed minutes of the board and all committees, record of incorporation, articles of incorporation, annual corporate reports) | Permanent |
| Licences and permits | Permanent |
Correspondence And Internal Memoranda
General principle: most correspondence and internal memoranda should be retained for the same period as the document to which they relate. For instance, a letter pertaining to a particular contract would be retained as long as the contract (7 years after expiration). It is recommended that records that support a particular project be kept with the project and take on the retention time of that particular project file.
Correspondence or memoranda that do not pertain to documents having a prescribed retention period should generally be discarded sooner.
This section sets out the data retention policies and procedures that are designed to help ensure compliance with legal obligations in relation to the retention and deletion of personal information.
Personal information that is processed for any purpose(s) shall not be kept for longer than is necessary for that purpose or those purposes. We will usually delete personal data falling within the categories set out below at the date/time set out below:
| Record type |
Retention period |
| Information about a computer, including visits to and use of this website (including an IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths) | 2 years following account closure |
| Information provided when registering with our website (including email address) | 2 years following account closure |
| Information provided when completing a profile on our website (including a name, gender, date of birth, interests and hobbies, educational details) | 2 years following account closure |
| Information provided for the purpose of subscribing to email notifications and/or newsletters (including a name and email address) | Until the client chooses to ‘unsubscribe’ |
| Information provided when using the services on the website or that is generated in the course of the use of those services (including the timing, frequency and pattern of service use) | At least 10 years following account closure |
| Information relating to any subscriptions made (including name, address, telephone number, email address and card details) | 2 years following account closure |
| Information posted to our website for publication on the internet | 2 years after post |
| Information contained in or relating to any communications sent through the website (including the communication content and metadata associated with the communication) | 2 years following contact |
| Any other personal information chosen to be sent | 2 years following contact |
| Any information provided to us by you, provided to us by others, or collected from any other source (third parties, social media, regulators, Government agencies etc…) | 2 years following contact |
Notwithstanding the other provisions of this section, we will retain documents (including electronic documents) containing personal data:
- To the extent that we are required to do so by law;
- If we believe that the documents may be relevant to any ongoing or prospective legal proceedings;
- In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
- For as long as required to respond to requests under GDPR or other Data Protection regulations or to respond to complaints, requests, investigations under such regulations.
When we run database backups of all electronic data contained on our servers, we will include all information relating to all current users, as well as any information that remains on the server due to any reason contained in this policy. This database backup is a safeguard to retrieve lost information within a one-year retrieval period should system users experience any problems. This may extend the retention period defined in this document by up to one year.
Electronic Documents
Electronic Mail
There is no specific retention or erasure policy for emails, our retention/erasure policy schedule depends on the subject matter and is based on the schedules defined in this document. The retention and erasure policy for emails is based on the content.
Electronic Documents
There is no specific retention or erasure policy for electronic documents, retention/erasure schedule also depends on the subject matter and is based on the schedule defined in this document.
We do not automatically delete electronic files beyond the dates specified in this policy. It is the responsibility of all staff to adhere to the guidelines specified in this policy. In certain cases, a document will be maintained in both paper and electronic form. In such cases, the official document will be the electronic document.
Insurance Records
| Record Type |
Retention Period |
| Certificates | Permanent |
| Claims files (including correspondence, medical records, injury documentation, etc…) | Permanent |
| Insurance policies (including expired policies) | Permanent |
| Any correspondence relating to policies, claims, adjustments, payments etc… | Permanent |
Legal Files And Papers
| Record Type |
Retention Period |
| Legal memoranda and opinions (including all subject matter files) | 7 years after close of matter |
| Litigation files | 1 year after expiration of appeals or time for filing appeals |
| Court orders | Permanent |
| Requests for departure from records retention plan | 10 years |
| Register of members | Permanent |
| Minutes of directors’ meetings | 10 years |
| Compliance and Regulatory Documents (Documents related to legal, industry-specific, or regulatory compliance) | 7 years or as mandated by the specific regulations |
Miscellaneous
| Record Type |
Retention Period |
| Consultant’s reports relating to any business function/project etc… | Permanent |
| Material of historical value (including pictures, publications) | Permanent |
| Policy and procedures manuals – original | Current version with revision history |
| Policy and procedures manuals copies | Retain current version only |
| Annual reports | Permanent |
| Record of person’s I.D for money laundering purposes | 5 years |
| Any work-related reportable accident, injury or death | Permanent |
| Immigration checks | 2 years from the termination of a job |
Personnel Records
| Record Type |
Retention Period |
| Job applications/interviews of unsuccessful candidates | 6 months or less (longer with explicit consent) |
| Employee personnel records (including individual attendance records, annual leave, application forms, job or status change records, performance evaluations, termination papers, withholding information, garnishments, test results, training and qualification records) | 2 months after separation |
| Employment contracts – individual | 2 months after separation |
| Employment records-correspondence with employment agencies and advertisements for job openings | 3 years from the date of the hiring decision |
| Job descriptions | 3 years after superseded |
| Working time opt-out forms | 7 years |
| Current bank details of employees | Only as long as necessary |
| Photos/videos/images of all formats to be used on ID cards, notice boards, newsletters social media, advertising and in all other media | 2 months after the end of our relationship (other than where used in the public domain – Permanent) |
| Training and Development records (Details of training sessions, courses, certifications, and other developmental programs attended by the employee) | 7 years from the date of the training program |
| Termination and Exit Records (Resignation letters, termination notices, exit interview notes, and any other documentation related to the end of the employment) | 2 months after separation |
| Diversity, Equity, and Inclusion records (Data related to diversity initiatives, equity programs, inclusion training, and related documentation) | 5 years from the date of the initiative or program |
| Compensation and Benefits records (Salary details, bonuses, benefits, deductions, payroll records, and other compensation-related documentation.) | 7 years from the end of the fiscal year |
| Event and Workshop Records (Attendance, feedback, and materials from events or workshops hosted or attended by the company) | 7 years from the end of the event |
Note: Application forms should give the opportunity for subjects to object to their details being retained/processed.
Tax Records
General Principle: Companies must keep books of account or records sufficient to establish the amount of gross income, deductions, credits, or other matters required to be shown in any such return. These documents and records shall be kept for as long as the contents thereof may become material in the administration of tax laws.
| Record Type |
Retention Period |
| Tax-exemption documents and related correspondence | Permanent |
| Tax bills, receipts, statements | 7 years |
| Tax returns | Permanent |
| Sales/use of tax records | 7 years |
| Annual information returns | Permanent |
| Payroll/wage records for unincorporated businesses | 7 years after the year of assessment |
| PAYE records | 7 years (minimum) from the end of the tax year to which they relate |
| Maternity records | 7 years after the end of the tax year in which the maternity pay period ends |
Operational Records
| Record Type |
Retention Period |
| Client records and account information (names, addresses, email addresses, contact details, membership and subscription details, account activity, entry scan logs, visit history, and all other information associated with a client’s account). | At the moment of cancelation of their membership |
| Client engagement records: (Client interactions, projects, feedback, testimonials, and outcomes) | 7 years |
| Feedback and Survey records (Feedback forms, surveys, and assessments related to services provided, client satisfaction, and team performance) | 3 years |
| Data related to business capabilities, team alignment, organizational alignment, diversity, equity, inclusion and post-merger execution | 7 years |
| Information related to advisory services including executive recruitment, leadership development, and organizational design. | 7 years |
| Supplier records (Name, address, email and other contact information) | 7 years |
| Employee records (Name, address, payroll and other employment information as required) | 2 months after separation |
| Customer records and account information (names, addresses, email addresses, contact details, membership and subscription details, account activity, entry scan logs, visit history, and all other information associated with a client’s account). | At the moment of cancelation of their membership |
| Security and Access Logs (Records of access to company systems, buildings, or data) | 7 years |
| CCTV and facial recognition footage | 90 days of its collection |
| Record Type |
Retention Period |
| Client engagement records: (Client interactions, projects, feedback, testimonials, and outcomes) | 7 years |
| Professional Background and Qualifications (Data related to an individual’s work experience, qualifications, CV, and other professional details) | 7 years |
| Feedback and Assessment (Notes, scores, or feedback from interviews, coaching sessions, or development programs) | 7 years |
| Analytical Assessment Results (Data-driven results such as Z Score or other analytical evaluations) | 7 years |
| Diversity Data (Information related to an individual’s ethnicity, gender, disability status, and other diversity metrics) | 7 years |
| Communication Records (Emails, messages, or any other form of communication with candidates, clients, or partners) | 7 years |
Governance of this document
Our organization views data protection as a critical component of our overall security and privacy strategy. This policy is overseen and owned by our Data Protection Lead (DPL). This key document emphasizes the paramount importance of data in the digital era, mandating a review and update every 12 months by the DPL to ensure continued relevance and compliance. Breaches or non-compliance should be promptly reported to the DPL, highlighting our steadfast commitment to safeguarding our stakeholders’ interests.
