How long we keep data

Data retention policy (APPROVED)

Status: APPROVED by Dan, 2026-08-07 (ticket D6). The periods below

are settled. Enforcement is still manual — no code prunes data on

this timetable yet. Automatic enforcement is ticketed separately

(869ef84kn, on hold). Until that ships, this policy states an

intention we are not yet meeting, which matters if anyone asks.

Operator: Blueworkz Ltd trading as Plan & Post.

| Data | Period | Rationale |

|---|---|---|

| Planning application records without personal data (reference, proposal, dates, decisions, council) | Indefinite | Not personal data once the applicant name/address association is removed; historical planning data has analytical value. |

| Applicant personal data (name, site address as an identifier of a person) | 24 months from the decision date (or from last collection where undecided) | Long enough to serve the trades' sales cycle (approvals are actioned within months); short enough to be defensible as necessity-bounded. |

| Suppression list entries | Indefinite | The entry exists to honour an objection; deleting it would restart unwanted contact. Contains the minimum data needed to match. |

| Letter send records (who was written to, when, by which client, which template) | 6 years | Evidence of what was sent (complaints, disputes, accounting). |

| Export audit log (ExportEvent) | 6 years | Evidence of personal-data egress (UK GDPR accountability). |

| Client account and billing data | Life of account + 6 years | Tax and contract records (statutory). |

| Server/application logs containing IPs | 90 days | Operational security only. |

Deletion is destruction, not archival. Backups: purged data leaves

backups as they rotate (currently 14 nightly / 8 weekly — see

docs/BACKUP-RESTORE.md), so full disappearance lags live deletion by

up to ~8 weeks; this is documented in the privacy notice's spirit of

"deleted on a published timetable".