Home
/
Privacy Centre
/
Data Retention Policy

Data Retention Policy

About this policy

This Retention Policy outlines how Red Flag Alert Technology Group Ltd's ("we", "our", "us", the "Business") meets its data privacy obligations and the retention of personal data (defined as any information identifying any living person or information relating to a living person that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal data may comprise information such as a person's name, address, email address, identification number, online identifiers, and/or one or more identity verification elements.

This Policy applies to all internal employees, workers, consultants and partners to the Business. This Policy also applies equally to all Clients, Prospective Clients and any additional Third Parties

This Policy is intended to supplement our Data Protection Policy ("the DP Policy") and incorporates the definitions provided in the DP Policy https://www.redflagalert.com/privacy-centre/gdpr-data-protection-policy. This Policy should also be read in conjunction with the DP Policy and the Business's document retention and destruction processes, which outline in particular the criteria used by the Business for the retention and destruction of client and TP-related documentation. If there is a contradiction between this policy and the retention and destruction of documents in relation to Client and TP material, such policies will take precedence, to the extent that they are compatible with the UKGDPR.

The Business is responsible for keeping its documents, records, and document management systems in compliance with the regulatory environment. This policy intends to establish the Business's position regarding the retention of personal data under the UK General Data Protection Regulation (UKGDPR) and any other laws and/or regulations that may regulate the processing of personal data from time to time.

This policy applies to all employees, workers, consultants, and partners of the Company ("you" or "your"). This policy is not contractual and is not included in any employment or engagement terms and conditions. The Business reserves the right to revise, alter, amend, or replace this policy at any time. This Policy also applies to all clients, prospective clients, and other third parties, such as suppliers and vendors.

The purpose of this policy is to ensure that the Business complies with the personal data protection guidelines outlined in the UKGDPR when processing personal data, including that of clients, prospects, and other third parties, as well as that of employees, workers, consultants, and partners. Specifically, this means that:

  • Personal data must be collected only for specified, explicit and legitimate purposes. It must not be further processed in any manner incompatible with those purposes.
  • Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. When Personal Data is no longer needed for specified purposes, it is deleted or anonymised as provided by these guidelines.
  • Personal data must be accurate and, where necessary, kept up to date. It must be corrected or deleted without delay when inaccurate.
  • Personal data must not be kept in an identifiable form for longer than is necessary for the purposes for which the data is processed.
  • Sufficient technical and organisational safeguards must be in place to protect personal data from unauthorised or illegal processing, as well as from unintentional loss, destruction, or damage.

Our Data Protection Officer is responsible for compliance with this Policy and all UKGDPR requirements. Any questions about this policy should be submitted to our DPO.

Types of Personal Data

The Business gathers and provesses personal data regarding its employees (including job applicants), contractors, consultants, partners, clients, prospects and other third parties, such as suppliers and vendors of products and services.

Location of Personal Data

Personal data relating to client’s, prospects, suppliers and other third parties is held by various parts of the Business including sales, marketing and finance. All data is stored within the UK.

Business Retention and Erasure of Personal Data

The Business ensures that it adheres to the data protection principles delineated in this policy and in line with the requirements of UKGDPR, with a particular emphasis on:

  • Documents are routinely reviewed to guarantee that they are sufficient, pertinent, and restricted to the extent necessary to support the Business's operational and/or employment requirements (where applicable) and/or compliance with legal or regulatory requirements.
  • Secure storage and protection from unauthorised or unlawful processing, as well as incidental loss, destruction, or damage, are implemented for documents. The Business will employ data obfuscation techniques in accordance with the sensitivity and criticality of the data processed, and wherever feasible, anonymisation will be implemented to prevent the identification of individuals.
  • The Business will ensure that documents and records, regardless of whether they are stored in digital format or as paper records, are permanently and securely expunged following their destruction. The Business will determine whether the data requires anonymisation when a document is archived, and it is necessary to consider whether the document should be destroyed, subject to a further period of retention, or perpetual retention as an archive.

Retention and Erasure of Personal Data

We keep personal information we acquire from you if we have a valid business need to do so (for example, to provide you with a requested service or to comply with applicable legal, tax, or accounting obligations).

When we no longer have a legitimate business reason to process your personal information, we will either delete or anonymise it. If this is not possible (for example, because your personal information is stored in backup archives), we will securely store your personal information and isolate it from further processing until deletion is possible.

The Business considers the purpose for which personal data was collected when determining the appropriate retention period. Nevertheless, it also considers legal risk and, as the default retention period for all data (digital and written), documents and records, it is at least seven years (and in some cases, longer) after any contractual relationship with us has concluded.

The following criteria will be considered by the Business in determining our data retention periods:

  • Any directives or regulations from our regulatory body;
  • What our insurance providers demand and what our insurance terms state;
  • The reason we retain the Personal Data;
  • The potential risk of harm from unauthorised use or disclosure of the Personal Data;
  • Whether we need the Personal Data to defend any proceedings in line with the Statute of Limitations. This includes but is not limited to any orders for the preservation of evidence, including Personal Data that may arise within the civil or criminal courts.
  • Any legal or regulatory requirements;
  • Any specific requests from a Data Subject to retain such Personal Data;
  • Any legal, accounting, or reporting requirements. This includes any matters in relation to HR and people management and requirememts from bodies such as the HMRC;
  • Whether we must retain such Personal Data to help us carry out our services or fulfil a contract; and/or
  • Any investigations required by the regulator or law enforcement agencies within the UK or elsewhere

The schedule below provides an overview of the categories of personal information we maintain and the length of time we believe is suitable for its keeping. The schedule is meant to serve as a guide only, though, and the Business may deviate from the retention periods listed if there is a valid and legal basis to do so. In certain situations, the Business will make sure that any further retention of personal data beyond what is suggested in the schedule below takes into account the principles of protecting personal data and that the Business otherwise complies with the DP Policy Privacy Centre | Red Flag Alert. Additionally, the business will regularly evaluate its records to determine if the personal data contained therein needs to be kept on file or if it may be anonymised or deleted.

Please note the recommended retention periods set out in the below tables are subject to further review and may be changed from time to time.

Retention of client, supplier and third part personal data - schedule

Type of record containing personal data Retention period Reasons for retention period including where applicable any legal requirements

Client documents

This may include:

  • Signed contracts between the parties
  • Data processing agreements
  • Communications
  • Documents and drafts of documents including SOWs / SLAs
  • Records of telephone calls
  • Master Agreements
  • Generated reports provided as a service or product to our clients
  • Any data provided in the generation of those reports including but not limited to IDV data where such data may be disclosed to regulatory or law enforcement agencies as required
 7 years unless otherwise specified, there being a specific reason for longer retention such as the possibility of a contractual claim such as an indemnity claim after more than 7 years. Limitation Act 1980 These kinds of documents / data have the potential to be accessed more than seven years after they have been closed. It is in our legitimate interests to retain these kinds of documents for the term of the lease plus an additional three years in case we are asked to respond to enquiries about the contract after it expires.

Supplier contracts

This may include:

  • SOWs
  • Signed contracts
  • Communications
  • Notices given or received
  • SLAs
 Life of contract plus 7 years Limitation Act 1980

CRM database

This may include contact details and preferences of clients, prospects, suppliers and other third parties

 The Business’s CRM database will be reviewed on an annual basis and obsolete personal data removed or anonymised

Third party enquiries

This may include enquiries which did not convert into a contract / agreement with RFA to provide a product or service.

 1 year

Data Subject Access Requests

Any request from a data subject to exercise their rights under the UKGDPR (or other laws / regulations relating to data protection)

 7 years from the conclusion of the request Limitation Act 1980; UKGDPR

Records of Business actions

This may include:

  • Claims brought by the Business
  • Complaints against the Business which do not result in a professional indemnity notification
 In relation to legal claims, 7 years from the conclusion, settlement or withdrawal of the claim; in relation to complaints 7 years from the conclusion of our complaints procedure. Limitation Act 1980

Financial management and accounting records

This may include:

  • Annual plans and budgets
  • Accounts payable and receivable ledgers
  • Annual audit reports
  • Financial statements
  • Bank statements, cancelled cheques, deposit slips
  • Business expense records
  • Electronic fund transfer documents
  • Invoices
  • Tax records
 The current financial year and 7 years prior to it. Value Added Tax Act 1994; Limitation Act 1980

Insurance records other than documents relating to claims under our professional indemnity insurance

This may include:

  • • Insurance claims
  • • Insurance applications
  • • Insurance contracts and policies
  • • Settlement or withdrawal of claims
 In relation to insurance claims, 7 years from the conclusion, settlement or withdrawal of the claim. In relation to other insurance related documentation 7 years from the conclusion of the insurance policy to which it relates Limitation Act 1980

Retention of employee/worker/consultant/partner personal data - schedule

Type of employment record Retention period and reasons (where appropriate)

Recruitment records

These may include:

  • Completed online application forms or CVs.
  • Equal opportunities monitoring forms.
  • Assessment exercises or tests.
  • Notes from interviews and short-listing exercises.
  • Pre-employment verification of details provided by the successful candidate. For example, checking qualifications and taking up references. (These may be transferred to a successful candidate's employment file.)
  • Criminal records checks. (These may be transferred to a successful candidate's employment file if they are relevant to the ongoing relationship.)
 Six months after notifying rejected candidates of the recruitment results. The rationale for this is to account for the time constraints for any rejected candidate to file a claim for discrimination or unfair treatment resulting from the recruitment process (S.123 Equality Act 2010). For successful candidates who are hired by the Business, certain of these records (where relevant to the ongoing employment relationship) may be kept while the individual is still working. In general, application forms, CVs, assessment exercises and tests, and interview notes will be kept for no more than two years after employment begins.

Right to Work checks

 Three years after the termination of employment.

Contracts

These may include:

  • Written particulars of employment.
  • Contracts of employment or other contracts.
  • Documented changes to terms and conditions.
 While employment continues and for seven years after the contract ends. This is to take into account the limitation periods for bringing claims against the Business – Limitation Act 1980.

Payroll and wage records

These may include:

  • Details on overtime.
  • Bonuses.
  • Expenses.
  • Benefits in kind.
 These must be retained for at least three years following the end of the tax year to which they pertain. However, due to their possible importance in wage disputes, they will be kept for seven years after employment ends. See Gov.uk: PAYE and payroll for employers; https://www.gov.uk/paye-for-employers/keeping-records; as well as Section 5 of the Limitation Act 1980 and the National Minimum Wage Regulations 1998 (as modified).

Current bank details

 Bank details will be deleted as soon after the end of employment as possible once final payments have been made

PAYE records

 These must be retained for at least three years following the end of the tax year to which they pertain. However, due to their possible importance in wage disputes, they will be kept for seven years after employment ends.

Payroll and wage records for LLPs

 These must be retained for six years after the fiscal year end in which payments were made. However, due to their possible importance in wage disputes, they will be kept for seven years after employment ends.

Records in relation to hours worked and payments made to workers

 These must be preserved for three years, beginning on the day the pay reference period immediately following the one to which they relate ends. However, due to their possible importance in pay disputes, they will be kept for seven years after the employment relationship ends (employment Time Regulations 1998 and Limitation Act 1980).

Travel and subsistence.

 While employment continues and for seven years after employment ends (Limitation Act 1980).

Record of advances for season tickets and loans to employees

 While employment continues and for seven years after employment ends.

Personnel records

These include:

  • Qualifications/references.
  • Consents for the processing of special categories of personal data.
  • Annual leave records.
  • Annual assessment reports.
  • Disciplinary procedures.
  • Grievance procedures.
  • Death benefit nomination and revocation forms.
  • Resignation, termination and retirement.
 While employment continues and for seven years after employment ends (Limitation Act 1980).

Records in connection with working time

Working time opt-out

 Three years from the date on which they were entered into (Working Time Regulations 1998)

Records in connection with working time

Records to show compliance, including:

  • Time sheets for opted-out workers.
  • Health assessment records for night workers.
 Three years after the relevant period (Working Time Regulations 1998)

Maternity records

These include:

  • Maternity payments.
  • Dates of maternity leave.
  • Period without maternity payment.
  • Maternity certificates showing the expected week of confinement.
 Four years following the end of the tax year in which the maternity pay period expires (Regulation 26, The Statutory Maternity Pay (General) Regulations 1986, as modified).

Accident records

These are created regarding any reportable accident, death or injury in connection with work.

 For at least four years from the date the report was made (to take into account limitation period under Limitation Act 1980 and time for issuing and serving proceedings).