CROESO PUBS LTD · SUPERCOMPUTER
Data Retention and Deletion Policy
Version 1.0 · Approved 20 October 2026
Policy contact: info@croesopubsltd.co.uk
Approval: Croeso management · Effective date: 20 October 2026 · Review: annually
Approved policy. Croeso management adopted this schedule on 20 October 2026. It does not confirm that automatic deletion, backup expiry or deletion across connected services is already configured. Complete the implementation checks before presenting these periods as current app behaviour.
1. Purpose and scope
Keep information only for a documented business or legal need, restrict access while it is retained, and securely delete or irreversibly anonymise it when that need ends. This policy covers Supercomputer accounts, operational records, uploads, associated service logs, exports and copies held in connected services. It is not a replacement for specialist HR, safeguarding, health-and-safety or statutory records schedules.
2. Retention schedule
Except for legal requirements, these periods are adopted business choices, not universal statutory deadlines. A record that meets more than one category follows the applicable longer requirement only where necessary; unnecessary duplicates and unrelated personal details should still be removed.
| Record | Period and trigger | Reason and disposal |
|---|
| Staff sign-in accounts and permissions | While access is required. Disable access immediately when employment/access ends or an account is compromised. Delete the authentication account and unnecessary profile details within 90 days of access ending. | Allow a controlled handover and investigate access issues. Revoke sessions and saved access where supported. Retain only the attribution needed for records still lawfully retained; do not keep an active login merely to preserve an author name. |
| Unused invitations and temporary review accounts | Remove unaccepted invitations after 30 days. Remove review accounts within 30 days after the review/testing purpose ends, unless an ongoing review is documented. | Avoid dormant access. Temporary password expiry is separate from account deletion. |
| Official accounting records and supporting reports: P&Ls, sales, ledger, invoices and financial evidence | 6 years from the end of the company financial year to which they relate, longer where HMRC rules, an enquiry, transaction or other applicable obligation requires. | Accounting and tax obligations. Finance identifies the authoritative record. App duplicates can be deleted sooner once the authoritative copy is verified and available. |
| Payroll and individual wage information, if uploaded | At least 3 years after the end of the relevant tax year for PAYE records; retain for the accounting period above where the record is also necessary accounting evidence. Finance must check any additional payroll, minimum-wage, pension or employment requirements. | Restrict to authorised finance/HR staff. Use venue totals instead of identifiable employee pay wherever individual detail is unnecessary. This is not a blanket rule for every HR record. |
| Routine management notes, actions, campaigns and live-music requests | 24 months after completion or closure. Review open items annually and close obsolete records. | Operational follow-up and comparison across trading seasons. Delete or anonymise at expiry. Transfer any necessary financial/contractual evidence to its proper record category. |
| Routine maintenance requests | 24 months after closure, unless they form part of financial evidence, asset servicing history, a warranty, a safety record or a claim. | Retain the necessary evidence under the relevant finance, asset or safety schedule. Do not apply the routine limit to statutory inspections or incident evidence. |
| Attachments, source uploads and exports | Necessary evidence follows its parent record. Temporary, duplicate or superseded import files: delete within 30 days after successful validation and verification of the retained record. | Preserve source evidence needed for accounting or reconciliation. Failed uploads or abandoned server-side staging files should expire within 30 days. Review local downloads separately. |
| Push-notification tokens and subscriptions | Remove on account deletion, permanent delivery failure or opt-out where supported; otherwise expire after 90 days without renewal. | Deliver work notifications while permission and account access remain valid. Remove associated endpoints as well as database entries. |
| Technical diagnostic logs | 90 days from creation. | Troubleshooting and service reliability. Avoid passwords, tokens and unnecessary report content in logs. Preserve only the extracts needed for a documented investigation. |
| Security/access audit logs | 12 months from the event. | Detect and investigate misuse. Content-level authorship/change history follows the parent record. Review extensions for active incidents. |
| Emails generated by the app | Routine duplicate notifications: 90 days after actioning. Emails that are the authoritative business record follow that record's schedule. | Apply mailbox retention rules and cover attachments. Deleting an app record does not automatically delete an email already delivered. |
| Privacy requests and deletion audit | 3 years after the request is closed or deletion is completed. | Demonstrate how the request was handled. Keep a minimal case record, not a copy of the deleted content; review identity evidence and remove it as soon as no longer needed. |
| Recovery backups and historical object versions | Rolling maximum of 90 days after backup/version creation, unless a documented legal hold applies. | Recovery only, with restricted access. Deleted data may remain until backup expiry; do not restore it to routine use. Reapply deletion records before a restored system returns to service. |
3. Exceptions and legal holds
Suspend routine deletion only for the specific records needed for a legal obligation, tax enquiry, complaint, employment dispute, safety incident or reasonably anticipated claim. Record the reason, scope, owner and next review date; review at least every 3 months. Release the hold when no longer needed and apply the original schedule. A hold must not preserve an entire account indefinitely without justification.
4. Privacy and deletion requests
Send requests to info@croesopubsltd.co.uk. The responsible manager must log and route the request promptly, verify identity proportionately, locate relevant records and assess applicable rights and exemptions. Work to the applicable statutory response deadline; the monthly housekeeping cycle must not delay a rights request. Explain any justified retention rather than promising that every record can be deleted on demand.
5. Disposal process and responsibilities
A designated administrator checks for expired records monthly, with Finance approving financial classification and retention exceptions. Before deletion, check legal holds, confirm which system holds the authoritative record and identify copies in AWS storage/databases, authentication, Notion, Microsoft services, email, exports and other connected systems. Apply least-privilege access throughout.
Delete content securely, including old versions and recoverable copies according to their schedules, or use genuine irreversible anonymisation. Replacing a name with an identifier is not anonymisation if it can still be linked to a person. Record the category, scope, date, method, responsible person and outcome of disposal without recreating the removed personal data.
6. Implementation and ongoing administration
- Management has approved the schedule and effective date; an accountable owner must oversee implementation.
- Finance confirms accounting/payroll classifications and any longer statutory needs.
- Inventory live storage, Notion/Microsoft copies, email, exports, backups and historical versions; verify actual expiry and restoration behaviour.
- Configure and test retention jobs, leaver access removal, notification endpoint cleanup, legal holds and deletion audit. Use manual controlled reviews until automation is proven.
- Update the staff/app privacy notice to describe actual practice, including backup delays, and communicate the policy to administrators.
- Review annually and when new features, data types or legal requirements change.
Sources and basis
The ICO requires organisations to justify how long employment information is needed and maintain a retention schedule; it does not prescribe one general retention period for all staff data. The operational periods in this policy are Croeso's adopted choices. Official financial-record rules are referenced below.