Data Retention Periods

Note: Where more than one data retention period applies to the data, the greater period of storage shall be used.

Data Type	Retention Period
Financial data	7 Years
Marketing data	Where legitimate interests are used as a lawful basis: Retained for six months following the most recent engagement with the client or prospect. For these purposes engagement shall mean some activity that denotes a willingness on the part of the data subject to continue to receive marketing communications for example, specific opt in, continuing to open and engage with email messages where the business is able to track such action, contacting the business to enter or continue with discussions relating to possible future business dealings. Where consent is used: Until consent is withdrawn or two years after the date the consent was given.
Potential employee data where such individual does not become an employee of the business	One year from the date of last contact with the individual
Employee data	7 years. Thereafter such data shall be minimised so that what is retained includes only the following: name; address; dates of employment; roles in which employed; main place(s) of work.
Hard copy client and supplier data	Files older than 6 years can generally be destroyed (from date of closure, not opening) Exceptions: Care cases (family) where the child we act for (or youngest child) is not yet 24 Change of name for a child who is not yet 24 PI cases where the client has an assisting person acting on their behalf Divorces that include a pension sharing order Will files
Electronic Client data	We have assessed our indefinite retention of data stored on our case management as being in our Legitimate Interests in light of the system capabilities, system provider’s plans to increase capabilities and cost of any replacement. Data will be exclusively held on our case management system. All other data will either be transferred to the system or destroyed. The business shall conduct and keep under review such LIA’s as shall be necessary to retain this category of personal data.