Legal
Data Retention Policy
Effective from 2026 · Olive Branch Design Ltd
1. Purpose
This policy explains how long we keep personal data and why, in line with UK GDPR requirements.
2. Retention Schedule
| Data Type | Retention Period | Reason |
|---|---|---|
| Client Project Files | 6 years | Contract & legal obligations |
| Website Form Submissions | 2 years | Customer service |
| Newsletter Sign-Ups | Until unsubscribed + 2 years | PECR compliance |
| Blog Subscriptions | Until unsubscribed | — |
| Comments | 2 years | — |
| Stripe Payment Data | 6 years | Tax & accounting |
| Analytics Cookie Data | 1–24 months | — |
| Advertising Cookie Data | 1–24 months | — |
| Consent Logs | 2 years | PECR compliance |
| Social Media Messages | 1 year | — |
| Email Communications | 2 years | — |
| Portfolio & Case Studies | Indefinite unless removal requested | — |
| Business Records | 6 years | Legal obligation |
3. Secure Deletion
When data reaches the end of its retention period, we delete or anonymise it using appropriate methods:
- Permanent deletion from databases and systems
- Clearing of logs
- Removal of files from storage
- Deletion of cloud storage items
4. Your Rights
You may request early deletion, access, correction, or restriction of your data. Contact us at admin@tomattwood.me.
5. Review
This policy is reviewed annually or whenever our systems or legal obligations change.