Data Retention Policy
Purpose
This schedule sets out how long EducatedOn (a Three 17 Limited product) retains different categories of data, and what happens to that data at the end of its retention period.
We keep personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law - for example for tax, accounting, regulatory or limitation-period reasons. This principle applies both to data we hold as a controller (our own business and marketing records) and to data we process as a processor on behalf of our customers.
This schedule should be read alongside our Privacy Policy and our Data Processing Information.
Customer data held as a processor
Where a customer uses AutomatedOn to process data through their configured Processes, Actions and connected Data Feeds, Three 17 acts as a processor and the customer as controller. The customer determines retention for that data, subject to the following platform defaults.
|
Data category |
Retention period |
Notes |
|---|---|---|
|
Learner Records |
Configurable |
Configurable to clients requirements |
|
Learning Content and Resources |
For the duration of the subscription |
Restored from backup if a customer requests recovery |
|
Execution logs and audit trails |
12 months |
Needed for troubleshooting, dispute resolution and security investigation |
|
Error reports and failed-run diagnostics |
3 months |
Needed for troubleshooting, dispute resolution and security investigation |
|
Integration credentials and access tokens |
Until revoked by the customer or the connection is deleted |
Stored encrypted; deleted on disconnection |
|
Backups containing customer data |
Database: 35-day point-in-time restore. Filesystem: 30 days of rolling snapshots. |
Deleted data persists in backups until the backup cycle completes |
On termination. As set out in our Data Processing Information, on termination of the agreement we will either promptly destroy all copies of Customer Personal Data in our possession, or - at the customer's written request received before termination - return one complete copy to the customer at the customer's expense and destroy all remaining copies. Where prompt destruction is not practical, particularly for backup copies not in active use, the data may be retained until our next deletion or destruction cycle.
User account data
|
Data category |
Retention period |
Notes |
|---|---|---|
|
Active user account records (name, email, job title, role) |
Duration of the subscription |
|
|
Deactivated user accounts |
Duration of the subscription |
|
|
Authentication logs (sign-in events, IP address) |
12 months |
Retained for security monitoring |
|
Passwords |
Duration of the account |
Stored hashed and salted; never stored in recoverable form |
Business and commercial records held as a controller
|
Data category |
Retention period |
Basis |
|---|---|---|
|
Customer contracts and related correspondence |
6 years after the end of the contract |
Limitation Act 1980 |
|
Invoices, receipts and VAT records |
6 years plus the current financial year |
HMRC requirements |
|
Prospect and sales enquiry records |
3 years from last active contact |
Legitimate interests |
|
General business correspondence |
3 years from our last active communication with you |
Legitimate interests |
|
Complaints and disputes |
1 year from final resolution, or 6 years where litigation is a realistic prospect |
|
|
Supplier records |
6 years after the end of the relationship |
Marketing data
|
Data category |
Retention period |
Notes |
|---|---|---|
|
Newsletter and marketing subscriptions |
Until consent is withdrawn, plus 1 year |
The additional year allows us to evidence that consent was validly obtained and honoured |
|
Suppression lists (unsubscribed contacts) |
Indefinitely |
Retained specifically so we do not contact you again |
|
Event registration and attendance records |
2 years from the event |
Website and analytics data
|
Data category |
Retention period |
Notes |
|---|---|---|
|
Website cookies and analytics data |
2 years |
|
|
Web server logs |
90 days |
Recruitment data
|
Data category |
Retention period |
Notes |
|---|---|---|
|
Unsuccessful applicant records |
6 months from the end of the application process |
|
|
Successful applicant records |
Transferred to the employee file and retained per our HR retention policy |
Support and correspondence
|
Data category |
Retention period |
Notes |
|---|---|---|
|
Support tickets and correspondence |
3 years from closure |
Retained to provide continuity of support and to evidence service levels |
What happens at the end of a retention period
When a retention period expires, or when we have no ongoing legitimate business need to process personal data, we will either securely delete it or irreversibly anonymise it.
Where immediate deletion is not technically possible - for example because the data is held within backup archives — we will securely store the data, isolate it from any further active processing, and delete it as part of the next scheduled deletion or destruction cycle.
Review
This schedule is reviewed at least annually, and is subject to change to reflect the evolving functionality of the platform and changes in data protection law.
Contact
Questions about this schedule, or requests relating to your personal data, can be sent to info@three17.co.uk.