Data retention policy
Company: Northgate Supplies Ltd
Applies under the law of: Germany
Owner: Data Protection Officer
Effective from: 1 May 2027
Next review: 1 May 2028
Purpose
Northgate Supplies Ltd keeps records only as long as it needs them for a clear reason, such as a legal duty, a contract or a real business need. Keeping data too long is a risk, and deleting it too early can break the law or lose evidence.
Principles
- Keep what we need, no more, and no longer than needed.
- Every kind of record has an owner, a reason and a keeping period.
- Personal data is deleted or anonymised when the period ends.
- Records are kept safely while we hold them and destroyed safely afterwards.
Retention schedule
| Record | Keep for | Reason | Where it is kept |
|---|---|---|---|
| Customer orders and invoices | 7 years from the end of the financial year | Tax and accounting law | Finance system |
| Employee files | 6 years after leaving | Employment claims | HR system |
| Job applications, unsuccessful | 12 months | Handle complaints | Recruiting tool |
| CCTV footage | 30 days | Security | Local recorder |
| Website analytics | 14 months | Service improvement | Analytics tool |
Deletion
Digital records are deleted from systems and backups on the next backup cycle. Paper records are shredded by a certified service.
Legal holds
If a claim, investigation or audit is likely, the owner may stop deletion of the records involved until told otherwise.
Exceptions
Anything outside the schedule needs the owner's written approval.
Roles
- Data Protection Officer maintains the schedule and answers questions.
- Department heads make sure their records follow it.
- Everyone keeps records in approved systems only and does not copy them elsewhere.
The schedule is reviewed on or before 1 May 2028.