Contents<\/strong><\/span> Client<\/strong> means any person who has signed up to TR\u2019s services, regardless of whether TR makes a claim with Her Majesty\u2019s Revenue and Customs (HMRC). This Policy sets out TR\u2019s data retention obligations and policies. This Policy applies to all data (except for employee, applicant, or service provider data) dealt with by TR (and by third-party data processors processing data on TR\u2019s behalf).<\/p>\n Under the GDPR, TR must keep data in a form which permits the identification of people for no longer than is necessary for the purposes for which TR processes the data. In certain cases, controllers may store data for longer periods (although those cases do not apply to TR).<\/p>\n The GDPR also includes the \u2018right to erasure\u2019, also known as \u2018the right to be forgotten\u2019. In other words, people have the right to have their data erased (and to prevent the processing of that data) in the following circumstances:<\/p>\n This Policy sets out the types of data held by TR for delivery of TR\u2019s services, the periods for which that data are retained by TR, the criteria for establishing and reviewing such periods, and when and how data are to be deleted or otherwise disposed of.<\/p>\n TR has a privacy manager called the Data Protection Manager. For further information on TR and other aspects of data protection and compliance with the GDPR, please contact the Data Protection Manager at: dataprotection@getyourtaxreturned.co.uk<\/a><\/p>\n The primary aim of this Policy is to set out clearly for all to see limits for TR\u2019s retention of data so that TR is accountable and transparent. TR stores data in the following ways:<\/p>\n All data held by TR is held in accordance with the requirements of the GDPR and people\u2019s rights under it, as set out in TR\u2019s Privacy Policy (link here<\/strong><\/a>). TR keeps people fully informed of their rights, what data TR holds about them, how TR uses that data, and how long TR will hold that data. People have the right:<\/p>\n TR will comply with erasure requests where it does not have an overriding reason, listed in this Policy, to retain the person\u2019s data. \u00a0Please note that:<\/p>\n Please consult the ICO\u2019s website (linked here<\/a>) if you wish to verify TR\u2019s position.<\/p>\n When the data retention periods set out in this Policy come to an end, TR will anonymise a person\u2019s data unless that person has requested erasure or restriction of processing, in which case TR will delete that person\u2019s data. When a person exercises their right to restrict TR\u2019s processing of their data or to have their data erased, where not in contravention of TR\u2019s legal obligations, TR will delete, destroy, or otherwise dispose of the data as follows:<\/p>\n Where a person provides to TR an original document (such as a passport or driver\u2019s licence), TR will not retain the original document. TR will instead make a digital copy and store that copy on TR\u2019s servers in accordance with this Policy. TR will return the original document to the person who provided it.<\/p>\n TR does not retain physical copies of documents from HMRC. TR scans documents from HMRC and stores the documents electronically. TR shreds any physical documents received from HMRC within one month of receipt. People cannot request access to original physical copies of correspondence from HMRC.<\/p>\n The Data Protection Manager is responsible for processing all \u2018right to be forgotten\u2019 requests and will process requests in accordance with this Policy and the data retention periods set out below.<\/p>\n As stated above and as required by law, TR shall not retain any data for any longer than is necessary considering the purposes for which that data is collected, held, and processed.<\/p>\n TR considers these factors when establishing and\/or reviewing retention periods:<\/p>\n If a precise retention period cannot be fixed for a data category, TR will establish criteria by which the retention of the data will be determined. This ensures that the data in question, and the retention of that data, can be regularly reviewed against those criteria. Different types of data, used for different purposes, will necessarily be retained for different periods\u00a0(and their retention periodically reviewed), as set out in the table below.<\/p>\n Notwithstanding the following defined retention periods, certain data may be deleted or otherwise disposed of before expiry of the defined retention period where a decision is made within TR to do so (whether in response to a request by a person or otherwise).<\/p>\n <—\u00a0 \u00a0Scroll\u00a0 —><\/p>\n Analytics data:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n 26 months<\/span><\/p>\n<\/td>\n<\/tr>\n Contact data:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n Until the earlier of the time it is deleted or just over 6 years from the end of the contract.<\/span><\/p>\n<\/td>\n<\/tr>\n Employment data:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n Until the earlier of the time it is deleted or just over 6 years from the end of the contract.<\/span><\/p>\n<\/td>\n<\/tr>\n Financial data:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n Until the earlier of the time it is deleted or just over 6 years from the end of the contract.<\/span><\/p>\n<\/td>\n<\/tr>\n Identification documents:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n Until the earlier of the time it is deleted or just over 6 years from the end of the contract.<\/span><\/p>\n<\/td>\n<\/tr>\n Identity data:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n Until the earlier of the time it is deleted or just over 6 years from the end of the contract.<\/span><\/p>\n<\/td>\n<\/tr>\n Legal documents:<\/strong><\/span><\/p>\n Reviewed annually<\/span><\/p>\n<\/td>\n Until the earlier of the time it is deleted or just over 6 years from the end of the contract.<\/span><\/p>\n<\/td>\n<\/tr>\n Preferences data:<\/strong><\/span><\/p>\n
\nDefinitions<\/a>
\nIntroduction<\/a>
\nContact details<\/a>
\nAims, objectives, and scope<\/a>
\nErasure and restriction of processing rights<\/a>
\nData disposal<\/a>
\nData retention<\/a>
\nImplementation<\/a><\/p>\n<\/a>Definitions<\/h3>\n
\nData<\/strong> in this Policy means personal data, which is any information relating to a person.
\nDelete<\/strong> means the removal of all or part of a client file (including data) from TR\u2019s databases and records and those of its relevant third-party processors.
\nGDPR<\/strong> means the EU Data Protection Regulation (EU) 2016\/679 which is directly effective in the UK until 31 December 2020. After that, it means the UK GDPR (which is effectively the rules in the Data Protection Act 2018).
\nPerson<\/strong> means what the GDPR calls a \u201cdata subject\u201d. People<\/strong> means more than one person. The GDPR defines a data subject as \u201can identifiable natural person, someone who can be identified, directly or indirectly\u201d.
\nTR<\/strong> means us i.e. Tax Returned Limited, an English company, number 08828062, whose registered office is 207 Regent Street, 3rd Floor, London, England, W1B 3HH.<\/p>\n<\/a>Introduction<\/h3>\n
\n
<\/a>Contact details<\/h3>\n
<\/a>Aims, objectives, and scope<\/h3>\n
\n
<\/a>Erasure and restriction of processing rights<\/h3>\n
\n
\n
<\/a>Data disposal<\/h3>\n
\n
<\/a>Data retention<\/h3>\n
\n
\n\n
\n \n Type Of Data<\/strong><\/span><\/h4>\n<\/td>\n
\n Purpose of Data<\/strong><\/span><\/h4>\n<\/td>\n
\n Review Period<\/strong><\/span><\/h4>\n<\/td>\n
\n Retention Period or Criteria<\/strong><\/span><\/h4>\n<\/td>\n<\/tr>\n<\/thead>\n\n
\n \n \n
\n \n
\n \n \n \n \n
\n \n
\n \n \n \n \n
\n \n
\n \n \n \n \n
\n \n
\n \n \n \n \n
\n \n
\n \n \n \n \n
\n \n
\n \n \n \n \n
\n \n
\n \n \n \n \n
\n \n