Definitions <\/a><\/p>\n Business relationship <\/strong>means the period during which TR is engaged in the performance or administration of services for a person <\/a><\/p>\n This Policy sets out TR\u2019s data retention obligations and policies. This Policy applies to all data (except for employee, applicant, or service provider data) dealt with by TR (and by third-parties processing data on TR\u2019s behalf).<\/p>\n TR must keep data in a form which permits the identification of people for no longer than is necessary for the purposes for which TR processes the data. In certain cases, controllers of personal data may store data for longer periods (although those cases do not apply to TR).<\/p>\n People also have the \u2018right to erasure\u2019, also known as \u2018the right to be forgotten\u2019. People have the right to have their data erased (and to prevent the processing of that data) in the following circumstances:<\/p>\n This Policy sets out the types of data held by TR for delivery of TR\u2019s services, the periods for which that data is retained by TR, the criteria for establishing and reviewing such periods, and when and how data are to be deleted or otherwise disposed of.<\/p>\n <\/a><\/p>\n The primary aim of this Policy is to set out clearly TR\u2019s data retention limits so that TR is accountable and transparent. TR stores data in the following ways:<\/p>\n <\/a><\/p>\n TR holds all data in accordance with the requirements and rights set out by the Data Protection Act 2018, as detailed in TR\u2019s Privacy Policy<\/a>. TR keeps people fully informed of their rights, the data TR holds about them, how TR uses that data, and how long TR will hold that data. People have the right:<\/p>\n TR will comply with erasure requests where it does not have an overriding reason, listed in this Policy, to retain the person\u2019s data. Please note that:<\/p>\n Please consult the relevant section of the ICO\u2019s website (linked here<\/a>) if you wish to verify our position.<\/p>\n <\/a><\/p>\n At the end of the data retention periods set out in this Policy, TR will fully anonymise a person\u2019s data unless that person has requested erasure or restriction of processing. If a person requests erasure or exercises their right to restrict TR\u2019s processing of their data, TR will delete, destroy, or otherwise dispose of the data (subject to any legal obligations).<\/p>\n Where a person provides to TR an original document (such as a passport or driver\u2019s licence), TR will store a digital copy of this document on its servers in accordance with this Policy. In this case, TR may return the original document to the person who provided it.<\/p>\n TR does not retain physical copies of documents from HMRC. TR scans documents from HMRC and stores the documents electronically. TR cannot provide original copies of documents from HMRC because TR shreds any physical documents received from HMRC within one month of receipt.<\/p>\n TR\u2019s Data Protection Manager is responsible for processing all \u2018right to erasure\u2019 requests in accordance with this Policy and the data retention periods set out below.<\/p>\n <\/a><\/p>\n TR shall not retain any data for longer than is necessary considering the purposes for which it collected, held, and processed that data.<\/p>\n TR considers the following factors when establishing and\/or reviewing retention periods:<\/p>\n TR considers carefully the criteria by which it determines data retention periods. TR periodically assesses the suitability of these criteria. TR uses distinct data for different purposes and therefore retention periods vary accordingly.<\/p>\n Notwithstanding the following defined retention periods, TR may erase or destroy certain data before expiry of the defined retention period where it is legally permitted to do so.<\/p>\n Type of Data<\/strong><\/p>\n<\/td>\n Analytics data:<\/p>\n \u00b7 Cookies<\/p>\n \u00b7 User identifiers<\/p>\n \u00b7 Advertising identifiers<\/p>\n<\/td>\n o To track website usage<\/p>\n o To track advertising campaigns<\/p>\n<\/td>\n Annually<\/p>\n<\/td>\n 26 months<\/p>\n<\/td>\n<\/tr>\n Contact data:<\/p>\n \u00b7 Postal address<\/p>\n \u00b7 Email address<\/p>\n \u00b7 Telephone number<\/p>\n<\/td>\n o To enter and fulfil a contract<\/p>\n o Business analytics and development<\/p>\n<\/td>\n Employment data:<\/p>\n \u00b7 Employment history<\/p>\n \u00b7 Sector<\/p>\n \u00b7 Job title<\/p>\n<\/td>\n o To fulfil a contract<\/p>\n o Business analytics and development<\/p>\n<\/td>\n Financial data:<\/p>\n \u00b7 Bank details<\/p>\n \u00b7 Transaction data<\/p>\n<\/td>\n Identity data:<\/p>\n \u00b7 First name<\/p>\n \u00b7 Former names<\/p>\n \u00b7 Last name<\/p>\n \u00b7 Marital status<\/p>\n \u00b7 Title<\/p>\n \u00b7 Date of birth<\/p>\n \u00b7 National Insurance number<\/p>\n \u00b7 Unique Tax Reference number<\/p>\n \u00b7 Customer reference number<\/p>\n \u00b7 IP address<\/p>\n<\/td>\n o Business analytics<\/p>\n and development<\/p>\n o Security measures<\/td>\n Identity verification data:<\/p>\n \u00b7 Nationality<\/p>\n \u00b7 Place of birth<\/p>\n \u00b7 Sex<\/p>\n \u00b7 Passport number<\/p>\n \u00b7 Driver\u2019s licence number<\/p>\n \u00b7 Photo<\/p>\n \u00b7 Next of kin<\/p>\n \u00b7 Relatives<\/p>\n \u00b7 Spouse<\/p>\n \u00b7 Civil partner<\/p>\n \u00b7 Place of birth<\/p>\n \u00b7 Place of death<\/p>\n \u00b7 Nature of death<\/p>\n \u00b7 Time of death<\/p>\n \u00b7 Officiating persons<\/p>\n \u00b7 Witnesses<\/p>\n \u00b7 Contact details of mentioned persons<\/p>\n<\/td>\n o To verify any name changes<\/p>\n o To verify the relevant person to receive funds in the event of a customer\u2019s death.<\/td>\n Preferences data:<\/p>\n \u00b7 Marketing preferences<\/p>\n \u00b7 Prize draw preferences<\/p>\n \u00b7 Communication preferences<\/p>\n<\/td>\n o To manage prize draws<\/td>\n Tax data:<\/p>\n \u00b7 Income (taxable or untaxable)<\/p>\n \u00b7 Tax paid<\/p>\n \u00b7 Taxable expenses (received and claimed)<\/p>\n \u00b7 Tax account balance (overpaid or underpaid)<\/p>\n \u00b7 Source of income (if pension fund)<\/p>\n \u00b7 Pension contributions<\/p>\n \u00b7 Student Loan Repayments<\/p>\n<\/td>\n o Business analytics and development<\/td>\n Technical data:<\/p>\n \u00b7 Login details<\/p>\n<\/td>\n \u00b7 Name of union<\/p>\n \u00b7 Membership fees<\/td>\n o Business analytics and development<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/a><\/p>\n TR has a privacy manager called the Data Protection Manager. For further information on TR and other aspects of our data protection and compliance policies, please contact the Data Protection Manager at: dataprotection@getyourtaxreturned.co.uk<\/a><\/p>\n
\n<\/a>Introduction
\n<\/a>Contact details
\n<\/a>Aims, objectives, and scope
\n<\/a>Erasure and restriction of processing rights
\n<\/a>Data disposal
\n<\/a>Data retention
\n<\/a>Implementation<\/a><\/p>\nDefinitions<\/h3>\n
\nClient<\/strong> means any person who has signed up to TR\u2019s services, regardless of whether TR submits a claim to His Majesty\u2019s Revenue and Customs (HMRC) on their behalf.
\nData<\/strong> in this Policy refers to personal data, which means any information relating to a person.
\nDelete<\/strong> means the removal of all or part of a client file (including data) from TR\u2019s databases and records and those of its relevant third-party processors.
\nPerson<\/strong> is what the UK GDPR calls a \u201cdata subject\u201d. The UK GDPR defines a data subject as \u201can identifiable natural person\u201d or someone who can be identified, directly or indirectly.
\nPeople<\/strong> means more than one Person.
\nTR<\/strong> means Tax Returned Limited, a company registered in England, number 08828062, whose registered office is 207 Regent Street, 3rd Floor, London, England, W1B 3HH.<\/p>\nIntroduction<\/h3>\n
\n
Aims, objectives, and scope<\/h3>\n
\n
Erasure and restriction of processing rights<\/h3>\n
\n
\n
Data disposal<\/h3>\n
\n
Data retention<\/h3>\n
\n
\n\n
\n \n Purpose of Data<\/strong><\/td>\n Review Period<\/strong><\/td>\n Retention Period or Criteria<\/strong><\/td>\n<\/tr>\n<\/thead>\n\n \n \n \n \n \n \n \n \n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n \n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n o To fulfil a contract<\/td>\n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n o To enter and fulfil a contract<\/p>\n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n o To perform identity verification checks<\/p>\n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n o To correctly manage your communication and marketing preferences<\/p>\n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n o To fulfil a contract<\/p>\n Annually<\/td>\n The earlier of the time of deletion or 6 years from the end of the contract to which the data relates.<\/td>\n<\/tr>\n \n \n o Security and Identification measures<\/td>\n Annually<\/td>\n The earlier of the time of deletion or for the duration required to perform the contract to which the data relates.<\/td>\n<\/tr>\n \n Trade union data:<\/p>\n o To fulfil a contract<\/p>\n Annually<\/td>\n \n Contact details<\/h3>\n