Data Retention Policy

1. Purpose and scope

1.1 This Data Retention Policy (the “Policy”) sets out how long CERTSYNC LIMITED (“CertSync”) keeps Personal Data and when it deletes it, under the storage-limitation principle in Article 5(1)(e) of the UK GDPR. It covers Personal Data CertSync controls and Personal Data it processes for Customers, in connection with the CertSync platform, website and mobile apps (the “Service”).

1.2 Read this Policy with the Privacy Notice, the Data Processing Agreement (the “DPA”), the Terms of Service and the Sub-processor List. If this Policy and another document differ on how long data is kept, this Policy applies, except that the DPA prevails on Customer Personal Data, as clause 22.1 of the Terms provides.

2. Definitions

2.1 Terms defined in the Privacy Notice or the DPA have the same meaning here.

2.2 “Read-Only Grace Period” means the 90-day period that begins on the day after the Customer's billing cycle ends following cancellation, during which the Customer keeps read-only access to its account data and may reactivate the account at any time.

2.3 “Day 91” means the day after the Read-Only Grace Period ends, on which the deletion in clause 3.4 takes effect.

2.4 “Customer Personal Data” means Personal Data CertSync processes for a Customer as processor, including Certificate Content, certificate-delivery and verification records, and Cross-Certificate Memory.

2.5 “Service Personal Data” means Personal Data for which CertSync is controller, including Account Data, Audit and Security Data, Payment Metadata, and Cookie, Analytics and Attribution Data.

3. Retention model — 90-day default

3.1 During an Active Subscription. CertSync keeps the Customer's Account Data, Certificate Content, Cross-Certificate Memory, Payment Metadata and Communications Data in full, and the Customer's authorised users have full access in line with the roles the Customer has set.

3.2 At cancellation. When a Customer cancels its subscription:

3.2.1 the account stays on the paid plan, with full access, until the end of the current billing cycle, and nothing more is charged;

3.2.2 CertSync emails a cancellation confirmation to the address on file; and

3.2.3 the deletion timer in clause 3.4 starts only when that cycle ends.

3.3 Read-Only Grace Period. On the day after the cancelled cycle ends, the account enters a Read-Only Grace Period of 90 calendar days. During it:

3.3.1 the Customer can sign in, view, download and export certificates, but cannot send a certificate from within the Service or turn on certificate verification;

3.3.2 the Customer cannot create or edit certificates;

3.3.3 there is no charge;

3.3.4 CertSync emails deletion warnings thirty days, seven days and one day before day 91; and

3.3.5 the Customer may reactivate under clause 3.5.

3.4 Day 91 deletion. If the Customer has not reactivated, on day 91:

3.4.1 CertSync deletes the Service Personal Data it holds for the account from its live systems, except as clause 4 allows;

3.4.2 CertSync deletes all Customer Personal Data from its live systems, including Certificate Content and certificate-delivery and verification records, and instructs each Sub-processor to delete what it holds for the Customer, as Article 28(3)(g) UK GDPR requires;

3.4.3 Cross-Certificate Memory for the account is deleted in the same step (clause 8); and

3.4.4 copies of the deleted data that remain in CertSync's encrypted backups expire on the backup schedule in clause 7, and are never used again.

3.5 Reactivation. At any time during the Read-Only Grace Period the Customer may reactivate the subscription. This restores full access and stops the deletion timer. Reactivation is not possible after day 91: the account and its Personal Data have then been removed from CertSync's live systems (except the records clause 4 keeps) and cannot be restored, and a returning Customer must sign up again.

3.6 Exports. During an Active Subscription and the Read-Only Grace Period, the Customer may download, free and as often as it likes: (a) a data export, a ZIP archive with a structured, machine-readable JSON record of all Customer Personal Data the Customer has entered and a JSON file for each certificate; (b) a certificate export, a ZIP archive of PDF copies of the certificates the Customer selects, with photographs and other attachments appended; and (c) a certificate-metadata export in CSV format. These are three separate downloads. Once downloaded they are the Customer's own record; after day 91 CertSync is no longer the system of record.

3.7 Leaving a team. If you leave or are removed from a team, your account is deleted 90 days later; certificates you created for that team stay with the team.

3.8 Copies on devices. So that work can continue without a connection, the CertSync mobile apps, and a browser used for offline working, keep an encrypted copy of the certificates, customers, sites and related records the user can see on that device. That copy is deleted from the device:

3.8.1 when the user signs out, if nothing on the device is waiting to sync. If changes are still waiting, the copy is kept, still encrypted, so the user can sign back in on that device and finish syncing, and it is deleted at a later sign-out once nothing is waiting;

3.8.2 when the user chooses to clear the offline data on that device; and

3.8.3 automatically, the next time the device connects to CertSync after the user's access has ended because their account was deleted or closed, they left or were removed from their team, or the team was deleted. Any unsynced changes are deleted too, because CertSync can no longer accept them.

3.8.4 A device that never connects again keeps its encrypted copy until the app, or the browser's data for the CertSync website, is removed from it.

4. Statutory exceptions (Service Personal Data)

4.1 CertSync keeps the data below after day 91 only as far as the stated obligation or interest requires. These are retentions of Service Personal Data, for which CertSync is controller, not of Customer Personal Data.

4.2 Invoice reference data

4.2.1 Stripe issues the invoices for the Customer's subscription and keeps them, with the payment history, in CertSync's Stripe account. Each invoice shows the billing name, email address, amount and date. CertSync's own systems keep no copies of invoices and no separate payment ledger. CertSync keeps these invoice records for 6 years after the end of the accounting period in which the payment was made, and longer only while an HMRC enquiry into that period is open.

4.2.2 The legal basis is Article 6(1)(c) UK GDPR (legal obligation): CertSync must keep its company tax records for that period under the Finance Act 1998, Schedule 18, paragraph 21. The six-year limitation period for contract claims in section 5 of the Limitation Act 1980 ends at about the same time.

4.2.3 Deleting the Stripe customer at day 91 does not delete its invoices: they stay in CertSync's Stripe account, and each still shows the billing name and email address. The Stripe invoice identifier can also be used to look up those details in Stripe, so CertSync does not treat that reference as anonymised data, and handles the invoices as Personal Data.

4.2.4 At the end of the period in clause 4.2.1, the personal elements of those invoice records (name, email address and billing contact) are deleted or anonymised.

4.3 Anonymised security audit log

4.3.1 Audit-log entries that record actions and security events against the account are anonymised when the user is deleted, as the Privacy Notice describes. The anonymised log is kept for six years from the date of anonymisation and then deleted.

4.3.2 The basis is Article 6(1)(f) UK GDPR: the legitimate interest of CertSync and of its users in an intact security record and in being able to bring or defend legal claims within the six-year limitation period under sections 2 and 5 of the Limitation Act 1980. Article 17(3)(e) UK GDPR applies during that period.

4.3.3 Once anonymised, an entry no longer identifies anyone, so it is no longer Personal Data (UK GDPR Recital 26).

4.4 Privacy complaint records

4.4.1 CertSync keeps the record of a privacy complaint and its handling for six years after the complaint is closed, and then deletes it.

4.4.2 The basis is Article 6(1)(c) UK GDPR, to show that CertSync met its duty to handle complaints under section 164A of the Data Protection Act 2018, and Article 6(1)(f), to bring or defend legal claims within the limitation period under the Limitation Act 1980.

4.5 AI credit purchase records

4.5.1 Where a Customer has purchased AI credits, the AI credit ledger — which records how those credits were granted and spent, and by which user — is deleted in full with the Customer's account at day 91, in accordance with clause 3. The ledger is the Customer's own financial record: each spend keeps a reference to the user who made it (an internal identifier, not a name or email address), and that reference stays on the ledger after the user leaves the Customer or their own account is erased, until the ledger itself is deleted. Before that deletion takes place, CertSync writes one record of each purchase, comprising the payment-processor reference for the purchase, the number of credits purchased, and the purchase date.

4.5.2 That record is retained on the same legal basis, and to meet the same record-keeping obligations, as the invoice reference data described at clause 4.2; those obligations and that basis are set out at clause 4.2.2. CertSync does not run an automated deletion of this record.

4.5.3 The record is created without a user identifier, an account identifier or an email address. Because the payment reference can be matched to the payment Stripe holds, CertSync treats the record as Personal Data.

4.6 No further statutory exceptions

CertSync keeps no other Personal Data after day 91, except as this clause 4 allows. In particular, it does not rely on BS 7671 as a retention basis (clause 5.3).

5. Customer's own retention obligations

5.1 Clauses 3 and 4 are CertSync's retention rules. The Customer is the controller of Certificate Content and is responsible for any retention obligation of its own. Depending on its circumstances these may include HMRC record-keeping, the limitation periods in the Limitation Act 1980 (including the latent-damage rules in section 14A), the conditions of a competent-person scheme such as NICEIC or NAPIT, and the Building Regulations regime for notifiable work.

5.2 To meet them, the Customer should download the exports in clause 3.6 before day 91 and keep them for as long as its obligations require. The Customer's own copies are outside this Policy.

5.3 BS 7671 is not a retention rule. BS 7671 does not set a period for which a certifying party must keep documents; Part 514 deals with identifying and labelling an installation. A fixed retention period quoted in the trade is custom, not statute.

5.4 This clause is general information, not legal advice. The Customer should take its own advice on how long to keep its records.

6. Sub-processor retention

6.1 CertSync's contract with each Sub-processor requires it to delete or return Personal Data on CertSync's instruction at the end of the service (Article 28(3)(g) UK GDPR). A Sub-processor's own backups age out on its documented schedule.

6.2 Stripe is an independent controller for card details and card-transaction history, which it keeps under its own retention schedule. At day 91 CertSync deletes the customer at Stripe and removes the Stripe customer identifier from the user's account. The subscription's Stripe references and the invoices in clause 4.2 are kept for the period set out there. CertSync cannot make Stripe delete data Stripe holds as controller. Requests about that data go to Stripe.

7. Backups

7.1 CertSync's primary database is protected by MongoDB Atlas's Cloud Backup service. Backups are encrypted and held in a single region in London (AWS eu-west-2).

7.1.1 Point-in-time recovery covers the last 7 days.

7.1.2 Snapshots are kept as follows: snapshots taken every six hours and daily snapshots, 7 days; weekly snapshots, 4 weeks; monthly snapshots, 3 months. No yearly snapshot is kept.

7.1.3 CertSync also takes its own encrypted application backup each day, stored in Vercel Blob and MongoDB Atlas.

7.1.4 Each application backup is deleted automatically when its expiry date passes, no more than 190 days after it was taken.

7.2 Deleted data in backups. Data deleted from live systems, at day 91 or on an erasure request, can remain in backups taken before the deletion. The longest it can remain is 190 days after deletion, when the last application backup holding it expires. Backups are encrypted, are not searched or used for any other purpose, and are used only to recover from data loss.

7.3 Deleted data is not restored into live use, except in a disaster-recovery restore.

7.4 Restore buffer. If CertSync restores from a backup that holds data deleted since it was taken, CertSync deletes that data again promptly and in any event within seven calendar days of the restore.

8. Cross-Certificate Memory

8.1 Cross-Certificate Memory is the customer, site, installation and contractor details a user has entered on certificates, saved so that the same user can pre-fill later certificates.

8.2 It is Customer Personal Data. CertSync processes it as processor, on the Customer's instructions, and uses it for nothing else. It is held against the user who entered it and is never shown to or used for any other Customer.

8.3 A user can pause or clear it in their account settings. It is deleted when that user's account is deleted, and in any event with the Customer's account at day 91. Clearing it does not change the certificates themselves.

8.4 A person whose details appear in it should contact the electrician or contractor who holds them, as controller. CertSync will help that Customer respond.

9. Deleting your account and rights to early deletion

9.1 In the app or on the website. Signed in, go to Settings → Account → Delete Account. You will be asked to confirm your identity before the account is deleted. This works the same in the CertSync iOS and Android apps and on certsync.co.uk.

9.2 By email. If you cannot sign in, email support@certsync.co.uk from the address on your account, with the subject “Account deletion request”. We will check that the request comes from the account holder before acting on it, and confirm by email when it is done.

9.3 What is deleted. Your access ends and your profile is erased as soon as the deletion completes. Your certificates and other records are deleted from our live systems after a further 90 days. Copies in our encrypted backups then expire on the schedule in clause 7, within 190 days at the latest. Certificates you created for a team stay with that team (clause 3.7). Export anything you need first (clause 3.6), because it cannot be recovered afterwards.

9.4 What is kept. We keep the payment records in clause 4.2 for the period stated there, the anonymised security log in clause 4.3, and any privacy complaint record in clause 4.4. Stripe keeps its own payment records (clause 6.2).

9.5 Cancelling instead. If you would rather keep read-only access to your certificates for a while, cancel your subscription instead. That starts the Read-Only Grace Period in clause 3.3. During it, a Customer can ask by email to privacy@certsync.co.uk for deletion to happen straight away instead of on day 91. We act on a verified request within five working days.

9.6 Your right to erasure. Anyone may ask us to erase their Personal Data under Article 17 UK GDPR by writing to privacy@certsync.co.uk. We reply within one month, which we may extend by up to two further months for a complex request, telling you why within the first month. If the request would in any case be met by the day-91 deletion, we act on it then and confirm that to you within the month.

9.7 Exceptions. The right to erasure does not cover data we must keep by law, such as the payment records in clause 4.2 (Article 17(3)(b)), or data needed for legal claims, such as the anonymised security log in clause 4.3 (Article 17(3)(e)).

10. Contact

For questions about how long we keep your data, or to make an erasure request, contact: