Data Retention and Deletion Policy
How long data is kept, and how it is removed.
Version 1.0 · Last updated 11 November 2026
Principle
Under section 39 of the Data Protection Act, 2019, personal data is kept only as long as it is reasonably needed for the purpose it was collected for, or as the law requires. It is then deleted, or anonymised so that it no longer identifies anyone.
Retention periods
| Data | Kept for |
|---|---|
| Data in client systems (we are the processor) | The term of the agreement, unless you delete it sooner or instruct otherwise |
| Client contracts and account records | The length of the relationship plus 5 years |
| Financial and tax records | 7 years |
| Helvino employee records | The length of employment plus 7 years |
| Authentication logs | 12 months |
| Website enquiries, job and partner applications | Reviewed at least once a year, and deleted or anonymised when no longer needed |
| Off-site backups | Daily copies for 30 days, monthly copies for 12 months |
When a client agreement ends
- Access to the system is revoked.
- You may request an export of your data within 14 days of termination.
- Your data is then deleted from live systems within 30 days of the end of that window, unless the law requires us to keep it.
- On request, we confirm the deletion in writing.
Backups
Backups cannot be edited record by record, so deleted data remains in existing backups until they expire on the schedule above, which is 12 months at most. Backups stay encrypted and access-controlled during that time, and are used only for disaster recovery. If a backup is ever restored, data that had been deleted is deleted again.
Deletion requests from individuals
Requests to erase or correct personal data are handled under our Data Subject Requests Procedure. Where we are the processor, we act on the instructions of the client that controls the data.