How long we keep data

Data retention policy (APPROVED)

Renamed 2026-08-20 (ticket 869em1n5x): the trading name changed

from Plan & Post to Just Granted. The controller is unchanged —

Blueworkz Ltd, company number 13258077. The contact address and

website named below still read planandpost.co.uk: the new domain

and mailbox are separate tickets (869em1nqu, 869em1ny7), and the

old address keeps working either way.

Status: APPROVED by Dan, 2026-08-07 (ticket D6). The periods below

are settled. Enforcement is still manual — no code prunes data on

this timetable yet. Automatic enforcement is ticketed separately

(869ef84kn, on hold). Until that ships, this policy states an

intention we are not yet meeting, which matters if anyone asks.

Re-confirmed by Dan 2026-08-11: 24 months is final and not

re-opened. The boundary between tickets, so it is not built twice:

**D6 (869ee2apd) owns this policy text and the suppression list;

869ef84kn owns the scheduled purge that enforces the timetable** —

including the rule that the purge must never delete a suppression

entry, and the dry-run-before-live requirement recorded on that ticket.

Operator: Blueworkz Ltd trading as Just Granted.

Registered office: 39 Crispin Field, Pitstone, Leighton Buzzard, LU7 9BG.

| Data | Period | Rationale |

|---|---|---|

| Planning application records without personal data (reference, proposal, dates, decisions, council) | Indefinite | Not personal data once the applicant name/address association is removed; historical planning data has analytical value. |

| Applicant personal data (name, site address as an identifier of a person) | 24 months from the decision date (or from last collection where undecided) | Long enough to serve the trades' sales cycle (approvals are actioned within months); short enough to be defensible as necessity-bounded. |

| Suppression list entries | Indefinite | The entry exists to honour an objection; deleting it would restart unwanted contact. Contains the minimum data needed to match. |

| Letter send records (who was written to, when, by which client, which template) | 6 years | Evidence of what was sent (complaints, disputes, accounting). |

| Export audit log (ExportEvent) | 6 years | Evidence of personal-data egress (UK GDPR accountability). |

| Client account and billing data | Life of account + 6 years | Tax and contract records (statutory). |

| Server/application logs containing IPs | 90 days | Operational security only. |

Deletion is destruction, not archival. Backups: purged data leaves

backups as they rotate (currently 14 nightly / 8 weekly — see

docs/BACKUP-RESTORE.md), so full disappearance lags live deletion by

up to ~8 weeks; this is documented in the privacy notice's spirit of

"deleted on a published timetable".