| Data | Kept for | Then |
|---|---|---|
| Enquiries and leads that do not become clients | 24 months after last contact | Deleted from CRM and email |
| Client contracts, proposals and invoices | Engagement plus the period required by tax law in the client's country (India: at least 8 years from the end of the financial year under the CGST Act and Income-tax Act, subject to confirmation with the accountant) | Deleted or archived offline |
| Client project files and reports | Engagement plus 24 months | Deleted |
| Client personal data processed under the DPA | Engagement plus 30 days | Deleted or returned |
| Stored client credentials | Until access is removed (within 7 days of offboarding) | Deleted from password manager |
| Free-tool scans and reports | 90 days | Deleted |
| Analytics data (GA4) | 14 months | Deleted by Google's retention setting |
| Consent records | Life of the consent plus 3 years | Deleted |
| Security, access and processing logs | At least 1 year | Deleted |
| Candidate data | 12 months after the role is filled | Deleted |
| Newsletter list | Until you unsubscribe; unsubscribed addresses kept on a suppression list | Suppression list only |
How deletion works
We delete from live systems first, then from backups as they expire. A data subject can ask for earlier deletion through the Privacy Request Form, except where the law requires us to keep the record.