This Data Retention Policy and Schedule explains Bloom for Mums Ltd’s requirements to retain data and to dispose of data and provides guidance on appropriate data handling and disposal.
This policy is media neutral and applies to all data (including personal data), information, documents and records whether in electronic or paper form (called “Records”).
1. Principle
We keep personal data only for as long as it is needed for the purpose for which it was collected. Where data is no longer needed, it is deleted. This reflects the principles of “data minimisation” and “storage limitation” imposed under UK data protection legislation.
2. Data Retention
Bloom for Mums’ data retention obligations can be categorised as follows:
Obligations not to keep Records for longer than is necessary: In order to comply with applicable UK data protection laws and to run an efficient organisation, Bloom for Mums will only keep Records for as long as it is necessary to do so to fulfil the original purpose for which it was collected.
Obligations to keep Records for specific periods of time: Bloom for Mums is required to keep certain Records for specific periods of time to achieve compliance with various legal, statutory, regulatory and other obligations that require us to retain such Records.
The time period for keeping Records that is deemed “necessary” can vary, depending on the type of Record. The factors that need to be considered include:
- Legal — there may be legal rules requiring Records to be kept for a specific period, or a dispute may mean Records need to be kept for longer than usual.
- Business — Bloom for Mums may need Records to help operate the business and evidence decisions made.
- Contracts — contracts with customers, suppliers and partners may influence when Records can be deleted or destroyed.
- The original purpose. Where the original purpose is no longer valid or has expired, the data must be deleted unless it must be maintained strictly to comply with applicable laws. An alternative purpose must not be found merely to keep data for longer.
This Policy guides Bloom for Mums on how long it needs to keep the Records it handles and how best to delete or destroy them when no longer necessary.
What Bloom for Mums needs to do:
- Manage Records and ensure they are not kept longer than necessary. Review the Schedule below and delete or destroy Records after the applicable period expires.
- If a Record has served its purpose and no specific retention period or good business reason applies, delete or destroy it straight away.
- If several retention periods apply to the same Record, apply the longest period.
- Review all Records at least annually, while monitoring retention throughout the year.
3. Schedule
Bloom for Mums Ltd establishes retention or disposal schedules or procedures for specific categories of data. This ensures legal compliance and helps protect our business and users.
Company and Corporate Records
| Record category | Retention | Mechanism |
|---|---|---|
| Company formation and all legal documents and correspondence | Indefinite | Not applicable |
| Details of decisions provided by a sole director; board minutes | 10 years from date of resolution, decision or meeting | Manual review |
| Accounting records | At least 3 years from the date they were made | Manual review |
Operations Records
| Record category | Retention | Mechanism |
|---|---|---|
| Community room posts | 30 days from posting, then deleted | Scheduled job |
| Moderation evidence (actioned posts) | 6 years from action taken | Scheduled job |
| Reports and appeals | 6 years from resolution | Scheduled job |
| User complaints handling | 6 years from settlement or closure | Manual review |
| AI chat messages | Not stored by Bloom (transient processing only) | Not applicable |
| Email enquiries to hello@bloomformums.com | 6 years from last contact | Manual review |
| Website analytics reports from cookies and other similar technology | 2 years | Manual review |
Legal Records
| Record category | Retention | Mechanism |
|---|---|---|
| Governance records (DPIA, breach log, this schedule) | 7 years from being superseded | Manual review |
| Previous versions of policies, including IT policy, privacy policy, retention policy etc. | 7 years from being superseded | Manual review |
| Data subject rights requests and data protection complaints | 6 years from closure of request | Manual review |
IT Records
| Record category | Retention | Mechanism |
|---|---|---|
| General information about developed IT infrastructure, software and systems | 7 years from decommissioning of system | Manual review |
| Contracts and agreements (software licences, support agreements, hardware agreements etc.) | 7 years from expiry of the agreement | Manual review |
4. Deletion
Bloom for Mums will regularly review electronic files and dispose of electronic records in accordance with the data retention periods set out above.
The data retention periods apply to official and master copies as well as any duplicates and convenience copies, including backups. All should be deleted or destroyed following expiry of the relevant retention period.
Deletion or destruction of data must render the data incapable of recovery.
Deletion is generally automatic via scheduled database jobs. Backups are retained by our managed-service provider in accordance with its policy and rotate within 7 days; once a record has been deleted, it is overwritten in backups within that window.
5. Litigation Hold / Document Preservation Notice
Occasionally, Bloom for Mums may need to take special measures to ensure that certain Records are neither deleted nor destroyed. This can happen if Bloom for Mums becomes involved in any actual or potential litigation, any form of actual or potential investigation, or other exceptional circumstances. This is known as a “Litigation Hold”.
6. Review
This schedule is reviewed annually and on any material change to the service.