Policy documents
Retention Policy
1. Purpose
This policy explains how long Heidi Computers Ltd, trading as Denizon, keeps personal data for which it is the controller, and how that data is deleted. It supports the storage limitation principle in Article 5(1)(e) of the GDPR: we keep personal data no longer than we need it for the purposes described in our Privacy and Cookie Policy.
Personal data we process on behalf of customers (as their processor) is kept and deleted according to their instructions and our Data Processing Agreement. Data in the FieldElite service is covered by the FieldElite Retention Policy.
2. Retention schedule
| Records | Retention period | Reason |
|---|---|---|
| Website enquiries that do not lead to business | 24 months from last contact | To follow up the enquiry and handle related questions |
| Customer, supplier and partner contracts, orders and correspondence | Duration of the relationship plus 6 years | Limitation period for contract claims in Ireland |
| Invoices, accounting and tax records | 6 years from the end of the accounting period, or longer where the Revenue Commissioners require | Irish tax and company law |
| Marketing consents and unsubscribe requests | Consent records: while you are on our list plus 2 years. Suppression list: indefinitely, limited to your email address | To show consent was given and to make sure we do not contact you after you opt out |
| Website analytics (Matomo) | Raw visit data 13 months; aggregated reports indefinitely | To measure and improve the website |
| Website form submissions stored in the website database | 12 months, then deleted | Copy of enquiries in case email delivery fails |
| Web server and security logs | 90 days | Security and troubleshooting |
| Data protection requests and complaints | 3 years after closure | To show how requests were handled |
Where a retention period has ended, we delete the data or anonymise it so that it no longer identifies anyone.
We may keep data longer where the law requires it, or where it is needed for an actual or reasonably expected legal claim or investigation ("legal hold"). Legal holds are reviewed regularly and released when no longer needed.
3. Deletion
Electronic records are deleted from live systems at the end of the retention period. Backups are overwritten in their normal cycle, within 35 days; deleted data is not restored from backups except to recover from an incident, in which case it is deleted again.
Paper records are shredded securely.
If you ask us to erase your personal data under Article 17 GDPR and the request is valid, we delete it without undue delay unless an exception applies, and tell you what we have done.
4. Responsibilities and review
Our Data Protection Officer is responsible for this policy. Staff follow internal procedures that put it into practice.
We review this policy at least once a year and when our processing changes.