Data Protection

Please read this data retention policy carefully as it sets out the basis and timeframes on which we retain and dispose of data produced by or through:

• www.upspot.co.uk website

• book.upspot.co.uk website

• Corporate portals or web pages managed by UpSpot on behalf of our corporate clients.

• Web pages offering payment or booking services from our booking apps.

• Staff functions including asset management, direct, agent & partner, corporate and key account client services, HR, operations & estates, finance, business development, marketing and IT team personnel.

• Incoming email or data transfer from colleagues or third parties

​

The purpose of this Policy is to ensure that data controlled or processed by UpSpot are adequately protected and maintained and to ensure that records that are no longer needed are discarded at the proper time.

​

This Policy is also for the purpose of aiding employees of UpSpot in understanding their obligations in retaining electronic documents – including e-mail, Web files, text files, sound and movie files, PDF documents, Microsoft Office or other formatted files and database records. This policy is effective from 1 January 2022.

​

For your reference, UpSpot is a trading name of UpSpot Ltd.

​

UpSpot is committed to compliance with Data Processing Laws and respecting your privacy. “Data Processing Laws” means (a) the Data Protection Act 1998 and any laws or regulations implementing Directive 95/46/EC; and/or (b) the General Data Protection Regulation (GDPR); and/or any corresponding or equivalent national laws or regulations; and any applicable laws replacing, amending, extending, re-enacting or consolidating any of the above DP Laws from time to time; For the purposes of the Data Processing Laws UpSpot is the data controller. UpSpot’s Privacy Policy can be viewed here.

 

Administration

​

Attached as Appendix A is a Retention Schedule that is approved as the initial maintenance, retention and disposal schedule for physical records of UpSpot and the retention and disposal of electronic documents. The Data Protection Officer (DPO) is the officer in charge of the administration of this Policy and the implementation of processes and procedures to ensure that the Record Retention Schedule is followed. The Administrator is also authorised to: make modifications to the Record Retention Schedule from time to time to ensure that itis in compliance with national and international laws.

 

Suspension of Record Disposal In Event of Litigation or Claims

​

In the event UpSpot is served with any data access request, court proceedings, legal claim, request for documents or any employee becomes aware of a governmental investigation or audit concerning UpSpot or the commencement of any litigation against or concerning UpSpot, such employee shall inform the DPO and any further disposal of documents shall be suspended until such time as the DPO, with the advice of counsel, determines otherwise. The DPO shall take such steps as is necessary to promptly inform all staff of any suspension in the further disposal of data.

 

APPENDIX A – RETENTION SCHEDULE

​

The Retention Schedule is organised as follows:

A. Personal Data that falls under the terms of our Privacy Policy
B. Accounting and Finance
C. Contracts
D. Corporate Records
E. Correspondence and Internal Memoranda
F. Electronic Documents
G. Insurance Records
H. Legal Files and Papers
I. Payroll Documents
J. Pension Documents
K. Personnel Records
L. Health & Safety Records
M. Property Records
N. Tax Records

​

A. Personal Data that falls under the terms of our Privacy Policy

​

Sign-ups for news, offers or marketing campaigns – If you have provided your contact details and confirmed that you have provided consent to receive news, offers or marketing campaigns, we will retain your personal information for no longer than 5 years from the point you last expressed an interest/opened a communication without unsubscribing/provided consent/contacted us/subscribed or unsubscribed. We retain information derived from cookies and other tracking technologies for no longer than 5 years.

​

Personal Information related to Enquiries and Orders – If you have made an enquiry about or order for products or services or a third party has done so on your behalf, we will retain your information for no longer than 7 years from the point of your last enquiry or order.

​

Billing – If you have been billed by UpSpot for any products or services, we will retain your information for no longer than 7 years from the point of billing of your last invoice.

​

Account Information – We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our products and services.

​

Client contracts – If you’re an employee of a corporate client that specifies in our contract that data must be retained for reporting purposes on their behalf for a particular period, we will comply with that length of time where possible and where they have confirmed their responsibility as data controller in that regards.

​

Job Applicant details – CVs, covering letters, application forms and interview notes for unsuccessful candidates will be retained for no longer than 1 year. Successful candidates will have these files transferred to their personnel file, for which our retention period will not be covered by this document.

​

Other files and emails – We retain active, undeleted electronic files and emails for a period of no longer than 7 years, unless they have been identified as business critical and set to not be deleted.

​

Complaints – We retain complaints and responses to them for no longer than 6 years from closure.

In other cases we’ll store personal information for the periods needed for the purposes for which the information was collected or for which it is to be further processed. And sometimes we’ll keep it for longer if we need to by law. Otherwise we delete it.

 

B. Accounting and Finance

​

Record Type & Retention Period:

• Accounts Payable ledgers and schedules – 7 years after the end of the financial year

• Accounts Receivable ledgers and schedules – 7 years after the end of the financial year

• Annual Accounts, Audit Reports and Financial Statements – Permanent

• Annual Audit Records, including work papers and other documents that relate to the audit – 7 years after completion of audit

• Annual Plans and Budgets – 7 years after the end of the financial year

• Bank Statements and Cancelled Checks – 7 years after the end of the financial year

• Employee Expense Reports – 7 years after the end of the financial year

• General Ledgers – Permanent

• Interim Financial Statements – 7 years after the end of the financial year

• Investment Records – 7 years after sales of investment/asset

• Credit card records (documents showing customer credit card number) – No longer than 3 years. Company practice is to enter credit card details into secure, encrypted system and cut out and shred from original document as soon as possible. No credit card numbers are permitted to be stored in paper files in our offices or electronic files on our networks beyond timeframe for entry and disposal discussed above.

 

C. Contracts

​

Record Type & Retention Period:

Contracts and Related Correspondence (including any proposal that resulted in the contract and all other supporting documentation) – 7 years after expiration or termination

 

D. Corporate Records

​

Record Type & Retention Period:

Corporate Records (minute books, signed minutes of the Board and all committees, corporate seals, articles of incorporation, bylaws, annual corporate reports) – Permanent

Licenses and Permits – Permanent

 

E. Correspondence and Internal Memoranda

​

Most correspondence and internal memoranda should be retained for the same period as the document they pertain to or support. For instance, a letter pertaining to a particular contract would be retained as long as the contract (7 years after expiration). It is recommended that records that support a particular project be kept with the project and take on the retention time of that particular project file.

Correspondence or memoranda that do not pertain to documents having a prescribed retention period should generally be discarded sooner. These may be divided into two general categories:

 

1. Those pertaining to routine matters and having no significant, lasting consequences should be discarded within two years.

We retain active, undeleted electronic files and emails for a period of no longer than 7 years, unless they have been identified as business critical and set to not be deleted.

​

2. Those pertaining to non-routine matters or having significant lasting consequences

We retain such files permanently

 

F. Email and  Digital Documents

​

1. Email

– Not all email needs to be retained, depending on the subject matter.

– All e-mail—from internal or external sources—is to be deleted after 24 months unless there is a legitimate business reason for retaining it.

– Staff will strive to keep all but an insignificant minority of their e-mail related to business issues.

– UpSpot will archive e-mail 120 days after the email was created unless it has been deleted. It is the staff member’s responsibility to ensure emails have been deleted prior to this time if they should not be retained.

– UpSpot will delete emails and email archives 30 days after an employee has left UpSpot unless their line manager or a director of UpSpot has requested their emails or email archives should be retained for a period.

– UpSpot will not store or transfer UpSpot-related e-mail on non-work-related computers except as necessary or appropriate for UpSpot purposes.

– Staff will take care not to send confidential/proprietary UpSpot information to outside sources unless necessary for legitimate business purposes.

– Staff with more than 1.3GB in their e-mail account will be unable to send or receive messages until the size of their account is reduced, unless authorised by a director of UpSpot. Staff will be notified by the UpSpot IT Dept as their account size approaches 5 GB.

– Any e-mail a staff member deems vital to the performance of their job should be copied to the staff’s drive folder, and printed and stored in the employee’s workspace.

– UpSpot will retain active, unarchived, undeleted emails for a period of no longer than 7 years, unless they have been identified as business critical and set to not be deleted.

 

2. Digital Documents

– The length of time that a digital document should be retained should be based upon the content of the file and the category under the various sections of this policy.

– UpSpot will retain active, unarchived, undeleted electronic files and emails for a period of no longer than 7 years, unless they have been identified as business critical and set to not be deleted.

– Staff will conduct annual reviews of all digital documents and will amend any they consider to be outdated or inaccurate, but still required.

– Staff will delete all those they consider unnecessary to retain in accordance with this policy. After five years, all

 

3. Web Page Files: Internet Cookies

– Users should schedule the manual clearing of their internet cookies and cache a minimum of once per month.

– It is company policy that passwords should not be set to be retained by devices or browsers.

– UpSpot does not automatically delete electronic files beyond the dates specified in this Policy. It is the responsibility of all staff to adhere to the guidelines specified in this policy.

 

4. Disaster Recovery Plan

This backup tape is a safeguard to retrieve lost information within a one-year retrieval period should documents on the network experience problems. The tape backup copy is considered a safeguard for the record retention system of UpSpot, but is not considered an official repository of UpSpot records. All monthly and yearly tapes are stored offsite according to UpSpot’s Disaster Recovery Policy.

In certain cases a document will be maintained in both paper and electronic form. In such cases the official document will be the electronic document.

 

G. Insurance Records

​

Record Type & Retention Period:

– Annual Loss Summaries – 0 years.

– Audits and Adjustments – 3 years after final adjustments.

– Certificates Issued to UpSpot – Permanent.

– Claims Files (including correspondence, medical records, injury documentation, etc.) – Permanent.

– Group Insurance Plans (Active Employees) – Until Plan is amended or terminated.

– Group Insurance Plans (Retirees) – Permanent or until 6 years after death of last eligible participant.

– Inspections – 3 years.

– Insurance Policies (including expired policies) – Permanent.

– Journal Entry Support Data- 7 years.

– Loss Runs – 10 years.

– Releases and Settlements – 25 years.

 

H. Legal Files and Papers

​

Record Type & Retention Period:

– Legal Memoranda and Opinions – 7 years after close of matter.

– Litigation Files – 3 years after expiration of appeals or time for filing appeals.

– Court Orders – Permanent.

– Requests for Departure from Records Retention Plan – 10 years

 

I. Payroll Documents

​

Record Type & Retention Period:

– Salary records (also overtime, bonuses, expenses) – 7 years.

– Income tax and NI returns, income tax records and correspondence with HMRC – 7 years.

– Inland Revenue/HMRC approvals – Permanent.

– Statutory Sick Pay records, calculations, certificates, self-certificates – 7 years.

 

J. Pension Documents

​

Record Type & Retention Period:

– Pension scheme investment policies and contributions – 12 years from the ending of any benefit payable under the policy.

– Pensioners’ records – 12 years after benefit ceases.

 

K. Personnel Records

​

Record Type & Retention Period:

– CVs, Cover notes, application forms and interview notes (for unsuccessful candidates) – 1 year.

– Redundancy details, calculations of payments, refunds, notification to the Secretary of State – 7 years from the date of redundancy.

– Parental leave – 18 years from the birth of the child.

– Personnel files and training records (including disciplinary records and working time records) – 7 years after employment ceases.

– Working time records – 2 years.

– Retirement Benefits Schemes – records of notifiable events, for example, relating to incapacity – 7 years from the end of the scheme year in which the event took place.

– Records relating to children and young adults – Until the child/young adult reaches the age of 21.

– Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence – 7 years after the end of the tax year in which the maternity period ends.

– National minimum wage records – 7 years after the end of the pay reference period following the one that the records cover.

 

L. Health and Safety Records

​

Record Type & Retention Period:

– Accident books, accident records/reports – 3 years from the date of the last entry (or, if the accident involves a child/ young adult, then until that person reaches the age of 21).

– Assessments under health and safety regulations and records of consultations with safety representatives and committees – Permanent.

– Medical records and details of biological tests under the Control of Lead at Work Regulations – 40 years from the date of the last entry.

– Medical records as specified by the Control of Substances Hazardous to Health Regulations (COSHH) – 40 years from the date of the last entry.

– Medical records under the Control of Asbestos at Work Regulations: medical records containing details of employees exposed to asbestos and medical examination certificates 40 years from the date of the last entry; (medical examination certificates) 4 years from the date of issue.

– Medical records under the Ionising Radiations Regulations 1999 until the person reaches – 75 years of age, but in any event for at least 50 years.

 

M. Property Records

​

Record Type & Retention Period:

– Management agreements, leases, licences to operate – Permanent.

– Building services statutory certificates and documents – 6 years after end of agreement.

– Original Purchase/Sale Agreements – Permanent.

– Property Insurance Policies – Permanent.

 

N. Tax Records

​

Record Type & Retention Period:

– Company tax returns, incl profit and loss for corporation tax – 7 years.

– VAT returns – 7 years.

– Capital gains tax returns – 7 years.

 

How you can request further information

If you have any questions or require details related to this Data Retention Policy, get in touch with our Data Protection Officer by

Emailing: dataprotection@upspot.co.uk

​

Or write to us at:
Data Protection Officer
UpSpot
31 St Matthews Road
Bristol BS6 5TU