Data Retention Policy

Last updated: April 12, 2026

This Data Retention Policy explains how the Portfolio Management System operated by peelpot.co.uk ("we", "us", "our") retains and deletes personal data, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We apply the UK GDPR's storage limitation principle (Article 5(1)(e)): personal data is kept only for as long as necessary for the purpose for which it was collected. We conduct periodic reviews to ensure compliance.

1. Retention Periods by Data Category

Student Educational Records (portfolio submissions, evidence, assignment responses, examination attempts, assessment records, grades, and feedback)

Retained for the duration of active enrolment plus 7 years after completion or withdrawal, in line with UK educational sector requirements and the Limitations Act 1980 (contract claims). After this period, records are securely deleted or anonymised.

User Account Data (name, email address, username, password hash, profile information, role assignments)

Retained for the duration of the active account. Following account deletion or a confirmed right-to-erasure request, account data is scheduled for deletion within 30 days (a grace period to allow recovery if the request was made in error). A backup is created before deletion. Where a legal hold applies (e.g., ongoing proceedings), deletion is deferred until the hold is lifted.

System Activity and Security Logs (audit logs recording all user actions, IP addresses, timestamps, and session data)

Retained for 90 days in active storage. After 90 days, logs are automatically archived. Archived logs are retained for a further period to support investigations or legal proceedings, after which they are securely deleted. See the Privacy Policy for full details of what is logged.

Login Attempt Records (failed and successful login attempts with IP address and timestamp)

Retained for 90 days for security monitoring purposes, then deleted.

Communication Data (messages sent via the built-in messenger, email notifications sent via the queue)

Messages are retained for the duration of the relevant accounts. Email queue records (metadata about sent notifications) are retained for 90 days, then purged.

Uploaded Files (documents, images, video, and text submitted as evidence or assignment material)

Retained for the duration of the associated portfolio or account. Deleted in line with student account deletion or upon an approved right-to-erasure request, subject to any applicable educational record retention requirements.

GDPR Consent Records (records of when and how users accepted data processing agreements)

Retained for the duration of the account plus 3 years after account closure, to demonstrate compliance if challenged.

Database Backups

Encrypted database backups are retained for 90 days, after which they are automatically deleted. Backups may contain personal data from the time they were created.

2. Deletion and Anonymisation

Upon expiry of the applicable retention period:

  • Personal data is securely deleted from active systems.
  • Where data exists in backups that cannot yet be deleted, it is restricted from further processing and deleted when the backup expires.
  • Where full deletion is not possible, data is anonymised so that it can no longer identify an individual.

Soft-deleted records (marked as deleted within the system) are treated as deleted for access purposes but may persist in backup storage until the backup retention period expires.

3. Right to Erasure

Under UK GDPR Article 17, you may request deletion of your personal data. Requests are reviewed by an administrator within 30 days. Where approved, a 30-day grace period applies before deletion is executed. Deletion may be refused or deferred where:

  • Retention is required by law (e.g., educational record-keeping obligations)
  • The data is needed to establish, exercise, or defend legal claims
  • Legitimate interests in security or accountability require retention

To submit a request, contact: dnbassett@peelpot.co.uk

4. Legal Exceptions

We may retain data beyond the standard periods where required to:

  • Comply with a legal obligation under UK law
  • Establish, exercise, or defend legal claims
  • Respond to a regulator or law enforcement request

5. Your Rights

Under UK GDPR you have rights to access, rectify, restrict, and object to processing, as well as rights to portability and erasure. Complaints may be lodged with the Information Commissioner's Office (ICO) at ico.org.uk.

6. Contact

For questions about this policy or to exercise your rights, contact: dnbassett@peelpot.co.uk