Data Retention Policy

UK & EU Regulations

• GDPR (General Data Protection Regulation): Personal data retention limited to necessary period for processing purposes
• UK Data Protection Act 2018: UK-specific data protection requirements
• ePrivacy Directive: Electronic communications data retention requirements
• Companies Act 2006: 6-year retention for accounting records and supporting documents
• VAT Regulations: 6-year retention for VAT records

Payment Industry Standards

• Payment Card Data: We do not store payment card data; card payments are handled by our payment providers.
• Anti-Money Laundering Regulations: Customer due diligence records retained 5 years from the end of the relationship

Industry Best Practices

• ISO 27001 information security management standards
• NIST guidelines for data lifecycle management
• ICO (Information Commissioner's Office) guidance on data retention

Active Data Storage

• Location: Primary storage is on servers located in the United States, with UK GDPR transfer safeguards
• Encryption: AES-256 encryption at rest, TLS 1.3 for data in transit
• Access Controls: Role-based access control (RBAC) with least privilege principle
• Backups: Daily full encrypted backups (AES-256) pushed off-site
• Monitoring: Automated alerting

Database Security

• Access: The database accepts local connections only; server access is by SSH key; backups are encrypted
• Access Logging: Server and database access is logged
• Separation: Production and development environments strictly separated

Data Classification

Archive Criteria

Data is moved to archive storage when:

• No longer required for active business operations
• Retention period requires long-term storage (7+ years)
• Data access frequency below defined threshold (less than once per quarter)
• System capacity optimization required
• Legal hold requires preservation beyond normal retention

Archive Storage

• Location: Archived data is kept as encrypted backup files off-site
• Encryption: AES-256 encryption maintained in archive
• Indexing: Searchable metadata for retrieval without full data access
• Integrity: Annual integrity verification and format migration as needed
• Access: Restricted access with management approval and audit trail

Archive Retrieval

• Request Process: Formal request with business justification required
• Approval: Company director approval for archive access
• Timeline: Standard retrieval within 24-72 hours
• Documentation: All retrievals logged with purpose and accessing party
• Temporary Access: Retrieved data returned to archive after use

Legal Hold Procedures

• Immediate Suspension: Deletion suspended for data subject to legal hold
• Preservation: Data isolated and preserved in immutable format
• Documentation: Legal hold register maintained with scope and duration
• Notification: IT and compliance teams notified of all legal holds
• Release: Data returned to normal retention schedule upon hold release

Automated Deletion Process

• Scheduled Reviews: Retention is reviewed periodically and expired data deleted
• Verification: Check that no legal holds apply before deletion
• Execution: Secure deletion executed during maintenance windows
• Confirmation: Deletion completion verified and documented

Deletion Methods

Deletion Verification

• Automated Verification: Scheduled scans to confirm deletion completion
• Backup Validation: Verification data removed from all backup systems
• Audit Trail: Complete log of what was deleted, when, and by whom
• Sample Testing: Periodic sample testing to verify deletion effectiveness
• Documentation: Deletion records maintained

Exceptions to Deletion

• Legal Hold: Active litigation or regulatory investigation
• Active Disputes: Ongoing chargebacks, complaints, or claims
• Regulatory Review: Data subject to pending regulatory audit
• Security Investigation: Data required for ongoing security incident investigation
• Extended Retention: Data subject extended retention notice (e.g., statute of limitations)

Individual Rights

Request Processing

• Submission: Requests by email to info@pops.gg
• Verification: Identity verification required before processing
• Timeline: Response within 30 days (extendable to 60 days for complex requests)
• Documentation: All requests logged and documented
• Exceptions: Clear explanation provided if request cannot be fulfilled

Roles & Responsibilities

• Data protection lead (the company director): Overall policy oversight and UK GDPR compliance
• IT Operations: Implementation of retention and deletion procedures
• Compliance Team: Monitoring adherence to retention schedules
• Legal Counsel: Review of retention periods and legal requirements
• Department Heads: Ensuring team compliance with policy

Policy Review & Updates

• Annual comprehensive policy review
• Updates triggered by regulatory changes within 30 days
• Periodic review of retention schedule effectiveness
• Version control maintained for all policy versions
• All material changes communicated to stakeholders

Training & Awareness

• Annual data retention training for all staff
• Specialized training for IT and compliance teams
• New hire training during onboarding
• Regular communications about retention requirements

Monitoring & Auditing

• Periodic compliance checks
• Annual internal review by the director
• Non-compliance issues escalated and remediated promptly