How long we keep your information

This Data Retention Policy explains how long Credensa retains the different categories of data processed through our platform, and how data is disposed of when it is no longer required.

1. General principle

We retain personal data only for as long as is necessary for the purposes for which it was collected, to comply with legal, accounting or reporting requirements, or to establish or defend legal claims.

2. Account data

Information relating to your account (name, contact details, organisation) is retained for the duration of your subscription and for 12 months following account closure, after which it is deleted or anonymised.

3. Accreditation documentation

A core feature of the platform is the historical audit trail of supplier documentation. Superseded and expired documents are retained as part of that audit history for the duration of the relevant supplier’s registration, and for 6 years thereafter, reflecting the limitation period for contractual claims. Customers may request earlier deletion where no legal basis requires retention.

4. Financial records

Invoices and billing records are retained for 6 years from the end of the financial year to which they relate, in accordance with HMRC requirements.

5. Correspondence and support records

Enquiries and support correspondence are retained for 24 months from the date the matter is closed, unless they form part of a continuing contractual relationship.

6. Website analytics

Analytics data is aggregated or anonymised within 26 months of collection.

7. Disposal

When retention periods expire, data is securely deleted from live systems, and removed from backups in line with the backup rotation cycle. Physical media, where used, is destroyed to recognised standards.

8. Review

This policy is reviewed annually. Questions about retention of specific data should be directed to us via the contact page.