Data Retention Statement
How long Ready Staff keeps different categories of record, and why.
Principles
We keep personal information only for as long as it is necessary for the purpose it was collected for, or for as long as the law requires (the UK GDPR storage-limitation principle). Each category of record below has a trigger event, a retention period and a disposal or review action.
At the end of the applicable period we securely delete, destroy or irreversibly anonymise the record. This schedule applies across our production systems, document storage, email and backups — backups are not used as a way of retaining active personal data indefinitely.
Records that are subject to a complaint, legal claim, regulatory enquiry, safeguarding matter, fraud investigation or legal hold are not destroyed until the matter is concluded and any applicable limitation period has passed (see Legal holds).
Our commitment. These are the standard retention periods we apply. They are not an entitlement to keep every record for the full period — where information is no longer necessary and no legal reason requires keeping it, we delete it sooner.
How this schedule works
- The periods below are standard periods, not a promise to keep every record for its maximum.
- We may delete information earlier when it is no longer necessary and no legal reason requires retention.
- A longer period may apply where required by law, contract, insurance, litigation, safeguarding or a regulatory investigation.
- Retention periods are reviewed at least annually, and whenever relevant law or our processing changes.
- Requests for erasure are assessed under UK GDPR — the right to erasure is not absolute.
A. Candidate and recruitment records
- 1. Incomplete candidate registrations
- Trigger: last activity. Retention: 6 months. Action: delete or anonymise, unless the candidate resumes or asks us to retain the registration.
- 2. Candidates who register but are not placed
- Trigger: last meaningful contact or recruitment activity. Retention: 12 months. Action: review and delete/anonymise unless renewed consent, continued engagement or a documented legal reason supports further retention.
- 3. Unsuccessful applications for a particular vacancy
- Trigger: end of the recruitment exercise or rejection. Retention: 12 months. Action: delete/anonymise, subject to legal hold.
- 4. Active candidate records
- Trigger: while actively seeking or accepting assignments. Retention: for the active relationship. Action: review at least annually and remove information no longer required.
- 5. Placed workers / personnel files
- Trigger: end of employment or the final assignment/working relationship, as applicable. Retention: 6 years. Action: secure deletion or anonymisation, except records governed by a different statutory period.
- 6. Right-to-Work check records
- Trigger: end of employment. Retention: duration of employment plus 2 years. Action: secure destruction after the statutory period, unless a legal hold applies.
- 7. DBS certificate information / check records
- Trigger: recruitment decision or end of the relevant purpose. Retention: normally no longer than 6 months for certificate information, unless exceptional circumstances are documented. Action: secure destruction; retain only the minimum permitted audit information — date of check, certificate reference where lawful, role, decision and who checked it.
- 8. Qualification, training, licence and compliance documents
- Trigger: end of the working relationship. Retention: 6 years, unless a shorter period is sufficient or a specific statutory rule applies. Action: secure deletion.
B. Employment, payroll and assignment records
- 9. PAYE and payroll records
- Trigger: end of the tax year the records relate to. Retention: at least 3 years, or longer where required for tax, accounting, employment or legal-claim purposes. Action: secure deletion after the applicable period.
- 10. Pension auto-enrolment records
- Trigger: creation of the record / end of the relevant membership or employment. Retention: 6 years; opt-out records 4 years. Action: secure deletion after the applicable period.
- 11. Timesheets, assignments, pay-rate records, holiday records and Key Information Documents
- Trigger: end of the assignment or relevant financial year. Retention: 6 years. Action: secure deletion.
- 12. National Minimum Wage records
- Trigger: end of the pay reference period. Retention: the statutory minimum period in force (currently 6 years — verified against GOV.UK requirements). Action: secure deletion after the mandatory period.
- 13. Accident and health-and-safety records
- Trigger: date of the record or incident. Retention: the relevant statutory period — normally at least 3 years for applicable adult accident records, with longer periods for children/young persons or where a claim exists. Action: secure deletion after expiry and resolution of any claim.
C. Employer, commercial and financial records
- 14. Employer/client contracts, assignments, invoices and material commercial correspondence
- Trigger: contract termination or end of the financial year, as applicable. Retention: 6 years. Action: secure deletion, unless needed longer for a dispute or statutory requirement.
- 15. Unconverted employer enquiries and quotation requests
- Trigger: last meaningful contact. Retention: 24 months. Action: delete/anonymise unless there is continued engagement or a documented lawful reason to retain.
- 16. Supplier and business-contact records
- Trigger: end of the relationship. Retention: 6 years for contractual/financial records; otherwise review after 24 months. Action: delete, or retain only necessary business records.
D. Website, marketing and communications
- 17. General contact-form submissions
- Trigger: closure of the enquiry. Retention: 24 months. Action: delete/anonymise unless converted into a client, candidate, complaint or other retained record.
- 18. Newsletter subscriptions
- Trigger: until unsubscribe, withdrawal of consent or confirmed inactivity. Retention: active for as long as valid; inactive subscriptions reviewed after 24 months. Action: remove from active marketing; retain only the minimal suppression evidence needed to respect the opt-out.
- 19. Marketing consent, lawful-basis and opt-out/suppression records
- Trigger: last marketing contact, withdrawal or objection. Retention: 6 years for evidence where necessary; a suppression record may be kept for as long as needed to ensure the person is not contacted again. Action: retain only the minimum necessary evidence.
- 20. Website analytics identifiers
- Trigger: collection. Retention: the actual configured cookie/analytics duration, not exceeding what the Cookie Policy discloses. Action: automatic deletion or anonymisation.
- 21. Security, access, fraud-prevention and technical logs
- Trigger: date created. Retention: normally 12 months, unless an incident or investigation requires longer. Action: automatic secure deletion or anonymisation.
E. Complaints, concerns and data-protection matters
- 22. General complaints
- Trigger: final closure. Retention: 6 years. Action: secure deletion/anonymisation after any relevant claim period.
- 23. Safeguarding, whistleblowing or concern reports
- Trigger: final closure. Retention: 6 years as a general baseline, reviewed case by case; retained longer where required for safeguarding, legal, regulatory or public-interest reasons. Action: documented review, then secure deletion/anonymisation when no longer necessary.
- 24. Anonymous concern reports
- Trigger: final closure. Retention: the same case-based schedule as concern reports. Action: preserve anonymity — we do not attempt to identify the reporter unless required and lawful in an exceptional situation.
- 25. Data-subject requests and related correspondence
- Trigger: final response/closure. Retention: 6 years. Action: secure deletion, retaining only what is necessary to evidence compliance.
- 26. Personal-data breach records
- Trigger: closure of the incident. Retention: 6 years. Action: secure deletion after regulatory/legal needs have expired.
Legal holds
Where a record is relevant to a dispute, investigation, regulatory enquiry, safeguarding matter or insurance claim, deletion is suspended until the matter concludes and any applicable limitation period has passed. A hold takes precedence over any ordinary retention rule and is lifted only after a documented review.
Requesting deletion
You can ask us to delete information we hold about you. Where we are legally required to retain a record we will explain why we cannot delete it, and we will delete what we can. The right to erasure is assessed under UK GDPR and is not absolute.
Note. Deleting a record from our live systems does not immediately remove it from backups. Backup copies expire on the backup cycle, after which they are securely overwritten or deleted and are no longer recoverable. We state this plainly rather than implying instant and total erasure.
Document control
- Document title
- Data Retention Statement.
- Document owner
- Data Protection Lead.
- Approved by
- Director, AI BIZ TECH LTD.
- Version
- 1.0.
- Approval / effective date
- 1 August 2026.
- Next review date
- 1 August 2027.
- Approval method
- Electronically approved by the Director.
- Contact
- compliance@readystaff.co.uk.
Contact
For questions about this Data Retention Statement or Ready Staff's retention and deletion practices, contact compliance@readystaff.co.uk. General enquiries may also be sent to info@readystaff.co.uk.
Last updated .
Related documents
- Privacy PolicyHow Ready Staff collects, uses, shares and protects personal information, the legal bases we rely on, and the rights available to you.
- Candidate Privacy NoticeHow we handle work-seekers' personal information, including compliance documentation, special category data and payroll records.
- Employer Privacy NoticeHow we handle personal information belonging to client and prospective client contacts.