Legal
Data Retention Policy
Last updated: 8 November 2026
1. About this policy
WORRAPS LTD, company number 17566250, keeps personal data only for as long as necessary for a stated purpose or a specific legal requirement. This notice summarises our retention approach. The Website Privacy Policy covers the public marketing website; account and accounting-record provisions below apply only when the relevant application service is provided. Browsing this website does not create an accounting account or upload financial records.
2. What we keep and for how long
The limits below are adopted WORRAPS policy requirements, not universal legal retention periods or confirmation that every control is already operating. We will implement and verify them before the relevant processing starts. We delete sooner when information is no longer needed, a valid rights request requires it or lawful customer instructions apply. Any longer retention must have a documented lawful reason and be limited to relevant records.
| Information | Retention period or criteria |
|---|---|
| Website cookie choice | Valid for 180 days. An expired local-storage record is removed on your next visit or when you clear site data; the browser does not expire it automatically. |
| Enquiries, support and complaint records | Routine maximum: 12 months after the matter is closed; sooner where no longer needed. Retain only relevant evidence longer for a documented lawful reason. |
| Access, diagnostic and security logs | Routine access/diagnostic logs: maximum 90 days from the event. Security-event and privileged-access audit records: maximum 12 months from the event. Specific incident evidence may be subject to a documented lawful hold. |
| Planned Google Analytics 4 | Before activation, we will select two-month retention for user/event data and disable reset on new activity. This does not determine standard aggregated-report retention or cookie lifetimes. Analytics is not currently integrated into this website. |
| Application accounts and accounting records | Non-essential profile and login-identifier fields: remove within 30 days after account closure. Customer financial records: return/delete under lawful instructions and the agreed DPA process; the profile deadline does not define the customer-document export window. |
| Temporary document-processing copies | Transient OCR/AI material: remove within 30 days after a job completes or fails, or sooner when no longer needed. Final accounting documents and outputs follow customer instructions; external-provider retention must be verified. |
| Data-rights request case files | Routine maximum: 12 months after case closure; retain only necessary claim/hold evidence longer for a documented lawful reason. |
| WORRAPS own company and billing records | Normally at least six years from the end of the relevant corporation tax accounting period, with longer retention where law requires it. The separate three-year private-company accounting minimum does not override longer tax duties. This is not a six-year rule for every customer document. |
3. Account closure and customer records
Cancelling a subscription or disconnecting a bank feed does not automatically erase historical records. You can request export or deletion at info@worraps.co.uk. Where we act as a processor, the customer controls the instructions under the applicable DPA. Customers remain responsible for keeping the tax records they need; their record-keeping duties do not automatically require WORRAPS to retain every copy.
4. Deletion, backups and legal holds
When information is no longer needed, we delete it or irreversibly anonymise it. Our routine recovery-copy policy maximum is 90 days from backup creation, including offsite, archived and immutable routine copies. Where immediate individual deletion is not possible, residual copies must remain protected and beyond normal use until expiry. Restoration must reapply deletion restrictions. Provider arrangements and the agreed export/deletion workflow must support these requirements before the relevant processing starts. A specific legal duty or necessary legal claim may require limited information to be kept longer. We record the reason, restrict use, review holds at least every 90 days and delete when the ground ends. Where we act as a processor, the DPA and lawful controller instructions apply. We do not keep information indefinitely just in case it might become useful.
5. Your rights
Email info@worraps.co.uk to request access, correction, deletion, restriction or other applicable data rights. We may verify your identity and will explain any lawful exception. Requests are handled without undue delay and normally within one month, subject to lawful extensions. See the Website Privacy Policy for website processing and the application privacy notice for enabled accounting services. You may also complain to the ICO at https://ico.org.uk/make-a-complaint/.
6. Contact and updates
WORRAPS LTD. Email: info@worraps.co.uk. Registered office: 71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Last updated: 8 November 2026. We update this notice when our processing or retention practices change. Our detailed operational retention schedule is maintained internally; it does not reduce your rights or authorise uses beyond those explained to you.