Data protection
Data retention policy
Last updated 4 October 2026.
Vericenta keeps information only for as long as there is a justified business, contractual, professional, security or legal need. Raw working material is deliberately kept for less time than the professional record of an issued service.
| Record type | Standard period |
|---|---|
| Unconverted enquiries and free checks | 12 months after the last meaningful interaction |
| Raw website crawl content and page metadata | Normally 90 days after the relevant report or monitoring cycle |
| Raw copied social-monitoring content | Normally 90 days after the monitoring cycle or evidence need ends |
| Rejected candidate findings | Normally 12 months after report completion unless needed for governance evidence |
| Issued reports, approved findings and professional decision trail | 6 years after the service relationship ends |
| Monitoring/subscription service-performance history | Service lifetime plus 6 years |
| Annual-report entitlement records | For as long as the earned edition remains available to the client, then normally up to 6 years after that entitlement ends or is revoked |
| Orders, invoices and accounting/tax records | At least the applicable statutory period; normally 6 years from the end of the relevant company financial year |
| Client portal account mapping | Active service/access lifetime plus normally up to 12 months after access ends |
| Client portal access/denial logs | Normally up to 12 months unless an active incident or legal hold requires longer |
| Governance & Readiness client-visible records | 6 years after the service relationship ends |
| Content Checker allowance / paid-extra ledger | Normally aligned with subscription and accounting records for 6 years |
| Security/authentication logs | Normally up to 12 months unless an active incident requires longer |
| Privacy-rights request log | 3 years after closure |
| Security incident log | 6 years after closure |
Exceptions and holds
A legal claim, complaint, regulatory matter, security incident, tax enquiry or other documented hold can require a relevant record to be kept longer. The hold is limited to information that may reasonably be needed and is reviewed when the matter closes.
Deletion and minimisation
At the end of a retention period, information is deleted, irreversibly anonymised or reduced to the minimum record still required. Raw public healthcare content is not retained merely "just in case". Where an approved finding needs evidence, Vericenta keeps the minimum context needed to support that finding rather than an unnecessary copy of the whole source.
Backups
Deleted operational data may remain temporarily in protected backups until the normal backup rotation overwrites it. Backup copies are not restored for ordinary business use after deletion unless required for disaster recovery, legal or security purposes.