Discussion
As long as necessary for the purposes for which they originally collected the information. In this case, there is no reason to retain anything other than your name, address and payment records for accounting and tax purposes - required to prove to HMRC that their income was genuine. Those they can (and should) retain for six years following the end of the financial year in which you cancelled your membership. They should use the retained data for no other reason, and share it only with their accountants and HMRC if so requested (plus, inevitably, whatever IT platform they use for storing and processing their accounts). You have (amongst other rights) the right to ask them for a copy of the data that they are holding about you, and to ask them for how long they intend to retain it; you also have the right to request its deletion - they can refuse but only if there is an overriding requirement for retention, so you can enforce the limitation to accounting records purpose that I set out above.
</gdprnerd>
</gdprnerd>
They can retain information so long as there's a genuine need for it.
If they're doing things right, they should classify data and have a data retention policy. Some places write that into their Privacy Policy for example, page 4 on https://www.southportcarpetcentre.co.uk/wp-content...
But too often, it's something that no-one actually gives much thought to. You can also exercise your right to be forgotten if you think they need a nudge.
If they're doing things right, they should classify data and have a data retention policy. Some places write that into their Privacy Policy for example, page 4 on https://www.southportcarpetcentre.co.uk/wp-content...
But too often, it's something that no-one actually gives much thought to. You can also exercise your right to be forgotten if you think they need a nudge.
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff