Data Retention Policy

Overview

CSL Longstone Ltd retains personal data only for as long as necessary to fulfil the purposes for which it was collected. This policy outlines our retention periods and deletion processes.

Retention Periods

Enquiries and Leads

• Active leads: Retained while the enquiry is active and for up to 24 months from the last activity.
• Closed/lost leads: Retained for 12 months after closure, then securely deleted.
• Lead activity logs: Retained for the same period as the associated lead.

Reviews

• Approved reviews: Retained indefinitely as published testimonials. You may request removal at any time.
• Unapproved/pending reviews: Deleted after 90 days if not approved.
• Reviewer email addresses: Never displayed publicly. Retained only for moderation purposes and deleted when the review is removed.

Staff/Employee Accounts

• Employee accounts and profiles are retained while the individual is employed by CSL Longstone.
• Upon departure, accounts are deactivated and personal data deleted within 30 days.

Cookie Consent Records

• Cookie consent preferences stored in your browser's local storage. Expires after 12 months.

Accommodation Bookings, Receipts and Payouts

• Booking, payment and receipt records are kept for 6 years after the end of the financial year they relate to, to meet UK accounting and tax record-keeping requirements.

Digital Product (Host Resources) Orders

• Order, payment and consent records (including the version of the terms you agreed to) are kept for 6 years after the end of the financial year of purchase.
• Download links expire automatically and are limited in the number of uses.

Email Records

• Email delivery logs (recipient, template, status) are kept for up to 24 months for troubleshooting.
• Suppression (unsubscribe/bounce) records are kept for as long as needed to respect your request not to be emailed.

Deletion Process

Data that has reached its retention limit is reviewed and securely deleted from our systems; backups held by our hosting provider roll off on their own schedule. Deletion is currently carried out by manual periodic review rather than an automated process, and records needed for accounting, legal claims or a live dispute may be kept longer where the law allows.

Security Incidents and Personal Data Breaches

• Any staff member who suspects a personal data breach must report it immediately to the directors at admin@csl-longstone.com.
• We contain the incident (for example, revoking access, rotating keys or disabling affected features), assess what data and people are affected, and record the incident, its effects and the action taken.
• Where a breach is likely to result in a risk to people's rights and freedoms, we report it to the ICO within 72 hours of becoming aware of it.
• Where the risk is high, we tell the affected people without undue delay.
• We ask our service providers to notify us of breaches affecting our data without undue delay.

Your Rights

You can request early deletion of your personal data at any time by contacting admin@csl-longstone.com. See our Privacy Policy for full details of your rights.