Data retention

Keep data for a reason

Different records need different retention rules. The schedule below identifies the current implemented rule and the criteria for other records. A legal hold or unresolved payment issue can delay deletion of relevant evidence; it should not extend retention of unrelated data.

Eligible abandoned entry drafts

Seven days without an update, then eligible for scheduled cleanup.

Allows a short return-to-checkout window without keeping incomplete participant records indefinitely. Paid, entry-linked, refund-linked and unresolved payment records are excluded. Cleanup requires its database migration and scheduled job to be enabled.

Account and reusable profile

While needed for the account, outstanding bookings and requested services; review on a closure request.

No automatic inactivity purge is implemented. Keep only information still needed for a continuing purpose; identify any exceptions before deletion.

Confirmed entries and event answers

Until event delivery and necessary follow-up are complete, then review against disputes and documented obligations.

The organiser must define its schedule. Health and emergency-contact details need a shorter, separate justification from ordinary booking or accounting data.

Payments, fees, refunds and tax records

For the applicable accounting, tax and claim periods, plus any documented legal hold.

Keep the minimum financial evidence; do not use financial-record obligations as a reason to retain all medical or event answers. The operator’s jurisdiction and accountant must confirm specific periods.

Marketing consent and suppression

Consent records while needed to demonstrate permission; minimum suppression records while needed to honour an objection.

Unsubscribing stops promotional eligibility; retaining a minimal suppression record prevents accidental re-subscription. No blanket automatic deletion period is currently configured.

Support, reviews and testimonials

Support until resolved and relevant follow-up is complete; published content while permission and its publication purpose continue.

Review declined and withdrawn submissions for deletion. Testimonials are immediately removed from public display on withdrawal; a restricted permission/moderation record may remain pending review.

Logs, exports, files and backups

According to the deployed provider settings and a documented operational schedule.

Provider backup/log periods still need verification. Organisers are responsible for downloaded exports. Removing a live record does not instantly remove every backup copy.

Deletion and review

Requests should identify the account or event concerned. We will assess what can be deleted, what needs to be retained and why. The operational schedule must record the owner, review trigger, deletion method and exceptions for each record type. We do not claim that every category above is automatically purged today.

The ICO’s storage-limitation guidance explains why retention must be justified by purpose rather than a universal expiry period.