Skip to content
English
Raise a Support Ticket Customer portal
  • There are no suggestions because the search field is empty.

Data Retention and Erasure Policy

1. Purpose

Expansive Solutions Ltd (Expansive) is committed to ensuring that customer and personal data is retained only for as long as necessary and securely erased when no longer required.

This policy explains how we manage data retention, deletion and disposal in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, our contractual obligations and our ISO 27001-certified Information Security Management System (ISMS).

Our approach is based on three principles:

  • Data minimisation: We retain only the information necessary for legitimate business, contractual or legal purposes.
  • Customer control: Customers determine appropriate retention requirements for the operational information they manage within Expansive FM.
  • Secure erasure: Information is securely deleted or anonymised when no longer required, subject to applicable legal obligations and backup retention arrangements.

2. Scope and Responsibilities

This policy applies to personal and business information processed by Expansive, including customer operational records, uploaded documents, user information, system logs, backups and internal business records.

For information entered into Expansive FM, our customers will generally act as the Data Controller, determining the purposes of processing and applicable retention requirements.

Expansive acts as the Data Processor, managing information in accordance with documented customer instructions, contractual agreements and applicable law.

For information collected and processed directly by Expansive, such as employee records, commercial relationships and supplier information, Expansive acts as the Data Controller.

The Management Review Board oversees this policy, with operational responsibility assigned to the CTO.

3. Data Retention

Expansive applies retention periods according to the type of information, its purpose and any applicable legal or contractual requirements.

Data Category Retention Approach
Customer operational records, including work orders, assets, compliance and financial information Retained according to customer-defined requirements and applicable contractual arrangements.
Customer documents, photographs and uploaded media Retained in accordance with the associated customer data retention requirements.
Production backups Retained for up to 12 months under our published backup arrangements.
System, security and audit logs Retained for defined operational, security and compliance purposes in accordance with internal retention requirements, typically 12 months
Customer support and correspondence records Retained for the period necessary to provide support, manage contractual relationships and meet applicable obligations.
Internal business, employee and financial records Retained according to documented business and statutory retention requirements.

Retention periods are reviewed periodically. Information is not retained indefinitely without a documented and lawful justification.

Where customers have specific regulatory or operational retention requirements, these should be identified and agreed as part of the service configuration or contractual arrangements.

4. Data Erasure and Secure Disposal

When information reaches the end of its applicable retention period, or a valid deletion instruction is received, Expansive takes appropriate steps to securely erase or anonymise the information.

Depending on the type of information, this may include:

  • Removing records and associated documents from operational systems.
  • Deleting information from databases, file storage and other applicable services.
  • Instructing relevant subprocessors to delete information in accordance with contractual obligations.
  • Securely disposing of physical records or storage media where applicable.

Erasure is undertaken using appropriate technical and organisational safeguards to prevent unauthorised recovery or disclosure.

Where information cannot immediately be permanently erased, it is appropriately restricted and protected until deletion can be completed.

5. Backup Retention and Erasure

Expansive maintains backups to support business continuity, disaster recovery and the protection of customer information.

Our production backup arrangements retain historical snapshots for up to 12 months.

Consequently, information deleted from operational systems may remain within historical backup copies until those backups expire.

During this period:

  • Backup information is protected through appropriate security and access controls.
  • Information awaiting deletion is kept beyond routine operational use.
  • Backup copies are automatically retired according to their established retention schedule.
  • Where historical backups are restored, applicable deletion requirements must be reapplied before the affected information is returned to normal processing.

This approach ensures the integrity of our disaster recovery arrangements while supporting our data protection obligations.

Further details are available in our Backing Up Your Data article.

6. Customer Offboarding and Contract Termination

Upon termination or expiry of a customer agreement, Expansive supports the return or secure deletion of customer information in accordance with the applicable contract and Data Processing Agreement.

The process includes:

  • Arranging the return or export of customer information where required.
  • Removing customer access to the platform at the appropriate point.
  • Deleting customer data from operational environments in accordance with the agreed instructions and timescales.
  • Managing residual information held in backups under the established retention schedule.
  • Providing confirmation of deletion activities upon request.

Where information must be retained for legal or regulatory reasons, Expansive will restrict its use and protect it until the applicable retention obligation expires.

7. Individual Rights and Erasure Requests

Expansive recognises individuals' rights under UK GDPR, including the right to request the erasure of personal information in qualifying circumstances.

Requests can be submitted to data@expansive.co.uk.

Where Expansive acts as Data Controller, we assess requests, verify identity where necessary and respond within applicable statutory deadlines.

Where Expansive acts as Data Processor, we support the relevant customer in fulfilling its data protection obligations, acting upon its documented instructions.

Requests may be subject to lawful exceptions, including obligations to retain information for legal compliance or the establishment, exercise or defence of legal claims.

8. Compliance, Monitoring and Review

Expansive maintains appropriate governance and oversight of its data retention and erasure arrangements through its ISMS.

This includes:

  • Reviewing retention requirements and associated risks.
  • Maintaining records of significant deletion activities and requests.
  • Ensuring relevant third-party service providers are subject to appropriate data protection obligations.
  • Reviewing this policy at least annually and following significant changes to legal, contractual or operational requirements.

Exceptions to normal retention arrangements must be supported by a legitimate purpose and appropriate safeguards.

9. Further Information

 

This policy should be read alongside our Data Protection Policy, Privacy Policy and applicable customer Data Processing Agreements.

For further information about retention, erasure or the processing of personal data, please contact:

Data Protection Officer
Expansive Solutions Ltd
Email: data@expansive.co.uk

 

Policy Owner: Management Review Board
Operational Responsibility: Chief Technology Officer
Review Frequency: At least annually