UK GDPR · compliance
Data protection
Retention schedules, subject access and erasure workflows, and an auditable activity log for every processing action.
Retention schedule
The automated sweep runs nightly at 22:00 and deletes, anonymises or archives according to each rule.
| Category | Retention | Lawful basis | Action | Due for sweep |
|---|---|---|---|---|
| Booking recordsKept 7 years alongside the accounting record | 84 mo | Contract performance | anonymise | 128 |
| Passenger contact detailsRemoved 24 months after the last journey | 24 mo | Contract performance | delete | 341 |
| Live tracking tracesGPS traces are minimised to 90 days (ICO employment practices guidance). | 3 mo | Legitimate interest — service delivery and disputes | delete | 12,904 |
| In-vehicle camera footage31 days maximum unless retained for an incident | 1 mo | Legitimate interest — safety | delete | 44 |
| Invoices and tax records6 years HMRC minimum, kept 10 years for corporate audit. | 120 mo | Legal obligation | archive | — |
| Card tokens and 3DS resultsTokens only — no PAN stored (PCI DSS SAQ-A) | 15 mo | Contract performance | delete | 61 |
| Marketing consentsRe-permission required every 3 years | 36 mo | Consent | delete | 87 |
| Chauffeur licensing documentsKept 5 years after the engagement ends | 60 mo | Legal obligation — licensing | archive | 3 |
| Support conversations24 months from the last message | 24 mo | Legitimate interest | delete | 205 |
Data subject requests
Statutory deadline: one calendar month from receipt.
Helen Marshh.marsh@barrington-demo.co.uk
DSR-2026-0142 · Subject access request · received 18 Jun 2026 · due 18 Jul 2026
Full export delivered as JSON + PDF via an expiring secure link.
Tom Fieldingtom.fielding@demo.co.uk
DSR-2026-0148 · Erasure / right to be forgotten · received 27 Jun 2026 · due 27 Jul 2026
Contact details, traces and consents erased. Invoices retained under the HMRC record-keeping obligation; booking rows anonymised instead of deleted.
Retained despite the request: invoices_tax, booking_records — overriding legal obligation
Activity log
01 Jul 2026 22:00 · system · retention sweep
delete — tracking_traces
12 904 GPS points older than 90 days deleted · Retention policy · 3 months
01 Jul 2026 22:00 · system · retention sweep
anonymise — booking_records
128 bookings older than 7 years anonymised (passenger fields hashed) · Retention policy · 84 months
30 Jun 2026 16:42 · Helena Voss · admin
sar_export — DSR-2026-0142
Export generated (JSON 214 KB, PDF 9 pages) and sent via expiring link · Art. 15 UK GDPR
28 Jun 2026 11:07 · Helena Voss · admin
erasure_partial — DSR-2026-0148
4 categories erased, 2 retained under legal obligation · Art. 17(3)(b) UK GDPR
28 Jun 2026 11:05 · Helena Voss · admin
identity_check — DSR-2026-0148
Identity confirmed — booking email + last four of the payment token
27 Jun 2026 09:31 · portal · self-service
request_received — DSR-2026-0148
Erasure request submitted from the customer app
26 Jun 2026 22:00 · system · retention sweep
delete — cctv_dashcam
44 clips older than 31 days deleted · Retention policy · 1 month