← Policies & data protection
Data retention & deletion policy
We only keep information for as long as it is genuinely useful to the young person or needed to run and evidence the service. When it stops being useful, it goes.
Owner: Be Free Campaign. This document is maintained by the organisation and should be reviewed at least annually.
Principles
- The young person owns their card. They can edit or delete it at any time.
- We keep the least amount of personal data we can, for the shortest sensible time.
- Reporting to funders and commissioners uses aggregate, anonymised figures, not personal records.
- Deletion means deletion of the personal record, not just hiding it from the screen.
What we hold and for how long
| Information | Why we hold it | Retention period |
|---|---|---|
| Account (email address, sign-in history) | To sign the person in and secure the account | While the account is active, then [24 months] after last sign-in, then deleted |
| Be;Ready Card (name, headline, strengths, interests, goals, photo, video) | It is the young person's own profile | Until the young person deletes it, or [24 months] after last sign-in |
| Connections and interest requests (who asked to connect, accept/decline) | So both sides have a record of an introduction | [24 months] from the date of the request |
| Cohort membership and licence code redemption | So a delivery organisation can support their own young people | Duration of the programme plus [12 months] for funder audit |
| Outcome follow-ups (4 / 12 / 26 week check-ins) | To evidence progression to the funder | [3 years], then reduced to anonymised statistics only |
| Product analytics (card created, shared, QR scanned) | To understand whether the service works | Event-level [13 months]; aggregate figures kept indefinitely |
| Bug reports and support messages | To fix problems and answer the person | [12 months] from resolution |
| Payment and subscription records (organisations) | Legal and accounting obligation | [7 years] as required by UK financial record-keeping |
| Email delivery and unsubscribe records | To honour opt-outs and prove consent | Suppression list kept indefinitely; send logs [13 months] |
Card photos and videos are stored in our file storage and deleted on the same schedule as the card they belong to.
How a young person deletes their data
- Delete individual content (photo, video, answers) at any time from My Card.
- Delete the whole card from My Card, this removes the public link, the QR code and anyone's saved view of it.
- Delete the account entirely by emailing info@befreecampaign.org from the address on the account. We complete deletion within [30 days] and confirm by email.
- Turn off Be Found at any time to stop appearing in employer talent search, without deleting anything.
After deletion we keep only what the law requires (for example payment records) and anonymised statistics that cannot be traced back to an individual.
What organisations can and cannot see
- A delivery organisation sees only the young people in its own cohorts, and only their progress and outcomes.
- An employer sees a card only when the young person has made it public or responded to them.
- A commissioner or funder sees aggregate, anonymised insight only, never an individual record.
- Removing a young person from a cohort ends that organisation's access and frees the licence seat.
Review
This policy is reviewed at least annually, and whenever we add a feature that collects new personal data. Last reviewed: August 2026. Next review due: August 2027.
Draft for review
Anything shown in [square brackets] needs confirming by Be Free Campaign before this is shared with funders, commissioners or an auditor.