+44 (0) 7866 373969

Retention Policy

Retention Policy


1. Purpose, Scope, and Users


This policy sets the required retention periods for specified categories of personal data and sets out the minimum standards to be applied when destroying certain information within Ace Recruitment (UK) Ltd (further: the “Company”).
This Policy applies to all business units, processes, and systems in all countries in which the Company conducts business and has dealings or other business relationships with third parties.
This Policy applies to all Company officers, directors, employees, agents, affiliates, contractors, consultants, advisors or service providers that may collect, process, or have access to data (including personal data and/or sensitive personal data). It is the responsibility of all of the above to familiarise themselves with this Policy and ensure adequate compliance with it.
This policy applies to all information used at the Company. Examples of documents include:
• Emails
• Hard copy documents
• Soft copy documents
• Video and audio
• Data generated by physical access control systems

2. Reference Documents


• EU GDPR 2016/679 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC)
• Personal Data Protection Policy


3. Retention Rules


3.1.Retention General Principle


In the event, for any category of documents not specifically defined elsewhere in this Policy (and in particular within the Data Retention Schedule) and unless otherwise mandated differently by applicable law, the required retention period for such document will be deemed to be 3 years from the date of creation of the document.

3.2.Retention General Schedule

The Data Protection Officer defines the time period for which the documents and electronic records should to be retained through the Data Retention Schedule.
As an exemption, retention periods within Data Retention Schedule can be prolonged in cases such as:
• Ongoing investigations from Member States authorities, if there is a chance records of personal data are needed by the Company to prove compliance with any legal requirements; or
• When exercising legal rights in cases of lawsuits or similar court proceeding recognized under local law.


3.3.Safeguarding of Data during Retention Period

The possibility that data media used for archiving will wear out shall be considered. If electronic storage media are chosen, any procedures and systems ensuring that the information can be accessed during the retention period (both with respect to the information carrier and the readability of formats) shall also be stored in order to safeguard the information against loss as a result of future technological changes. The responsibility for the storage falls to the Data Protection Officer.

3.4.Destruction of Data

The Company and its employees should therefore, on a regular basis, review all data, whether held electronically on their device or on paper, to decide whether to destroy or delete any data once the purpose for which those documents were created is no longer relevant. See Appendix for the retention schedule. Overall responsibility for the destruction of data falls to the Data Protection Officer.
Once the decision is made to dispose according to the Retention Schedule, the data should be deleted, shredded or otherwise destroyed to a degree equivalent to their value to others and their level of confidentiality. The method of disposal varies and is dependent upon the nature of the document. For example, any documents that contain sensitive or confidential information (and particularly sensitive personal data) must be disposed of as confidential waste and be subject to secure electronic deletion; some expired or superseded contracts may only warrant in-house shredding. The Document Disposal Schedule section below defines the mode of disposal.
In this context, the employee shall perform the tasks and assume the responsibilities relevant for the information destruction in an appropriate way. The specific deletion or destruction process may be carried out either by an employee or by an internal or external service provider that the Data Protection Officer subcontracts for this purpose. Any applicable general provisions under relevant data protection laws and the Company’s Personal Data Protection Policy shall be complied with.
Appropriate controls shall be in place that prevents the permanent loss of essential information of the company as a result of malicious or unintentional destruction of information – these controls are described in the company’s IT Security Policy.
The Data Protection Officer shall fully document and approve the destruction process. The applicable statutory requirements for the destruction of information, particularly requirements under applicable data protection laws, shall be fully observed.

3.5.Breach, Enforcement and Compliance

The person appointed with responsibility for Data Protection, the Data Protection Officer has the responsibility to ensure that each of the Company’s offices complies with this Policy. It is also the responsibility of the Data Protection Officer to assist any local office with enquiries from any local data protection or governmental authority.
Any suspicion of a breach of this Policy must be reported immediately to Data Protection Officer. All instances of suspected breaches of the Policy shall be investigated and action taken as appropriate.
Failure to comply with this Policy may result in adverse consequences, including, but not limited to, loss of customer confidence, litigation and loss of competitive advantage, financial loss and damage to the Company’s reputation, personal injury, harm or loss. Non-compliance with this Policy by permanent, temporary or contract employees, or any third parties, who have been granted access to Company premises or information, may therefore result in disciplinary proceedings or termination of their employment or contract. Such 0 may also lead to legal action against the parties involved in such activities.


4. Document Disposal

4.1.Routine Disposal Schedule

Records which may be routinely destroyed unless subject to an on-going legal or regulatory inquiry are as follows:
• Announcements and notices of day-to-day meetings and other events including acceptances and apologies;
• Requests for ordinary information such as travel directions;
• Reservations for internal meetings without charges / external costs;
• Transmission documents such as letters, fax cover sheets, e-mail messages, routing slips, compliments slips and similar items that accompany documents but do not add any value;
• Message slips;
• Superseded address list, distribution lists etc.;
• Duplicate documents such as CC and FYI copies, unaltered drafts, snapshot printouts or extracts from databases and day files;
• Stock in-house publications which are obsolete or superseded; and
• Trade magazines, vendor catalogues, flyers and newsletters from vendors or other external organizations.
In all cases, disposal is subject to any disclosure requirements which may exist in the context of litigation.

4.2.Destruction Method

Level I documents are those that contain information that is of the highest security and confidentiality and those that include any personal data. These documents shall be disposed of as confidential waste (cross-cut shredded and incinerated) and shall be subject to secure electronic deletion. Disposal of the documents should include proof of destruction.
Level II documents are proprietary documents that contain confidential information such as parties’ names, signatures and addresses, or which could be used by third parties to commit fraud, but which do not contain any personal data. The documents should be cross-cut shredded and then placed into locked rubbish bins for collection by an approved disposal firm, and electronic documents will be subject to secure electronic deletion.
Level III documents are those that do not contain any confidential information or personal data and are published Company documents. These should be strip-shredded or disposed of through a recycling company and include, among other things, advertisements, catalogues, flyers, and newsletters. These may be disposed of without an audit trail.


5. Managing Records Kept on the Basis of this Document

Record name Storage location Person responsible for storage Controls for record protection Retention time

Data Retention Schedule Data Protection Officer’s Google Drive Data Protection Officer Only authorised persons may access this document Permanently

6. Validity and document management

 

This document is valid as of May 25th 2018
The owner of this document is the Data Protection Officer who must check and, if necessary, update the document at least once a year.


7. Appendix – Data Retention

Appendix – Data Retention Schedule

 

Document type

How long to keep for (and source of requirement)

Personnel records

 

  • Work-seeker records including application form/CV, ID checks, terms of engagement (see also below), details of assignments, opt-out notices and interview notes

 

  • Hirer records including client details, terms of business (see below), assignment/vacancy details.

1 year from the last date of providing work-finding services as an Employment Agency or Employment Business (Conduct of Employment Agencies and Employment Businesses Regulations 2003 (Conduct Regulations))

Terms of engagement with temporary worker and terms of business with clients

6 years in order to deal with any civil action in the form of contractual claim (Limitation Act 1980) (5 years in Scotland). Please note that 6 years is not a minimum legal requirement but is the time period in which a contractual claim can be made. You will still have to establish why it is necessary to keep these records.

Working time records:

  • 48 hour opt out notice
  • Annual leave records

2 years from the time they were created

Annual appraisal/assessment records

No specific period – under data protection laws you should only keep records for as long as is necessary.

References

Under data protection laws, only keep records for as long as is necessary. However, the Conduct Regulations require references to be kept for 1 year following the introduction or supply of a work seeker to a client.

Records held relating to right to work in the UK

2 years after employment or engagement has ended – must not be alterable

Criminal records checks/ Disclosure Barring checks

There is no longer a 6 month time limit on how long DBS certificates can be kept for. When it comes to handling and storing certificates the new DBS Code requires registered bodies to ‘handle all information provided to them by DBS, as a consequence of applying for a DBS product, in line with the obligations under Data protection Act 1998’ .

National Minimum Wage documentation:

  • Total pay by the worker and the hours worked by the worker
  • Overtime/shift premia
  • Any deduction or payment of accommodation;
  • Any absences eg rest breaks, sick leave, holiday;
  • Any travel or training during working hours and its length;
  • Total number of hours in a pay reference period

 

For HMRC purposes: 3 years after the end of the pay reference period following the one that the records cover (National Minimum Wage Act 1998)

 

 Or 6 years (5 in Scotland) in order to show that you have paid at least national minimum wage rates if a breach of contract claim is brought against you.

Sickness records – statutory sick pay

Records can be kept in a flexible manner which best suits your business but should be kept for payroll purposes (see below)

Statutory maternity, paternity, adoption pay

3 years from the end of the tax year to which it relates

Pensions auto-enrolment (including autoenrolment date, joining date, opt in and opt out notices, contributions paid)

6 years except for opt out notices which should be kept for 4 years. For further information please see The Pensions Regulator’s detailed guidance for employers.

Gender pay gap reporting

1 year (but the statement must be kept on the Government website and organisation’s own website for 3 years)

Company financial records

 

VAT

6 years –please see an overview of VAT record keeping on the Gov.uk website.

Company accounts

6 years –please see an overview of running a limited company on the Gov.uk website

• Payroll information

 • CIS records

3 years from the end of the tax year – please see CIS record-keeping and PAYE record-keeping guidance on the Gov.uk website.

ITEPA (the intermediaries legislation) records

Report due every quarter, to be kept for no less than 3 years after the end of the tax year to which they relate.