Hybrid Comply Data Retention and Deletion Schedule

Effective date: 17 August 2026 · Last updated: 17 August 2026 · Version: 1.0

1. Purpose

This Data Retention and Deletion Schedule establishes how long Hybrid HQ LTD, trading as Hybrid Comply (“Hybrid Comply”, “we”, “us” or “our”), retains information processed through:

• the Hybrid Comply mobile application;
• the Hybrid Comply web portal and administrative dashboard;
• the Hybrid Comply website;
• property health and safety inspections;
• compliance reports;
• customer support;
• billing and subscription services;
• marketing activities;
• security and fraud-prevention systems;
• suppliers and integrations; and
• Hybrid Comply’s internal business operations.

This Schedule is intended to ensure that information is:

• retained only for as long as it is reasonably required;
• available for legitimate operational, contractual and legal purposes;
• reviewed at appropriate intervals;
• securely deleted or anonymised when no longer needed;
• preserved when subject to a legal hold; and
• managed consistently across production systems, user devices, integrations, archives and backups.

This Schedule should be read with Hybrid Comply’s:

• Privacy and Data Protection Policy;
• Terms of Service;
• Cookie and Mobile Tracking Notice;
• Data Processing Agreement;
• Information Security Policy;
• Personal Data Breach Response Plan;
• Data Subject Rights Procedure; and
• Record of Processing Activities.

2. Scope

This Schedule applies to:

• all Hybrid Comply employees, directors, workers and contractors;
• all information created, received, uploaded, generated or otherwise processed by Hybrid Comply;
• information for which Hybrid Comply acts as data controller;
• information processed by Hybrid Comply as a processor for a customer;
• all production, development, test, support and backup environments;
• information held by authorised subprocessors;
• information stored on company-managed devices;
• approved paper records; and
• exports or copies created for legitimate business purposes.

This Schedule covers personal and non-personal records. Personal data must receive the protections required by applicable data-protection law.

3. Retention Principles

Hybrid Comply will apply the following principles.

3.1 No indefinite retention by default

Personal data must not be retained indefinitely merely because it may be useful in the future.

A defined retention period, review event or deletion trigger must apply to every material category of personal data.

3.2 Purpose-based retention

Retention periods must be connected to a documented purpose, including:

• providing the Hybrid Comply service;
• carrying out customer instructions;
• preserving compliance evidence;
• maintaining security;
• resolving complaints;
• administering contracts;
• complying with tax, accounting or regulatory duties;
• establishing, exercising or defending legal claims; or
• producing properly anonymised statistics.

3.3 Data minimisation

Only the information reasonably required for the identified purpose should be retained.

Where part of a record is no longer required, Hybrid Comply should consider:

• deleting that part;
• redacting personal information;
• reducing location precision;
• removing image metadata;
• separating identifying information;
• aggregating the record; or
• anonymising the information.

3.4 Controller and processor roles

Where Hybrid Comply acts as a controller, this Schedule determines the default retention period.

Where Hybrid Comply acts as a processor:

• the customer’s documented retention instructions take priority;
• the applicable Data Processing Agreement applies;
• customer-configured retention settings may apply;
• Hybrid Comply must not retain customer personal data for its own unrelated purposes; and
• Hybrid Comply may retain limited records where legally required or necessary to establish or defend a legal claim.

3.5 Earliest lawful deletion

A record may be deleted before the maximum period where:

• its purpose has been completed;
• no law or contract requires continued retention;
• no legal hold applies;
• deletion will not compromise an active inspection or investigation;
• the relevant customer has authorised deletion; and
• no unresolved data-subject request applies.

3.6 Retention periods are maximums

Unless a legal minimum applies, the periods in this Schedule are maximum periods rather than automatic requirements to retain every record for the full period.

4. Retention Events

Retention periods will normally begin from one of the following events:

• the date a record is created;
• the date an inspection is completed;
• the date a report is issued;
• the date a remedial action is closed;
• the date a subscription ends;
• the date an account is closed;
• the date a complaint or support case is resolved;
• the date consent is withdrawn;
• the date an invoice is issued or a transaction completes;
• the end of the relevant financial year;
• the date a contract expires or terminates;
• the date of the last meaningful interaction;
• the date a security incident is closed;
• the date litigation or an investigation ends; or
• the date a child reaches a relevant age, where an expressly approved child-related retention rule applies.

The applicable retention event must be recorded in the relevant system or processing documentation.

5. Retention Schedule

5.1 Accounts and Customer Administration

5.2 Property and Inspection Records

Implementation note: Inspection evidence must not automatically receive a six-year period without considering the customer’s legal purpose, property type, risk profile and sector. Customers should be able to select a shorter lawful period.

5.3 Location Data

Hybrid Comply must not maintain a continuous historical location profile unless the feature has been specifically approved through a Data Protection Impact Assessment.

5.4 Device, App and Technical Records

5.5 Offline and Device-Stored Records

Uninstalling the app may delete locally stored information. Users should be warned to synchronise required records before uninstalling or changing devices.

5.6 Billing, Payments and Tax Records

Where a different statutory accounting or tax period applies, Finance must record and apply that period.

5.7 Contracts and Legal Records

5.8 Customer Support and Communications

5.9 Marketing and Sales

Marketing records must be reviewed sooner where:

• the address is invalid;
• the person objects;
• consent is withdrawn;
• the contact changes employer;
• the information is inaccurate; or
• continued contact is no longer reasonably expected.

5.10 Analytics, Research and Product Improvement

Inspection photographs, free-text notes, tenant information, pupil information and special-category data must not be reused for general product research, machine-learning development or model training unless the use is separately assessed, lawful, transparent and authorised.

5.11 Data-Protection and Compliance Records

5.12 Security, Fraud and Incident Records

5.13 Staff, Contractor and Recruitment Records

This section applies where Hybrid Comply employs staff or engages contractors.

HR must maintain a more detailed employment retention schedule before recruiting employees at scale.

5.14 Supplier and Business Administration Records

5.15 Website and Cookie Records

5.16 Backups, Archives and Disaster Recovery

Deleted data may remain in protected backups until the relevant backup cycle expires.

Backup data must:

• not be restored to ordinary use except for disaster recovery;
• remain protected from routine access;
• inherit applicable legal holds;
• be deleted through documented backup rotation; and
• be re-deleted where restored after an erasure action.

5.17 Development and Testing Data

6. Sector-Specific Customer Retention

Hybrid Comply’s customers include schools, landlords, homeowners, businesses, hotels and recreation facilities.

Hybrid Comply must not represent the default periods in this Schedule as satisfying every customer’s sector-specific legal obligations.

Customers remain responsible for determining the appropriate retention period for their records, including:

• school premises and safeguarding-related records;
• landlord and tenant records;
• fire-safety records;
• gas and electrical inspection documents;
• workplace health and safety records;
• accident and incident records;
• hotel and leisure-facility records;
• insurance evidence;
• statutory certificates; and
• records required by a regulator, licensing authority or professional body.

Where a customer selects an unusually long period, Hybrid Comply may require confirmation that the customer has documented:

• the purpose;
• lawful basis;
• relevant legal or contractual requirement;
• affected data categories;
• access controls;
• review date; and
• justification for retaining identifiable information.

7. Anonymisation

Information may be retained beyond its normal personal-data retention period where it has been effectively anonymised.

Anonymisation must ensure that an individual is not reasonably identifiable:

• directly;
• through account identifiers;
• through property addresses;
• through location information;
• by combining the dataset with other information reasonably available to Hybrid Comply or a likely recipient; or
• through photographs, free text or unique property circumstances.

Replacing a name with a reference number is normally pseudonymisation, not anonymisation. Pseudonymised information remains subject to this Schedule and applicable data-protection requirements.

8. Legal Holds

Normal deletion must be suspended where information is reasonably required for:

• actual or anticipated litigation;
• a regulatory investigation;
• a law-enforcement request;
• an insurance claim;
• an internal investigation;
• a contractual dispute;
• a data-subject request;
• a personal data breach investigation;
• an audit;
• a safeguarding matter; or
• another legal preservation duty.

A legal hold notice must identify:

• the affected matter;
• the categories of information;
• the systems and custodians involved;
• the date the hold begins;
• the person authorising the hold;
• restrictions on alteration and deletion; and
• the review date.

Legal holds must be reviewed at least every six months.

When a hold ends:

• the Legal or Privacy Lead must issue a written release;
• the underlying retention period must be recalculated;
• overdue records must be deleted promptly; and
• the release and deletion action must be documented.

9. Data-Subject Requests

Hybrid Comply must not delete or alter information for the purpose of avoiding a valid data-subject request.

Once a relevant request is received:

• routine deletion of information potentially within scope may be temporarily paused;
• the pause must be limited to information reasonably needed to respond;
• unnecessary duplicate copies should not be created;
• identity documents used for verification must be deleted promptly after verification;
• the request record must be retained under section 5.11; and
• routine retention rules resume when the request is closed, unless a dispute or legal hold applies.

10. Customer Account Termination

When a customer subscription ends:

1. The customer should be given 30 days to export its data, subject to the applicable contract.
2. The account should become read-only or inaccessible at the end of the export period.
3. Active production data should be deleted within 30 days after the export period expires.
4. Temporary exports should be deleted within 7–30 days after creation.
5. Backups should expire through the ordinary backup cycle within a maximum of 90 days.
6. Hybrid Comply may retain minimal customer, payment, security and contract records under the relevant sections of this Schedule.
7. The customer should receive deletion confirmation where contractually required.
8. Subprocessors must delete or return relevant information under their contracts.

Where immediate deletion is requested, Hybrid Comply may shorten the export period after confirming the requester’s authority.

11. Individual Account Closure

Closing an individual user account does not necessarily delete inspection records belonging to an organisational customer.

On individual account closure:

• the user’s access must be revoked;
• authentication credentials must be disabled;
• optional marketing must stop unless another valid relationship exists;
• the profile should be deleted after the applicable closure period;
• inspection audit history may retain the user’s name or a replacement identifier where necessary for evidential integrity;
• unnecessary contact details should be removed from retained audit records; and
• the user must be told where the organisation controls the relevant inspection data.

12. Deletion Standards

Deletion must be appropriate to the medium and risk.

Approved deletion methods may include:

• permanent deletion from active databases;
• cryptographic erasure;
• secure object-storage deletion;
• automatic expiry;
• deletion of encryption keys;
• secure device wiping;
• physical shredding;
• certified destruction of media;
• irreversible anonymisation; and
• controlled backup rotation.

Moving a file to a recycle bin, marking a record inactive or hiding it from the interface is not sufficient final deletion.

Deletion processes must address:

• primary databases;
• file and object storage;
• search indexes;
• caches;
• exports;
• analytics platforms;
• customer-support systems;
• local device storage;
• development environments;
• subprocessors; and
• backup systems.

13. Destruction Records

Hybrid Comply should keep appropriate evidence of scheduled deletion, including:

• data category;
• system;
• retention rule;
• deletion date;
• volume or record range;
• deletion method;
• person or automated process responsible;
• exceptions;
• legal holds checked; and
• verification result.

Deletion logs should not recreate or contain the deleted personal data.

Operational deletion logs should normally be retained for six years.

14. Responsibilities

14.1 Board and senior management

Senior management is responsible for:

• approving the Schedule;
• ensuring adequate resources;
• assigning accountable owners;
• reviewing significant exceptions; and
• supporting enforcement.

14.2 Privacy Lead or Data Protection Officer

The Privacy Lead is responsible for:

• maintaining this Schedule;
• advising on lawful retention;
• reviewing exceptions;
• coordinating data-subject request holds;
• maintaining relevant compliance records;
• assessing unusually long retention periods; and
• conducting the annual review.

14.3 Information Security Lead

The Security Lead is responsible for:

• secure-deletion standards;
• logging and verification;
• legal-hold implementation;
• access controls;
• device disposal;
• incident-record retention; and
• supplier security requirements.

14.4 Engineering

Engineering is responsible for:

• implementing automated retention;
• deletion across linked systems;
• backup rotation;
• customer-configurable periods;
• account termination workflows;
• test-data controls;
• monitoring failed deletion jobs; and
• maintaining technical deletion documentation.

14.5 Product Management

Product Management is responsible for:

• defining retention requirements during feature design;
• preventing unnecessary collection;
• giving customers suitable retention controls;
• ensuring new features are reflected in the Schedule; and
• completing privacy review before release.

14.6 Customer Support and Customer Success

These teams are responsible for:

• following support-record periods;
• avoiding unnecessary duplication;
• escalating deletion requests;
• correctly handling account closure; and
• warning customers before expiry where appropriate.

14.7 Finance, HR, Marketing and Legal

Each department owns the records created through its activities and must:

• classify records;
• apply the correct retention rule;
• avoid local unauthorised archives;
• respond to deletion reviews;
• preserve records under legal hold; and
• confirm disposal.

14.8 All personnel

All personnel must:

• store information only in approved systems;
• avoid retaining unnecessary copies;
• follow legal holds;
• delete routine files when due;
• not use personal email or storage for Hybrid Comply records; and
• report retention failures or unauthorised archives.

15. Customer Configuration

Hybrid Comply may permit organisational customers to configure retention periods.

The product should:

• present a privacy-protective default;
• explain when the period begins;
• identify which records are affected;
• warn before permanent deletion;
• permit authorised administrators only to change settings;
• log changes;
• prevent ordinary users from overriding deletion;
• identify records subject to legal hold;
• support a deletion grace period where appropriate; and
• communicate how backups are treated.

Hybrid Comply may establish minimum technical periods necessary for:

• security;
• synchronisation;
• recovery;
• fraud prevention; and
• contractual administration.

Any minimum must be documented and proportionate.

16. Retention Exceptions

An exception requires written approval from:

• the relevant record owner; and
• the Privacy Lead, Legal Lead or authorised senior manager.

The exception record must state:

• the relevant data category;
• the normal period;
• the proposed period;
• the reason;
• the legal basis;
• risks to individuals;
• security controls;
• affected systems;
• approval date; and
• next review date.

Open-ended exceptions are prohibited.

Exceptions must be reviewed at least annually.

17. Supplier and Subprocessor Requirements

Contracts with subprocessors or other suppliers that store Hybrid Comply information must address:

• retention periods;
• deletion on termination;
• backup deletion;
• return or export;
• secure disposal;
• legal holds;
• deletion certification;
• international transfers;
• assistance with data-subject requests; and
• notification where deletion cannot be completed.

Supplier retention settings must be reviewed before deployment and at least annually.

A provider’s default retention period must not be accepted without assessing whether it is appropriate for Hybrid Comply.

18. Monitoring and Audit

Hybrid Comply will monitor compliance through:

• automated deletion reports;
• failed-job alerts;
• account-closure checks;
• backup-expiry checks;
• access reviews;
• supplier reviews;
• sample record audits;
• data mapping;
• Record of Processing Activities reviews;
• customer configuration reviews; and
• annual policy review.

Material failures must be recorded and escalated to the Privacy and Security Leads.

A retention failure that exposes, loses or unlawfully retains personal data must be assessed under the Personal Data Breach Response Plan.

19. Review Cycle

This Schedule must be reviewed:

• at least annually;
• before launching a materially new feature;
• when a new category of personal data is introduced;
• when an SDK or subprocessor changes;
• when a customer sector introduces new requirements;
• after a material security incident;
• following relevant legal or regulatory change;
• when a retention exception becomes frequent; or
• when an audit identifies a weakness.

The review must confirm:

• that each data category remains necessary;
• that periods remain justified;
• that actual systems match the Schedule;
• that deletion processes work;
• that backups expire correctly;
• that customer settings are honoured;
• that subprocessors comply; and
• that public privacy information remains accurate.