Data Retention Policy

This policy explains how long Impacturi (operated by Clickonic Ltd) retains data, and what happens to your data when your subscription ends or you ask us to delete it.

1. Principle

We retain personal data only for as long as it is needed to provide our services or to comply with legal obligations. We do not keep data "just in case". When data is no longer needed, it is deleted.

2. Retention periods

Data type	Retained while	After account closure	Lawful basis
Account profile (name, email, organisation)	Subscription is active	Deleted within 30 days	Contract performance (Art. 6(1)(b) UK GDPR)
Donor personal data (names, email addresses, giving history)	Subscription is active	Deleted within 30 days of account closure	Processing under contract with charity (Art. 28 UK GDPR processor obligation)
Financial transaction records	Required by UK law	Retained for 7 years (UK tax law requirement)	Legal obligation (Art. 6(1)(c) UK GDPR; Companies Act 2006; HMRC)
Anonymised and aggregated analytics	Indefinitely	Retained indefinitely (no personal data, cannot identify individuals)	Not personal data; UK GDPR does not apply
Support correspondence	2 years from last contact	Deleted after 2 years	Legitimate interests (Art. 6(1)(f) UK GDPR) — defending potential legal claims
Impact web pages and stories	Subscription is active	Unpublished immediately, deleted within 30 days	Contract performance (Art. 6(1)(b) UK GDPR)
Uploaded media (logos, photos)	Subscription is active	Deleted within 30 days	Contract performance (Art. 6(1)(b) UK GDPR)
CRM connection credentials	Connection is active	Deleted immediately on disconnection or account closure	Contract performance (Art. 6(1)(b) UK GDPR)
Payment and billing records	Required by law	Retained for 7 years (HMRC requirement), held by Stripe	Legal obligation (Art. 6(1)(c) UK GDPR; HMRC)
Application logs (error logs, access logs)	Rolling 90-day window	Automatically purged after 90 days	Legitimate interests (Art. 6(1)(f) UK GDPR) — security monitoring and service integrity
Automated database backups	Daily backups, retained 8 days. There is no longer-term backup tier.	Personal data in backups is purged when those backups age out of the 8-day window	Legitimate interests (Art. 6(1)(f) UK GDPR) — disaster recovery and service continuity

3. Backups and deleted data

Personal data present in automated backups at the time of deletion will be purged when those backups age out of the retention window. The database is backed up daily and each backup is kept for 8 days. There is no monthly or longer-term backup tier. This means that following a deletion request or account closure, personal data may persist in encrypted database backups for up to 8 days before those snapshots are overwritten.

Files you upload, such as logos and photographs, are stored separately from the database and are not covered by that daily database backup. They are copied weekly to separate storage instead, and the twelve most recent weekly copies are kept. So where a deleted record may sit in an encrypted database backup for up to 8 days, a deleted file may sit in those weekly copies for up to about 12 weeks before it ages out. Those copies are private, are never published, and are used only to restore something that has been lost.

Clickonic does not restore personal data from backup solely for data access purposes after a deletion request has been fulfilled. Backups exist solely to allow service restoration in the event of data loss or system failure.

4. What happens when your subscription ends

Grace period: After your subscription lapses, your data is retained for 30 days. During this time you can resubscribe and pick up where you left off, or export your data.
After 30 days: All personal data, donor records, impact web pages, uploaded media, and CRM credentials are permanently deleted from our production database.
Public pages: Any published impact web pages or showcase pages are unpublished immediately when the subscription ends. They are no longer accessible to anyone.

5. Your right to export

Before or during the 30-day grace period, you can export all your data. The platform provides CSV export of donor records and donation history. For a complete data export, contact us and we will provide it within 5 working days.

6. Your right to deletion

You can request deletion of your data at any time by contacting us. We will:

Delete all personal data within 30 days of the request
Confirm deletion in writing
Retain only what is legally required (billing records for HMRC)

You can also delete individual donor records yourself at any time through the platform dashboard.

7. Review

This policy is reviewed at least annually and updated as our platform and legal obligations evolve.

8. Contact

For data export requests, deletion requests, or questions about this policy:

Data Protection contact, Clickonic Ltd
data@impacturi.com