CleverRooms Data Retention and Legal Hold Policy
How long CleverRooms keeps information, how it is deleted, and how a legal hold stops deletion.
Contents
1. Purpose
This policy sets how long CleverRooms Tech Ltd (CleverRooms) keeps information, how it is deleted, and how a legal hold stops deletion. It applies to information we hold for our customers (as their processor) and information we hold for ourselves (as controller), in every system we use, including backups and suppliers' systems.
2. Principles
2.1 We keep personal information only for as long as we need it for the purpose it was collected for, or as the law requires (UK GDPR Article 5(1)(e)).
2.2 The customer decides for its own records. How long a hotel's records are kept in CleverRooms is the hotel's setting. The default is to keep them for the subscription. Shortening the setting is recorded with who, when and why.
2.3 A legal hold stops deletion. A customer, or CleverRooms for its own records, can place a legal hold (for example because of a claim, an inspection or an investigation). While a hold is on, nothing it covers is deleted, whatever the setting says. Placing and lifting a hold is recorded with who, when and why.
2.4 No quiet deletion. CleverRooms never offers or builds a way to make inconvenient records disappear. Deleting a hotel's records is done only by the hotel's setting, by the end of the contract, or by a person's valid request, and every deletion is logged without keeping the deleted content.
2.5 Archive is not delete. In the product, removing an item from view archives it. Archived items count as kept for this policy until they are deleted under it.
3. Customer data (we act for the hotel)
| Information | Kept for | Then |
|---|---|---|
| A hotel's records in CleverRooms (operations records, checks, taps, rotas read in, finance views, apps and automations it built, files and emails it sent in) | The hotel's setting. Default: for the subscription | Deleted under section 3.2 at the end of the contract |
| Records during a pilot that does not continue | The pilot, plus a [30]-day export window | Deleted within [30] days after the window |
| Connection credentials for a hotel's systems | While connected | Deleted immediately when disconnected |
| Raw emails the hotel sends in (for example till reports and invoices) | [90] days after the useful content has been read into the records | Deleted; the records made from them stay under the hotel's setting |
| Requests sent to AI providers | Not kept by CleverRooms beyond the answer; the provider keeps them only for [its stated period, to confirm per provider] | Deleted by the provider |
| A hotel's audit log (who did what and when) | Same as the hotel's records | Deleted with them |
3.1 During the contract, if a person's information must be deleted (for example after a valid request the hotel passes to us), we delete or anonymise it within [10] business days of the hotel's instruction, keeping what the hotel tells us it must keep.
3.2 At the end of the contract, the hotel has [30] days to export its data. We then delete it from live systems within [30] days, and it is overwritten in backups within a further [35] days. We confirm deletion in writing on request.
4. Our own information (we decide)
| Information | Kept for | Why |
|---|---|---|
| CleverRooms user accounts | While active, then [90] days | To let people sign in; the short tail lets a hotel restore a removed user |
| Security and sign-in logs | [12] months | To investigate misuse and incidents |
| Service logs (errors, performance) | [30] days | To fix problems; they must not contain customer content |
| Usage data (combined and de-identified) | Indefinitely | It identifies no hotel or person |
| Support requests | [2] years after closing | To help with repeat problems |
| Customer contracts, order forms and correspondence about them | 6 years after the contract ends | Limitation Act 1980 (6 years for contract claims) |
| Invoices and accounting records | 6 years after the end of the financial year they relate to | Companies Act 2006 and HMRC requirements |
| Personal data breach and incident records | 6 years | To show how incidents were handled |
| Website waitlist | Until CleverRooms launches, then 12 months, unless the person becomes a customer or pilot hotel | As shown on the website privacy notice |
| Website demo requests and questions | 12 months after our last message with the person | As shown on the website privacy notice |
| Marketing opt-out list (email address only) | For as long as we market | So we never contact someone who opted out |
| Job applications | [6] months after the role is filled | To answer questions about the decision |
| CleverRooms staff records | 6 years after the person leaves | Employment and tax law |
5. Backups
5.1 Customer databases are backed up daily, with point-in-time recovery. Backups are kept for no more than [35] days and then overwritten automatically. Deleted information remains in backups only until they expire, and is not restored except to recover from an incident (in which case deletions are applied again).
5.2 Backups are encrypted and stored in the United Kingdom.
6. How information is deleted
Information is deleted from databases and storage using the provider's deletion, so it cannot be read back through the service. Where full deletion is not possible straight away (for example in backups), the information is put beyond use until it is overwritten. Deleted connection credentials are revoked with the provider where the provider allows it.
7. Legal holds
7.1 A legal hold can be placed by the hotel in CleverRooms' settings, or by CleverRooms' director for CleverRooms' own records. It must say what it covers and why.
7.2 While it is on, automatic deletion skips everything it covers, and end-of-contract deletion of covered records waits until it is lifted (we will agree with the hotel how covered records are kept after the contract ends).
7.3 Holds are reviewed every [6] months and lifted when the reason has ended.
8. Suppliers
We require our suppliers to delete our customers' data when we instruct them and when our contract with them ends, and we check their retention settings when we engage them and every year.