Once the respective purpose ceases to apply, we will either delete or anonymise the personal information or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
As explained above in the section “What do we do”, GBG access personal data in 2 ways. When we access personal data via a web service, our data suppliers hold the database therefore GBG does not see or have any control over this, other than via our GBG Audit Trail which we explain below.
We also receive personal data which we host a copy of. At the point of collection, you will have been advised how long your personal data will be held for, which will be different to the retention period GBG state below.
A ‘data refresh’ is how often GBG get a copy of the personal data. The data supplier may provide GBG with a complete refresh, which is a new copy of the entire file. Some data suppliers only provide updates to a file (e.g. new records, updates to existing records or a request to delete records). GBG then apply these updates to a master file we hold. What this means is whilst GBG gets a new copy of the data, this database may contain much of the same data we have previously received. This explains why the data refresh is different to GBG’s data retention period.
| Sector |
Data Refresh |
GBG Data Retention Period |
Further Information |
| GBG Audit Trail |
Daily |
12 month |
GBG retain a copy of your personal data for a period of twelve (12) months to enable GBG to respond when an individual wishes to exercise a data subject right. |
| Full Electoral Roll |
Monthly |
From 1992
The retention period will increase each year, up to 80 years. This will then be maintained at 80 years. Customer access is restricted for 6 years, with the opportunity to view earlier data providing they have a justification.
|
This data is governed by the Representation of the People Act, therefore can only be used by our public sector/law enforcement customers. |
| Open Register |
Monthly |
From 2003
The retention period will increase each year, up to 80 years. This will then be maintained at 80 years. Customer access is restricted for 6 years, with the opportunity to view earlier data providing they have a justification.
|
Also known as the Edited Electoral Roll. |
| insolvency Data |
Weekly |
6 years |
We receive data from 3 sources: England and Wales, Scotland and Northern Ireland. They each send GBG any new records, amended records or records they would like us to delete. We then apply this to a copy of the database we hold. |
| Postcode Address File (PAF) |
Daily |
Variable
GBG receives daily updates of PAF, which we hold which we hold indefinitely to aid historical address or postcode enquiries. We apply this to a copy of the database we hold, and where an address is retained, Royal Mail keeps it on their master database (i.e. for as long as the property exists).
|
PAF is address data provided by Royal Mail |
| BT OSIS (UK Telephone Number Database) |
6 days a week |
Variable
GBG receive updates of any new records, amended records or any records we need to delete and we hold these update files for 2 weeks. We apply the updates to a master database, so you will stay on this until BT ask us to remove you, which is typically when you cease having a landline telephone number.
|
You may know this as the BT Phonebook. GBG must refer to it by its name as dictated by our licence. |
| Commercial Data |
Weekly or Monthly |
2 Months
|
GBG receive a full refresh of the data each month, but may receive a weekly update asking us to remove a record if an individual has exercised one of their data subject rights to our data supplier. |
If you have questions about or need further information concerning how long we keep your personal data for, please contact us using the contact details provided below.
Transfers outside of the UK and European Economic Area (EEA)
Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.
Our group companies, data suppliers, customers and third party providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.
However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this privacy notice.
Where appropriate, these include implementing the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Agreement for international data transfers between our group companies, which require all group companies to protect UK and EEA personal data in accordance with UK and European Union data protection law.
We have implemented similar appropriate safeguards with our data suppliers, customers and third party providers and partners.