Adopted: 9 October 2026. Retention periods may be extended where information is required for an active complaint, dispute, legal claim, regulatory investigation or another legal obligation.
Retention periods
| Information | Normal retention period | Action at the end |
|---|---|---|
| Website enquiry submissions held by Formspree | Up to 30 days in Formspree’s submission archive. The resulting business enquiry may then be retained under the period below. | Allow deletion from Formspree’s archive and retain only the enquiry record required for business purposes. |
| Unsuccessful enquiries and quotations | 12 months after the last meaningful contact. | Securely delete or anonymise. |
| Active client contact information and project files | For the duration of the client relationship. | Review and retain only the records required under the periods below. |
| Contracts, approvals and important project correspondence | Six years after the client relationship ends or a dispute is resolved, whichever is later. | Securely delete or anonymise. |
| Invoices, expenses and tax records | At least five years after the 31 January Self Assessment deadline for the relevant tax year, or longer where legally required. | Securely delete when the statutory period has expired and no investigation is active. |
| Orca Marketing’s own marketing contacts | Until consent is withdrawn, the person objects or the information is no longer relevant. Records are reviewed at least every 24 months. | Remove from active marketing systems and retain only a minimal suppression record where required. |
| Marketing suppression records | For as long as Orca Marketing conducts the relevant marketing activity. | Retain only the minimum information needed to prevent further marketing contact. |
| Client customer data processed by Orca Marketing | For the duration of the relevant engagement and normally no longer than 30 days afterwards, unless the client instructs otherwise or the law requires retention. | Return to the client or securely delete in accordance with the applicable data-processing terms. |
| Website and security logs, where collected | Normally no longer than 90 days, unless required to investigate a security incident. | Securely delete or anonymise. |
| Deleted information held in backups | Until removed through the normal backup cycle, normally within 90 days. | Allow secure, automatic deletion through the backup cycle. |
Review and deletion
Orca Marketing reviews retained personal information at least annually. Information that is no longer required is securely deleted or anonymised so that individuals can no longer be identified.
Where a client supplies personal information for Orca Marketing to process on its behalf, the client’s documented instructions and the applicable data-processing terms take priority, subject to legal requirements.
Contact
Questions about this schedule or a request concerning personal information can be sent to James@orcamarketing.co.uk.