Data Retention Policy
How We Set Retention
We keep information only as long as needed for the purpose for which it was collected, a contract, applicable record-keeping duties, security, or legal claims. At the end of a period we delete or anonymise it, unless a documented exception requires a temporary hold. Backups expire on their managed rotation.
Optional homepage analytics can create a short-lived, pseudonymous broad-interest profile. It is used only to choose approved homepage content and never determines price, eligibility, or a customer-service outcome. Raw visitor identifiers are not stored in the growth database.
Retention Periods
| Category | Data Held | Retention Period | Lawful Basis |
|---|---|---|---|
| Customer accounts | Name, email address, and hashed password | Account lifetime, then up to 2 years after last activity | Contract; legitimate interests |
| Orders and payments | Order, delivery, invoice, and payment-reference records; no complete card details | 7 years | Contract; legal obligations |
| Quotes and uploaded project files | Contact and project details, correspondence, photographs, and quote status | 2 years from the latest relevant activity | Steps before contract; legitimate interests |
| Contact and enquiry messages | Name, contact details, message, and related correspondence | 2 years from the latest relevant activity | Steps before contract; legitimate interests |
| Newsletter subscriptions | Email address, subscription and suppression records | Until withdrawal, with a suppression record kept as needed | Consent; legitimate interests in honouring opt-outs |
| Product reviews | Review, rating, and associated account or moderation information | While published; account identifiers removed when appropriate | Legitimate interests |
| Essential security and operational logs | Restricted request, authentication, error, and fraud-prevention information | Normally no more than 90 days; longer if required for an incident or claim | Legitimate interests; legal claims |
| Consent choices | Signed choice in the browser and a pseudonymous consent receipt | Browser choice: 180 days; receipt and related audit record: 730 days | Consent administration; legitimate interests in demonstrating choices |
| Optional growth events | Pseudonymous visitor key, safe event name, page path without query text, device class, and approved metadata | 180 days | Consent (analytics and experiments) |
| Broad interest profile | Decayed scores, broad segment, event count, and last-event time; no form values or contact details | 180 days from the latest qualifying activity; removed on withdrawal where linked | Consent (analytics plus personalisation) |
| Experiment exposure and conversion records | One-way visitor key, experiment and variant, opaque quote identifier, outcome, and optional booked value | 395 days | Consent (analytics and experiments); experiment integrity |
| Growth agent and governance records | Aggregate insight summaries, bounded AI proposals, decisions, alerts, and audit history | 730 days | Legitimate interests in safe operation and accountability |
| Optional session replay | Masked and sampled interaction recording, only if separately approved and enabled | Target 30–90 days, confirmed before activation | Consent (analytics and experiments) |
Provider-held optional analytics or marketing data is also subject to the configured provider retention period described in our Cookie and Storage Notice. Optional session replay remains disabled unless its exact settings and period have been approved and published.
What Happens When You Withdraw
Changing Cookie Preferences stops future collection for the withdrawn category. We remove the growth browser identifier and linked broad-interest profile where available. Pseudonymous consent, experiment exposure, conversion, security, and audit records created before withdrawal may remain for the periods above where needed to demonstrate the choice, prevent duplicate counting, preserve experiment integrity, or establish legal claims. They are not used for future personalised content. Aggregate statistics that no longer identify a visitor may also remain.
Your Rights
Depending on the circumstances, you may ask us for access, correction, erasure, restriction, portability, or object to processing. You can withdraw consent at any time. A right may be limited where we must keep a record by law or have another overriding lawful reason. We normally respond within one calendar month.
Export and Deletion Requests
Account holders can review available order information on the account page. For a formal export or deletion request, email privacy@kenningtonupholstery.com with enough information for us to verify and locate your records. We may ask for proportionate proof of identity. Records required for tax, contractual, security, or legal-claim purposes cannot always be deleted immediately.
Contact and Complaints
Contact privacy@kenningtonupholstery.com with a retention or rights question. If you are dissatisfied with our response, you can complain to the Information Commissioner's Office.
Last updated: 16 July 2026