Data Retention Schedule
This Schedule outlines the retention periods and disposal procedures applied by GRAM Systems to all categories of data managed within our infrastructure, complying with the UK GDPR, the Data Protection Act 2018, and UK statutory business obligations.
1. Master Data Retention Schedule
| Data Category | Retention Period | Statutory / Operational Basis |
|---|---|---|
| Platform User Accounts & Profiles | Duration of client engagement + 12 months | Contract management & reactivation support |
| Commercial Invoices & Billing Records | 7 years following transaction date | UK HMRC statutory tax record-keeping requirements |
| Operational Equipment & BOM Records | Active contract duration; exported on request; purged within 90 days post-termination | Customer data ownership & confidentiality |
| Planned Maintenance (PM) Checklist History | Active contract duration; exported on request | Maritime class & IMCA audit trail compliance |
| Statutory Equipment & Lifting Certificates | Active lifecycle of equipment + contract duration | Safety compliance & statutory inspection records |
| Website Walkthrough & Contact Enquiries | 24 months from date of last communication | Commercial follow-up & consent management |
| Server Security & Access Audit Logs | 12 months rolling window | System integrity, intrusion monitoring, & diagnostics |
| Automated Database Backup Snapshots | 30 days rolling retention with automated overwrite | Disaster recovery & business continuity |
2. Operational Asset Records & Checklists
Clients retain full ownership of all equipment hierarchies, maintenance occurrence logs, and Daily Progress Reports. Because these records serve critical audit purposes for vessel charters and classification societies, GRAM Systems maintains these records throughout the active subscription.
Upon termination of an engagement, client organisations may request a structured export of their complete dataset within 30 days. Following transition, client databases are securely retired.
3. Commercial & Tax Records
In compliance with Section 386 of the Companies Act and UK HM Revenue & Customs (HMRC) regulations, all invoices, payment records, and related commercial agreements are retained for seven (7) years following the conclusion of the relevant tax year.
4. Security & Access Logs
Technical logs containing IP addresses, request timestamps, and authentication attempts are retained on a rolling 12-month basis. These logs are used strictly by Matthew Hudson to monitor platform stability, detect anomalous access attempts, and verify system integrity.
5. Database Backup Snapshots
Automated database snapshots generated for disaster recovery are retained on an automated 30-day rolling rotation. Snapshots older than 30 days are automatically overwritten by cryptographic storage rotation mechanisms.
6. Secure Disposal Procedures
When retention periods expire, data is permanently and irreversibly destroyed:
- Relational Database Records: Cryptographically purged from active database tables using irreversible delete operations.
- Digital Storage Volumes: File attachment storage volumes are overwritten in accordance with modern cryptographic standards.
- Backups: Expired snapshots age out of the automated backup rotation pool and cannot be retrieved.