Data Retention Policy
Last updated: 1 July 2026
This policy sets out how long VBU4 Limited (trading as LogisticsFlow) retains different categories of personal and operational data, and how that data is deleted when it is no longer needed. This policy forms part of our commitment to UK GDPR compliance.
1. Principles
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. When data is no longer needed, it is permanently and securely deleted.
2. Retention schedule
| Data category | Retention period | Reason |
|---|---|---|
| User account data (name, email, role) | Duration of subscription + 30 days after closure | Service delivery; allows data export before deletion |
| Company and site data | Duration of subscription + 30 days after closure | Service delivery |
| Booking records | 7 years from booking date | Legal/contractual obligation and audit trail |
| Delivery slot and capacity data | 3 years from slot date | Operational reporting and dispute resolution |
| Uploaded documents (PODs, compliance docs) | 12 months from upload date | Operational necessity; configurable by account admin |
| Booking messages | 7 years from booking date | Audit trail and dispute resolution |
| Notification history | 90 days | Support and debugging |
| Password reset tokens | 15 minutes from generation | Security, short expiry minimises risk |
| Email verification tokens | 24 hours from generation | Account security |
| Server access logs | 90 days | Security monitoring and incident investigation |
| Payment transaction records | 7 years | Legal obligation (HMRC / financial regulation) |
| Support communications (emails) | 3 years from last contact | Dispute resolution and service improvement |
| Anonymised/aggregated analytics | Indefinite | Cannot identify individuals; used for product improvement |
3. Account closure and deletion
When a subscription is cancelled or a customer account is closed:
- The account is immediately deactivated and access is revoked.
- Customer data is retained for 30 days to allow the customer to request a data export.
- After 30 days, all personal data (user accounts, company data, bookings, messages, and uploaded documents) is permanently and irreversibly deleted from our systems and storage providers.
- Booking records subject to the 7-year legal retention requirement are anonymised rather than deleted, so the operational record is preserved without identifying individuals.
4. Deletion of individual data (right to erasure)
Under UK GDPR Article 17, individuals may request deletion of their personal data. We will honour such requests within 30 days, subject to our legal obligations to retain certain records (e.g. financial transaction records for 7 years under HMRC requirements). Where we cannot delete data in full, we will inform you of what is retained and why.
To submit a deletion request, email privacy@logisticsflow.co.uk.
5. Storage and security during retention
All retained data is stored securely with encryption at rest and in transit. Access is restricted to authorised personnel only. Third-party storage providers (Neon, Cloudflare R2, Vercel) operate under Data Processing Agreements and are required to maintain equivalent security standards.
6. Breach notification
In the event of a data breach affecting retained personal data, VBU4 Limited will notify the ICO within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where the breach poses a high risk to their rights and freedoms.
7. Policy review
This policy is reviewed at least annually. The most recent version is always published at this URL. Material changes will be communicated to active customers by email.
8. Contact
For questions about this policy or to exercise your data rights:
VBU4 Limited (trading as LogisticsFlow)
Email: privacy@logisticsflow.co.uk