Retention Schedule

Last reviewed: 20 October 2026

This schedule sets out each type of personal information Galeno Marketing holds and how long it is kept. Most client and financial records are kept for 6 years, in line with HMRC record-keeping rules and the 6-year time limit for contract claims.

Retention schedule

  
    


  
      Personal information
      Why we hold it
      How long we keep it
      At the end
    

  
      Client contact details (names, job titles, work emails, phone numbers)
      To run client accounts and deliver our services
      For the length of the engagement, then 6 years after it ends
      Delete, or keep only if the contact remains on our marketing list
    

      Contracts, proposals and project records
      To deliver the work and defend or bring any legal claim
      6 years after the engagement ends
      Securely delete
    

      Invoices, payment and accounting records
      To meet HMRC record-keeping rules
      6 years from the end of the financial year they relate to
      Securely delete
    

      Enquiries from prospective clients who do not become clients (including website contact form messages)
      To respond to the enquiry and follow up
      2 years after our last contact
      Delete
    

      Complaints, disputes and claims
      To resolve them and keep a record in case of legal action
      6 years after the matter is closed
      Securely delete
    

      Marketing list (business contacts and newsletter subscribers)
      To send updates about our services
      Until the person unsubscribes, or 2 years with no engagement, whichever is sooner
      Delete, then add to the suppression list if they unsubscribed
    

      Suppression list (people who have opted out of marketing)
      To make sure we never contact them again by mistake
      Indefinitely, holding only the email address
      Not applicable
    

      Testimonials and case studies naming individuals
      To show our work on our website and in pitch materials
      While in use, or until the person asks us to remove them
      Remove from all materials and delete
    

      Supplier and associate details (freelancers, partners)
      To manage the working relationship and pay them
      For the length of the relationship, then 6 years
      Securely delete
    

      Data protection requests (access, deletion and similar)
      To show we handled the request properly
      2 years after the request is completed
      Delete
    

      Website analytics data
      To understand how visitors use our website
      Set by Squarespace; analytics cookies last up to 2 years
      Managed by Squarespace
    


  
  

Personal information	Why we hold it	How long we keep it	At the end
Client contact details (names, job titles, work emails, phone numbers)	To run client accounts and deliver our services	For the length of the engagement, then 6 years after it ends	Delete, or keep only if the contact remains on our marketing list
Contracts, proposals and project records	To deliver the work and defend or bring any legal claim	6 years after the engagement ends	Securely delete
Invoices, payment and accounting records	To meet HMRC record-keeping rules	6 years from the end of the financial year they relate to	Securely delete
Enquiries from prospective clients who do not become clients (including website contact form messages)	To respond to the enquiry and follow up	2 years after our last contact	Delete
Complaints, disputes and claims	To resolve them and keep a record in case of legal action	6 years after the matter is closed	Securely delete
Marketing list (business contacts and newsletter subscribers)	To send updates about our services	Until the person unsubscribes, or 2 years with no engagement, whichever is sooner	Delete, then add to the suppression list if they unsubscribed
Suppression list (people who have opted out of marketing)	To make sure we never contact them again by mistake	Indefinitely, holding only the email address	Not applicable
Testimonials and case studies naming individuals	To show our work on our website and in pitch materials	While in use, or until the person asks us to remove them	Remove from all materials and delete
Supplier and associate details (freelancers, partners)	To manage the working relationship and pay them	For the length of the relationship, then 6 years	Securely delete
Data protection requests (access, deletion and similar)	To show we handled the request properly	2 years after the request is completed	Delete
Website analytics data	To understand how visitors use our website	Set by Squarespace; analytics cookies last up to 2 years	Managed by Squarespace

How we apply this schedule

We review the information we hold once a year and delete anything that has passed its retention period. Deletion covers every place the information is stored, including email, cloud storage, Squarespace and any backups we control.

We keep information for longer only where there is a specific reason, such as an ongoing dispute, an HMRC enquiry or a legal requirement. Once that reason ends, the normal period applies.

We update this schedule if we start collecting new types of personal information or change how we use it.