The New 5-a-day Data Retention Schedule
Version
2.0
Date
November 2026
Owner
Website owner
Review date
November 2027
1. Purpose
This schedule sets out the categories of personal data processed by The New 5-a-Day, the legal basis for processing, the retention period for each category, and the method of deletion or anonymisation. It supports compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The schedule applies to all personal data collected through the website (new5aday.com), and associated communications. It should be read alongside the website’s Privacy Notice.
The website is operated by Nicholas Walters as an individual (the “website owner”). No company is involved in operating the website, and there is no online shop, app or newsletter connected to it.
2. Retention Principles
Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected. The following principles apply:
• Data is kept for the minimum period necessary to fulfil its stated purpose.
• Where a legal obligation requires longer retention (e.g. tax records), the statutory period takes precedence.
• Data is reviewed at least annually against this schedule.
• Data past its retention period is deleted or anonymised within 30 days of the review.
• Data subjects may request earlier deletion under their right to erasure (Article 17, UK GDPR), subject to lawful exceptions.
3. Data Retention Schedule
4. Legal Basis Summary
The website owner relies on the following legal bases under Article 6(1) of the UK GDPR:
5. Deletion and Anonymisation Procedures
• All deletion actions are logged with the date, data category, volume of records deleted, and method used.
• Where data cannot be fully deleted (e.g. backup systems with fixed retention cycles), it is flagged for deletion at the next available cycle and access is restricted in the interim.
• Anonymisation is used where aggregate data has ongoing analytical value. Anonymised data is not personal data and falls outside the scope of UK GDPR.
• Deletion requests from data subjects (right to erasure) are actioned within 30 days of receipt, in accordance with Article 17.
• Where deletion is refused on lawful grounds (e.g. legal obligation to retain tax records), the data subject is informed of the reason and their right to complain to the ICO.
6. Data Subject Rights
Data subjects have the following rights under the UK GDPR. Requests should be directed to the contact details set out in the Privacy Notice and will be responded to within 30 days.
• Right of access (Article 15) — to obtain a copy of personal data held.
• Right to rectification (Article 16) — to correct inaccurate personal data.
• Right to erasure (Article 17) — to request deletion of personal data where there is no compelling reason for continued processing.
• Right to restriction of processing (Article 18) — to limit how data is used.
• Right to data portability (Article 20) — to receive personal data in a structured, commonly used format.
• Right to object (Article 21) — to object to processing based on legitimate interest.
• Right to withdraw consent — where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
7. Review
This schedule is reviewed annually by the Website owner, or sooner if there is a material change to data processing activities (e.g. new data categories, new third-party processors, or changes to applicable law).
Changes to this schedule are recorded in the version control table on the first page. The current version is published internally and referenced in the website’s Privacy Notice.
End of Data Retention Schedule
