Data Retention Policy

Welcome

Native is a trading name of Native Places Limited (“Native”, “we”, “us”, “our”).

This policy is effective from and was last revised 17 August 2026. The next review date is 17 August 2027 or the first working day thereafter.

Please read this data retention policy carefully as it sets out the basis and timeframes on which we retain and dispose of data produced by or through:

• the www.nativeplaces.com website;
• corporate portals or web pages managed by Native on behalf of our corporate clients;
• web pages offering payment or booking services from our booking apps;
• staff functions including asset management, direct, agent & partner, corporate and key account client services, HR, operations & estates, finance, business development, marketing and IT team personnel; and
• incoming emails or data transfers from colleagues or third parties.

The purpose of this Policy is to ensure that data controlled or processed by Native is adequately protected and maintained, and that records no longer needed are discarded at the proper time.

This Policy also helps Native employees understand their obligations in retaining electronic documents – including e-mail, web files, text files, sound and movie files, PDF documents, Microsoft Office or other formatted files, and database records.

Native is committed to compliance with Data Processing Laws and respecting your privacy. “Data Processing Laws” means: (a) the UK General Data Protection Regulation (the retained Regulation (EU) 2016/679, “UK GDPR”) and the Data Protection Act 2018; and/or (b) where applicable to Native’s processing (for example, processing relating to individuals in the EU), the EU General Data Protection Regulation (EU 2016/679); and/or (c) any corresponding or equivalent national laws or regulations; and any applicable laws replacing, amending, extending, re-enacting or consolidating any of the above from time to time. For the purposes of the Data Processing Laws, Native Places Limited is the data controller.

Native’s Privacy Policy can be viewed at https://www.nativeplaces.com/privacy-policy.

You have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk, if you believe your data has been processed unlawfully.

Administration

Attached as Appendix A is a Retention Schedule, approved as the initial maintenance, retention and disposal schedule for physical records of Native and the retention and disposal of electronic documents. The Data Protection Officer (DPO) is the officer in charge of administering this Policy and implementing processes and procedures to ensure the Record Retention Schedule is followed. The DPO is also authorised to make modifications to the Record Retention Schedule from time to time to ensure it remains compliant with national and international law.

Suspension of Record Disposal in the Event of Litigation or Claims

If Native is served with any data access request, court proceedings, legal claim, request for documents, or any employee becomes aware of a governmental investigation or audit concerning Native, or the commencement of any litigation against or concerning Native, that employee shall inform the DPO and any further disposal of relevant documents shall be suspended until the DPO, with the advice of counsel, determines otherwise. The DPO shall take the steps necessary to promptly inform all staff of any such suspension.

Data Subject Rights and Early Deletion

The retention periods in Appendix A are maximum periods, not entitlements to retain data regardless of circumstance. Where a data subject exercises a right under UK GDPR (for example, the right to erasure under Article 17, or the right to restriction of processing under Article 18), Native will assess the request under its separate Data Subject Rights Procedure and may delete or restrict the relevant data earlier than the periods below, unless an overriding legal obligation, the establishment/defence of legal claims, or another applicable exemption applies.

Appendix A – Retention Schedule

The Retention Schedule is organised as follows:

1. Personal Data under our Privacy Policy ·
2. Accounting and Finance ·
3. Contracts ·
4. Corporate Records ·
5. Correspondence and Internal Memoranda ·
6. Email & Digital Documents ·
7. Insurance Records ·
8. Legal Files and Papers ·
9. Payroll Documents ·
10. Pension Documents ·
11. Personnel Records ·
12. Health & Safety Records ·
13. Property Records ·
14. Tax Records.

A. Personal Data that Falls Under the Terms of Our Privacy Policy

Sign-ups for news, offers or marketing campaigns – where you have provided your contact details and confirmed consent to receive news, offers or marketing campaigns, we retain your personal information for no longer than 5 years from the point you last expressed interest, opened a communication without unsubscribing, provided consent, contacted us, subscribed or unsubscribed.

Cookies and other tracking technologies – we retain information derived from cookies and similar technologies for no longer than 12 months. Our cookie banner will prompt you to re-confirm your preferences at renewal; continued use after that point without re-confirmation will not be treated as ongoing consent for non-essential cookies.

Personal information related to enquiries and orders – where you have made an enquiry about, or an order for, products or services (or a third party has done so on your behalf), we retain your information for no longer than 7 years from the point of your last enquiry or order. This period reflects the standard six-year limitation period for contract-related claims under the Limitation Act 1980, plus a one-year administrative buffer.

Billing – where you have been billed by Native for any products or services, we retain your information for no longer than 7 years from the point of billing of your last invoice, consistent with HMRC recordkeeping requirements for tax purposes.

Account information – we retain your account information for as long as your account is active, and a reasonable period thereafter in case you decide to reactivate the Services. We also retain some information as necessary to comply with legal obligations, resolve disputes, enforce our agreements, support business operations, and continue to develop and improve our products and services.

Client contracts – where you are an employee of a corporate client whose contract with us specifies that data must be retained for reporting purposes on their behalf for a particular period, we will comply with that period where possible and where the client has confirmed their responsibility as data controller in that regard.

Job applicant details – CVs, covering letters, application forms and interview notes for unsuccessful candidates are retained for no longer than 1 year, reflecting the standard time limit for bringing an employment tribunal discrimination claim, plus a buffer. Successful candidates will have these files transferred to their personnel file, whose retention is covered under Section K (Personnel Records), not this section.

Other files and emails – we retain active, undeleted electronic files and emails for no longer than 7 years, unless identified as business-critical and set not to be deleted (see Section F for full email handling rules).

Complaints – we retain complaints and responses for no longer than 6 years from closure, reflecting the standard six-year limitation period for related civil claims.

In other cases, we store personal information for the period needed for the purpose for which it was collected or is being further processed, and sometimes longer where required by law. Otherwise, we delete it.

B. Accounting and Finance