Osa näistä asiakirjoista julkaistaan toistaiseksi vain englanniksi ja saksaksi. Käännöksiä valmistellaan; englanninkielinen teksti on ratkaiseva versio.
Data Retention & Deletion Policy
Grow Pro®, Grow_Pro_Data_Retention_Policy_v1_5
How long we keep your data, and when and how it is deleted.
| Document | Grow_Pro_Data_Retention_Policy_v1_5 |
|---|---|
| Version | 1.5 |
| Owner | Chris, Founder & CEO, Gro Pro Ltd |
| Approver | Director (David) |
| Effective date | 1 September 2026 |
| Review cycle | Annually, or on material change |
| Issued | 2026-09-29 |
1. Purpose
This policy sets out how Gro Pro Ltd applies the storage limitation principle in Article 5(1)(e) of the UK GDPR: that personal data is kept no longer than is necessary for the purpose it was collected for. It covers everything Grow Pro® processes, in production systems, in backups, in logs, and at the companies who work for us.
Our Privacy Policy points here for the full schedule. This document is the master record. Where it disagrees with any other Grow Pro® document, this one prevails.
2. The principles we work to
- Keep data only as long as it is needed for a purpose we have written down.
- Where the law requires us to keep something longer, that period wins.
- Where we keep something for our own legitimate interests, the period has to be proportionate and recorded here.
- At the end of a retention period, data is deleted or anonymised so thoroughly that nobody could work back to a person.
- Backups are not an exemption. A deletion flows through to backups within the backup window.
- Where the law says keep it, it is kept, and it is not deleted with the account. It is moved somewhere restricted, cut back to the least that still makes it a valid record, and deleted when the period ends.
3. The schedule
| What | Lawful basis | How long | Notes |
|---|---|---|---|
| Account record: email address, hashed password, postcode district | Contract | Life of the account, then 30 days | Deleted from production within 30 days of closure and from backups within 90. We do not hold a name, a date of birth or a full postcode for an account. A name and full address are held only against an order, see below |
| Notes you write | Contract | Life of the account | You can delete any of them at any time. Hard deleted when you close the account |
| Garden and plant records, journals, tasks | Contract | Life of the account | As above |
| Your questions to Sage | Contract | Life of the account | Deleted with the account, straight away. We keep the question and what it matched to, never the answer |
| Name and delivery address held against an order | Contract | Life of the account, then 30 days, except where it forms part of a sale record below | Collected only when there is something to post |
| Soil test results and reports | Contract | Life of the account | The laboratory holds its own copy under its own retention, see section 6 |
| Sale and payment records | Legal obligation (HMRC) | 6 years from the end of the financial year the sale falls in. Our financial year ends 31 October | Survives account closure. Moved to restricted access storage and cut back to the order reference, date, what was bought, the amount, VAT where it applies, your name and billing address, and the invoice. Nothing else. Held by us and by our payment provider |
| Records of consent, including cookie consent and acceptance of the Terms | Legal obligation (accountability) | Life of the account, then 3 years. Where there was a sale, the acceptance record is kept beside it for the same 6 years, because it is the evidence the sale was validly contracted | The version accepted and the time it was accepted, which is the only evidence that consent was given |
| Support tickets | Legitimate interests | 3 years from closure | Service quality and defending a dispute |
| Data subject requests and complaints | Legal obligation | 3 years from closure | For audit and for regulator queries |
| The anonymous garden record made at deletion: plants grown (reference, count, month), habitat features, wildlife sightings (species, month, count), region | Not personal data once made (anonymised; see section 5). Making it: legitimate interests | Indefinite | Made at every deletion. Holds no postcode, address, email, name, free text, given names, garden shape or size, harvests or account details; dates rounded to the month; no identifier that can be joined back to any live or deleted account. Kept so we can see across many gardens what grows and what helps wildlife where. Nothing goes outside the company until the section 5 release check has been done |
| Deletion logs | Legal obligation (accountability) | 6 years | What was requested, when production completed, when each instruction went out, and what came back. This is the only evidence we would have if anybody asked |
| Crash logs, telemetry, app logs | Legitimate interests | 90 days | Aggregated figures with nobody in them may be kept longer |
| Server access logs | Legitimate interests | 12 months | Incident detection and investigation |
| Governance records: this policy, the ROPA, DPIAs, security policies | Legitimate interests | Indefinite, with versions kept | Superseded versions kept so an auditor can see what applied when |
| Backups | Legitimate interests | Rolling 30 days | Encrypted. Restoration tested at least once a year |
4. How deletion works
- You start it, from your account settings. We also start it on a verified request made any other way, because under UK GDPR you can ask by any route you like and we cannot make you use a settings page.
- Production deletion completes within 30 days of the request.
- Backups expire on the rolling 30 day window, so within 90 days at the outside.
- The companies who hold your data for us are told at the same time, and what we tell each of them differs. Section 6 sets that out.
- Deletion means deletion. Not a flag, not a hidden row.
- Anything we must keep for a legal reason moves to restricted access storage with the minimum identifiers, and does not simply survive in place.
DELETION_SPEC_for_code.md is the build specification for all of this.
5. Anonymising rather than deleting
Where data still has value after its retention period, and only where it can be stripped of any link to a person, it may be anonymised and kept.
One thing is kept this way: the anonymous garden record. When you delete your account, the plants you grew, the habitat features you built, the wildlife you recorded and your region are written to a record that has no key back to you, and the rest of your account is deleted. It exists so that we can learn across many gardens what grows and what helps wildlife where, which is a picture no single garden shows. It never holds your postcode, address, email, name, notes, the names you gave plants or zones, your garden's shape or size, your harvests or anything about your account; dates are rounded to the month; and the region is one of about thirty.
It is made at every deletion; there is no tick box, because once made it is not about you. The right to object to processing done under legitimate interests still applies up to the moment of deletion, and an objection sent to hello@growproltd.com before deleting is honoured.
If any of it ever leaves the company — published, or passed to anybody outside it — the person releasing it checks that no combination of region, plants and sightings appears so rarely that one garden could be picked out (a rare plant in a small region is the usual case), and either aggregates or removes those rows. The check and its result are recorded in the working notes. The check stays whether or not there is ever anybody to release anything to: it is the test of whether the word anonymous is true of this record at all, and that is worth knowing either way.
Anonymisation has to be one way. No key, no lookup table, no realistic route back to a person. If there is a route back it is not anonymised and this section does not apply to it. If a photograph upload is ever built, the same rule will apply to it.
6. The companies who hold your data, and what we can make them do
| Who | What they hold | Their role | What happens when you delete |
|---|---|---|---|
| Stripe, our payment provider | Name and billing address against a payment | Processor | Nothing, while the 6 year HMRC retention is running, because their record is the sale record we are required to keep. It goes when that period ends |
| DJL Agriculture Ltd, who pack and post products. Company number 09980803, Scropton, Derby, DE65 5PS | Name, delivery address, what you ordered | Processor | An instruction to delete, which they must follow and confirm under our data processing agreement. We log the confirmation |
| Richard Austin Agriculture Ltd, our soil laboratory. Company number 06936430, Frampton West, Boston, Lincolnshire, PE20 1RZ | Name and address, because they post the sampling kit out to you | Controller in their own right | A forwarded request, not an instruction. They decide, and their published policy says they hold data for up to 7 years. We tell you that rather than promise you something we cannot deliver |
Where we can only ask, we say so. Telling somebody their data has gone everywhere when it has not would be worse than telling them the truth.
7. Who is responsible
- Founder & CEO owns this policy and approves any departure from it.
- Director reviews the schedule every year and on any material change.
- Engineering lead builds the automatic deletion and checks that it works.
- Accountant manages retention of tax and accounting records.
8. Review
Reviewed every year, and whenever a new category of data, a new company, a new lawful basis or a new country is introduced.
9. Questions
hello@growproltd.com. If you are unhappy with how we handle your data you can also complain to the Information Commissioner's Office at ico.org.uk. We are registered with the ICO under reference ZC126801.
Document control
| Version | Date | Author | Summary of changes |
|---|---|---|---|
| 1.5 | 2026-09-29 | Chris | Version 1.4, with one thing taken out on the founder's instruction of 29 September: the statements that the anonymous garden record might be used, shared or sold commercially. There is no buyer for it and none is being looked for, and a policy should not hold out a possibility the company is not pursuing. Three places carried it: the schedule row for the record, the opening of section 5, and the release-check paragraph. Each now says what the record is actually for — seeing across many gardens what grows and what helps wildlife where — and the schedule row still says the retention is indefinite. The release check written for the sale is kept, reworded from a step before a sale to a condition on anything leaving the company at all, and a line added that it stands whether anything leaves or not. It is the check that no single garden can be picked out of the data, which is what makes the word anonymous true; removing it with the sale would have weakened the policy for no gain. Nothing else in 1.4 is changed |
| 1.4 | 2026-09-27 | Chris | The founder's answers of 27 September: the record is made at every deletion with no tick box; it holds only plants, habitat features, wildlife sightings and region (harvests, garden type, size band and account age dropped); a release check against rare combinations written into section 5, with the schedule row pointing at it; the right to object noted. Issued but never published in this form; 1.5 is the version that went out |
| 1.3 | 2026-09-27 | Chris | The anonymous garden record added to the schedule and to section 5, on the founder's instruction that plant and biodiversity information should outlive an account with nothing personal and no exact location: the fields kept, the fields never kept, region as the location grain, month rounding, indefinite retention, and the opt-out at deletion. Section 5 no longer says nothing is kept this way |
| 1.0 | 2026-05-04 | Chris | Initial draft |
| 1.2 | 2026-09-01 | Chris | Photographs removed from the schedule and from section 5, because there is no photograph upload in the application. Section 5 now says plainly that nothing of a customer's is being kept this way today. The AI inference log row removed, since there is no outside AI provider, and our AI provider removed from section 6 for the same reason |
| 1.1 | 2026-09-01 | Chris | Every period checked against the law rather than carried forward. HMRC's six years now runs from the end of the financial year the sale falls in, which for us is 31 October, not from the end of the tax year, and the sale record row says exactly which fields are kept. Published, because the Privacy Policy defers to this document for the full schedule and a reader had no way to see it. The account record row corrected: it listed a name, a date of birth and a region, none of which we collect. A name and address now appear only against an order. Rows added for Sage conversations, soil test results, consent records and deletion logs. Section 6 added, naming Stripe, DJL, the laboratory and our AI provider, what each holds and what we can actually make each of them do, including that the laboratory is a controller in its own right and can only be asked. Stripe's position under the 6 year HMRC retention stated. Photographs in the reference library given their own section with the right to object. Effective date set, draft marking and signature block removed |
Approval
Approved in writing by the directors of Gro Pro Ltd on 1 September 2026. The executed copy is held by the company.
Gro Pro Ltd | Grow Pro® UK Trade Mark No. UK00004034914
Haluatko mieluummin puhua ihmisen kanssa? Kirjoita meille, niin saat ihmisen.
hello@growproltd.com