How long CM Beyer retains your data

A summary of how long we keep different categories of personal and business data, and why. This complements the retention section in our privacy policy.

Why retention periods matter

Under UK GDPR, personal data must not be kept for longer than necessary for the purposes for which it was collected. Different categories of data have different appropriate retention periods, driven by legal obligations, legitimate business needs, and contractual requirements.

Standard retention periods

The following are our standard periods. Specific engagements or legal requirements may extend or shorten them in particular cases.

Engagement records — 7 years

Signed engagement terms, statements of work, invoices, and key correspondence are retained for seven years from engagement close. This reflects HMRC’s six-year record-keeping requirement plus one additional year for limitation purposes.

Working files and project materials — 2 years

Draft deliverables, internal working files, research notes, and project communications are typically retained for two years from engagement close, then deleted. If you would like working files retained for longer, you can request this in writing.

Enquiry and proposal data — 18 months

If you contacted us about a possible engagement but did not proceed, your enquiry and any proposal we issued is retained for eighteen months and then deleted, unless you have asked us to keep your details on file.

Marketing contact data — until you unsubscribe

If you have opted in to marketing communications, your contact details are retained until you unsubscribe or ask us to delete them. See how to opt out of marketing communications.

Investor records — life of the instrument plus 7 years

Records relating to loan notes, dividends, and shareholder registers are retained for the lifetime of the instrument plus seven years after redemption or transfer.

Website analytics — 26 months

Aggregated and anonymised website analytics are retained for 26 months. Individual session data is not linked to identified individuals.

Asking for early deletion

You can ask us to delete personal data sooner than the standard period under the GDPR right to erasure. We will comply unless we have a legal or contractual obligation to retain it. See your rights under UK GDPR for how to make a request.