Data Retention Schedule

Lycia Limited retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory and accounting requirements. Data is securely deleted or anonymised when no longer required.

Retention periods are reviewed at least annually. The following schedule sets out the current retention periods by data category. All periods marked "LEGAL REVIEW REQUIRED" have not been confirmed by legal, tax or provider requirements and must be reviewed before finalisation.

LEGAL REVIEW REQUIRED — All retention periods must be confirmed by a qualified legal or data-protection professional. Lycia does not automatically delete regulated data until approved retention periods are confirmed.

When the retention period expires, data is either:

• Securely deleted — records are permanently removed from the database and associated files are deleted from storage
• Anonymised — identifying fields are removed or irreversibly altered so the data can no longer be linked to an individual, and the anonymised data may be retained for statistical or analytical purposes

The deletion method and anonymisation method are specified for each category in the internal retention configuration.

Data may be retained beyond the standard retention period where:

• There is a legal hold (e.g. pending or anticipated litigation)
• Regulatory requirements specify a longer period
• Data is required for the establishment, exercise or defence of legal claims
• Deletion is not technically feasible without affecting other data

Exceptions are documented and approved by the Privacy Lead.

This retention schedule is reviewed at least annually by the Privacy Lead and approved by the Master Administrator. The next review date is recorded in the internal retention configuration.