Website & Marketing Privacy Notice

How long Charcoalblue Group Ltd holds different categories of personal data, and what happens when a retention period ends
Effective date: August 2026

This policy sets out how long Charcoalblue Group Ltd retains the personal data described in our Website & Marketing Privacy Notice and Candidate Privacy Notice, and the process for reviewing and acting on that data once a retention period ends. It closes a gap that our privacy notices flag but do not themselves resolve.

 

1. Why we have this policy

Data protection law requires us to keep personal data for no longer than necessary for the purpose it was collected for. This policy is our internal record of how we apply that principle in practice, and the public-facing summary our contacts and candidates can refer to.

 

2. Marketing and website contacts

  • Active contacts who engage with our emails (opens, clicks or replies) — retained for as long as they remain engaged and have not unsubscribed
  • Non-engaging contacts — where a contact has not opened or clicked any email for 12 months, we will send a re-permission / “still want to hear from us?” campaign asking them to reconfirm interest
  • Contacts who do not respond to a re-permission request within 30 days are removed from active marketing lists and moved to a suppression list to ensure we do not re-add them accidentally
  • Suppression list entries (unsubscribes) — retained indefinitely, or for as long as reasonably necessary, solely to ensure we honour the opt-out and do not re-contact the individual
  • Website enquiry data not converted to a marketing contact — retained for up to 36 months to allow us to follow up, then deleted

 

3. Candidate data

  • Unsuccessful applicants — retained for 12 months following notification of our decision, to demonstrate a fair and non-discriminatory recruitment process, then securely deleted
  • Unsuccessful applicants who consent to being considered for future roles — retained for 12 months from the date of consent, then deleted unless consent is renewed or withdrawn sooner
  • Successful applicants — application data is moved into the employee record and retained under the separate employee privacy notice and HR retention schedule

 

4. Technical and cookie data

Retention periods for cookies and similar technologies are set out in our Cookie Policy. In general, analytics and marketing cookie data is not retained for longer than 36 months.

 

5. Review and deletion process

  • Marketing list hygiene is reviewed on a quarterly basis in HubSpot
  • Candidate data retention is reviewed by the People Team on a rolling basis tied to each recruitment exercise’s close date
  • Deletion is carried out by removing the record from the relevant system (HubSpot, Teamtailor) and confirming it is not retained in backups beyond the standard backup cycle

 

6. Exceptions

We may retain data for longer than the periods above where necessary to comply with a legal obligation, to establish, exercise or defend a legal claim, or where the individual has separately consented to a longer period.

 

7. Review of this policy

This policy will be reviewed at least annually, or sooner if our processing activities change materially.