Data Retention Policy

4Sight Education Ltd (trading as VESPA Academy)

Last updated: June 2026

Policy owner	Antony Dennis, Director
Version	1.1
Effective date	June 2026
Review cycle	Annually or on material change
Applies to	All personal data processed by 4Sight Education Ltd via the VESPA Academy platform

1. Purpose

This policy sets out how long 4Sight Education Ltd retains personal data and how it is securely deleted or returned. We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. In respect of student and staff data on the platform, 4Sight acts as data processor on the instructions of the customer (the school, college or trust), who is the data controller.

2. Retention periods

Data	Retention period
Student / learner data	Retained while the student is enrolled and active on the platform. When a student leaves or graduates (typically end of Year 13, or Year 11 in some settings), their personal data is fully purged from the system within 30 days.
Staff platform accounts (as users)	Held as processor under the customer’s contract. The account is deactivated and deleted within 30 days of the staff member leaving the institution or the account being closed.
Primary / business contacts (as controller)	Where a contact is retained for business or marketing purposes, a limited record (name, work email, organisation) is held by 4Sight under legitimate interests for relationship and re-engagement purposes, until the contact objects or unsubscribes.
Customer business & contract records	Retained for the duration of the contract and for 6 years afterwards, to meet legal, accounting and audit obligations.
Support correspondence	Retained for up to 24 months from last contact, then deleted.
Backups	Deleted personal data is also removed from operational backups within the normal backup retention cycle of our infrastructure provider.

3. Deletion on contract termination

On expiry or termination of a customer agreement, unless required to retain data for legal or statutory reasons, we will at the customer’s choice return their personal data and/or securely destroy all copies we hold. Any data retained for legal reasons remains subject to appropriate security and confidentiality measures and is securely deleted when its retention period expires.

4. Method of deletion

Personal data is deleted using secure methods that render it unrecoverable, including removal from production systems and expiry from backups within the backup cycle described above.

5. Responsibilities

The Director is responsible for this policy and for ensuring retention periods are applied. Customers may request information about retention, or earlier deletion, by contacting admin@vespa.academy.

6. Review

Reviewed annually, or sooner on material change.

Signed: Antony Dennis, Director, 4Sight Education Ltd — June 2026