Data Retention Policy

4Sight Education Ltd (trading as VESPA Academy)

Last updated: August 2026

Policy owner	Antony Dennis, Director
Version	2.0
Effective date	August 2026
Review cycle	Annually or on material change
Applies to	All personal data processed by 4Sight Education Ltd via the VESPA Academy platform

1. Purpose

This policy sets out how long 4Sight Education Ltd retains personal data and how it is securely deleted or returned. We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. In respect of student and staff data on the platform, 4Sight acts as data processor on the instructions of the customer (the school, college or trust), who is the data controller. The periods below are the default schedule; the Controller may instruct different retention or earlier erasure, and we will follow those instructions unless a legal retention obligation applies.

2. Retention periods

Data	Default retention period (configurable by Controller instruction)
Student / learner data	Retained while the student is enrolled and active on the platform. When a student leaves or graduates (or the Controller instructs erasure), we delete personal data from production systems. Our operational target is completion within 30 days of a confirmed leave/erasure instruction. Erasure is currently executed via a documented runbook (manual checklist) pending full automation; schools may log requests via their account contact / CRM. Core records cascade on student deletion; related stores keyed by email (e.g. UniGuide chat, UCAS drafts, FL4SH lite) are included in the erasure checklist. On completion we provide written confirmation of deletion on request (see also the DPA clause on delete-or-return). Anonymous national aggregates do not contain student identifiers.
Staff platform accounts (as users)	Held as processor under the customer’s contract. Default: account deactivated and deleted within 30 days of the staff member leaving the institution or the account being closed, unless the Controller instructs otherwise.
Primary / business contacts (as controller)	Where a contact is retained for business or marketing purposes, a limited record (name, work email, organisation) is held by 4Sight under legitimate interests for relationship and re-engagement purposes, until the contact objects or unsubscribes.
Customer business & contract records	Retained for the duration of the contract and for 6 years afterwards, to meet legal, accounting and audit obligations.
Support correspondence	Retained for up to 24 months from last contact, then deleted.
Backups	Deleted personal data is also removed from operational backups within the normal backup retention cycle of our infrastructure provider.

3. Deletion on contract termination

On expiry or termination of a customer agreement, unless required to retain data for legal or statutory reasons, we will at the customer’s choice return their personal data and/or securely destroy all copies we hold, and provide written confirmation of deletion on request. Any data retained for legal reasons remains subject to appropriate security and confidentiality measures and is securely deleted when its retention period expires.

4. Method of deletion

Personal data is deleted using secure methods that render it unrecoverable, including removal from production systems and expiry from backups within the backup cycle described above. A deletion confirmation letter template is available in our compliance pack for schools.

5. Responsibilities

The Director is responsible for this policy and for ensuring retention periods are applied. Customers may request information about retention, earlier deletion, or written confirmation of deletion by contacting admin@vespa.academy.

6. Review

Reviewed annually, or sooner on material change.

Signed: Antony Dennis, Director, 4Sight Education Ltd — August 2026 (v2.0)