Our mission is to inspire long lives of adventure, and promote discovery and care for nature.
We create life changing adventures with a light touch on nature, focus young people’s sight & skills for the future and help organisations with innovation & sustainability. We play for the planet.
P R I V A C Y P O L I C Y
How we will keep your personal information safe
The TYF Group Ltd (“We”) is committed to protecting and respecting your privacy.
This document along with our Data Protection Policy, Data Retention Policy and our Cookie Policy explains how we collect personal information from you, what personal information we will collect, how we will use this personal information and why we need to collect it.
Please read this document carefully so you can understand exactly how we use and protect your personal information.
Data Controller
The TYF Group Ltd is Registered in Wales whose registration number is 3665408 and our address is 1 High Street, St Davids, Pembrokeshire, Wales. SA62 6SA.
Our company is known by the associated names of ‘The TYF Group Ltd’, ‘The TYF Group, ‘TYF’, ‘TYF Group’, ‘TYF Adventure’ and ‘the TYF Shop’. As recorded at companieshouse.gov.uk the nature of the business is
- 47710 – Retail sale of clothing in specialised stores
- 70229 – Management consultancy activities other than financial management
- 85510 – Sports and recreation education
- 93199 – Other sports activities
The TYF Group Ltd will be what’s known as the ‘Controller’ of the personal data you provide to us. We only collect basic personal data about you via contact forms which do not include any special types of information or location based information. This does however include name, address, email, phone number. Detailed enquiry forms for large adventure-based activity enquiries collect a more detailed set of information, which you submit to us in the knowledge that we will handle such data in line with this privacy policy and our data protection policy.
Why we need your data
We need to know your basic personal data in order to provide you with on-going adventure activity and retail services in line with this overall contract. We will not collect any personal data from you we do not need in order to provide and oversee this service to you.
What we do with your data
All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance, some of this information is processed through approved cloud computing services and servers located in the United Kingdom, Europe and the United States. No 3rd parties have access to your personal data unless the law allows them to do so.
We have a Data Protection policy in place to oversee the effective and secure processing of your personal data. More information on this framework can be found at: tyf.com/dataprotectionpolicy
How long we keep your data
We are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed. Your information we use for marketing purposes will be kept with us until you notify us that you no longer wish to receive this information. More information on our retention policy can be found at: tyf.com/dataretentionpolicy
What we would also like to do with your data
If you have subscribed to one of our marketing subscriptions, we would like to use your email address to inform you of our future offers and similar products. All marketing subscription lists that we generate are joined freely and are ‘double opt-in’. This information is not shared with third purposes and you can unsubscribe at any time via phone, email or our website.
What are your rights
The GDPR provides the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
More information on your rights as an individual can be found at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If at any point you believe the information we process on you is incorrect you can request to see this information and have it corrected or deleted. If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated. complaints@tyf.com
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office https://ico.org.uk/
The Data Protection Act
Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We do not pass on your details to any third party or Government Department unless you give us permission to do so.
What information do we collect?
We collect two kinds of information from visitors to TYF Web site: service enquiries and feedback (through emails), and site usage information, from analytics.
Feedback
We welcome your feedback. You can contact us by emailing play@tyf.com
Comments and Questions
We may need to contact other departments in order to answer questions sent to us. If your question is technical, we may need to pass it to our suppliers. We do not pass on any of your personal information when dealing with your enquiry, unless you have given us permission to do so.
Site usage information
Cookies – This site uses cookies to store information on your computer. Some of these cookies are essential to make our site work and others help us to improve by giving us some insight into how the site is being used. These cookies are set when you submit a form, login or interact with the site by doing something that goes beyond clicking some simple links. We also use some non-essential cookies to anonymously track visitors or enhance your experience of this site. If you’re not happy with this, we won’t set these cookies but some nice features on the site may be unavailable.
To control third party cookies, you can also adjust your browser settings. By using our site you accept the terms of our privacy policy.
What happens when I link to another site?
The TYF Web site contains links to other web sites. This privacy policy applies only to our site, so you should always be aware when you are moving to another site and read the privacy statement of any site which collects personal information. We do not pass on any personal information you have given us to any other site.
If you wish to see our records of any correspondence you have sent to us, or if you have a query or complaint about this privacy policy or about the site, you can contact us by email:
or by post at:
The TYF Group Ltd, 1 High Street, St David’s, Pembrokeshire, Wales SA62 6SA
Changes to this privacy policy
If this privacy policy changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties. This version: 1st January 2018.
This privacy policy explains how we protect and respect the data we collect from you. We may at any time revise these terms and conditions without notice. Please check regularly. Continued use of this after a change has been made is deemed to be your acceptance of the change.
D A T A P R O T E C T I O N P O L I C Y
Context and overview
Key details
- Policy prepared by: Nayfe Slusjan, Head of Technology & Design, The TYF Group Ltd
- Approved by board / management on: 14/05/18.
- Policy became operational on: 14/05/18.
- Next review date: 10/01/19.
Introduction
The TYF Group Ltd needs to gather and use certain information about individuals.
These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.
This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards — and to comply with the law.
Why this policy exists
This data protection policy ensures The TYF Group Ltd:
- Complies with data protection law and follow good practice
- Protects the rights of staff, customers and partners
- Is open about how it stores and processes individuals’ data
- Protects itself from the risks of a data breach
Data protection law
The Data Protection Act 1998 describes how organisations — including The TYF Group Ltd— must collect, handle and store personal information.
These rules apply regardless of whether data is stored electronically, on paper or on other materials.
To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.
The Data Protection Act is underpinned by eight important principles. These say that personal data must:
- Be processed fairly and lawfully
- Be obtained only for specific, lawful purposes
- Be adequate, relevant and not excessive
- Be accurate and kept up to date
- Not be held for any longer than necessary
- Processed in accordance with the rights of data subjects
- Be protected in appropriate ways
- Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection
People, risks and responsibilities
Policy scope
This policy applies to:
- The head office of The TYF Group Ltd
- All branches of The TYF Group Ltd
- All staff and volunteers of The TYF Group Ltd
- All contractors, suppliers and other people working on behalf of The TYF Group Ltd
It applies to all data that the company holds relating to identifiable individuals, even if that information technically falls outside of the Data Protection Act 1998. This can include:
- Names of individuals
- Postal addresses
- Email addresses
- Telephone numbers
- …plus any other information relating to individuals
Data protection risks
This policy helps to protect The TYF Group Ltd from some very real data security risks, including:
- Breaches of confidentiality. For instance, information being given out inappropriately.
- Failing to offer choice. For instance, all individuals should be free to choose how the company uses data relating to them.
- Reputational damage. For instance, the company could suffer if hackers successfully gained access to sensitive data.
Responsibilities
Everyone who works for or with The TYF Group Ltd has some responsibility for ensuring data is collected, stored and handled appropriately.
Each team that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles.
However, these people have key areas of responsibility:
The board of directors is ultimately responsible for ensuring that The TYF Group Ltd meets its legal obligations.
The data protection officer, Nayfe Slusjan, is responsible for:
- Keeping the board updated about data protection responsibilities, risks and issues.
- Reviewing all data protection procedures and related policies, in line with an agreed schedule.
- Arranging data protection training and advice for the people covered by this policy.
- Handling data protection questions from staff and anyone else covered by this policy.
- Dealing with requests from individuals to see the data The TYF Group Ltd holds about them (also called ‘subject access requests’).
- Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data.
The IT manager, Nayfe Slusjan, is responsible for:
- Ensuring all systems, services and equipment used for storing data meet acceptable security standards.
- Performing regular checks and scans to ensure security hardware and software is functioning properly.
- Evaluating any third-party services the company is considering using to store or process data. For instance, cloud computing services.
The marketing manager, Samantha Minas, is responsible for:
- Approving any data protection statements attached to communications such as emails and letters.
- Addressing any data protection queries from journalists or media outlets like newspapers.
- Where necessary, working with other staff to ensure marketing initiatives abide by data protection principles.
General staff guidelines
- The only people able to access data covered by this policy should be those who need it for their work.
- Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
- The TYF Group Ltd will provide training to all employees to help them understand their responsibilities when handling data.
- Employees should keep all data secure, by taking sensible precautions and following the guidelines below.
- In particular, strong passwords must be used and they should never be shared.
- Personal data should not be disclosed to unauthorised people, either within the company or externally.
- Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
- Employees should request help from their line manager or the data protection officer if they are unsure about any aspect of data protection.
Data storage
These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT manager or data controller.
When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it.
These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:
- When not required, the paper or files should be kept in a locked drawer or filing cabinet.
- Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
- Data printouts should be shredded and disposed of securely when no longer required.
When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:
- Data should be protected by strong passwords that are changed regularly and never shared between employees.
- If data is stored on removable media (like a CD or DVD), these should be kept locked away securely when not being used.
- Data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing services.
- Servers containing personal data should be sited in a secure location, away from general office space.
- Data should be backed up frequently. Those backups should be tested regularly, in line with the company’s standard backup procedures.
- Data should never be saved directly to laptops or other mobile devices like tablets or smartphones.
- All servers and computers containing data should be protected by approved security software and a firewall.
Data use
Personal data is of no value to The TYF Group Ltd unless the business can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft:
- When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.
- Personal data should not be shared informally. In particular, it should never be sent by email, as this form of communication is not secure.
- Data must be encrypted before being transferred electronically. The IT manager can explain how to send data to authorised external contacts.
- Personal data should never be transferred outside of the European Economic Area.
- Employees should not save copies of personal data to their own computers. Always access and update the central copy of any data.
Data accuracy
The law requires The TYF Group Ltd to take reasonable steps to ensure data is kept accurate and up to date.
The more important it is that the personal data is accurate, the greater the effort The TYF Group Ltd should put into ensuring its accuracy.
It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.
- Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.
- Staff should take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.
- The TYF Group Ltd will make it easy for data subjects to update the information The TYF Group Ltd holds about them. For instance, via the company website.
- Data should be updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed from the database.
- It is the marketing manager’s responsibility to ensure marketing databases are checked against industry suppression files every six months.
Subject access requests
All individuals who are the subject of personal data held by The TYF Group Ltd are entitled to:
- Ask what information the company holds about them and why.
- Ask how to gain access to it.
- Be informed how to keep it up to date.
- Be informed how the company is meeting its data protection obligations.
If an individual contacts the company requesting this information, this is called a subject access request.
Subject access requests from individuals should be made by email, addressed to the data controller at datacontroller@tyf.com. The data controller can supply a standard request form, although individuals do not have to use this.
The data controller will aim to provide the relevant data within 30 days.
The data controller will always verify the identity of anyone making a subject access request before handing over any information.
Data Portability
All individuals who are the subject of personal data held by The TYF Group Ltd are entitled to:
- receive a copy of their personal data; and/or
- have their personal data transmitted from one controller to another controller.
The TYF Group Ltd can transmit personal data in structured, commonly used and machine readable formats. We use secure methods to transmit personal data. We have processes in place to ensure that we respond to a request for data portability without undue delay and within one month of receipt.
We are aware of the circumstances when we can extend the time limit to respond to a request.
Data portability requests from individuals should be made by email, addressed to the data controller at datacontroller@tyf.com. The data controller can supply a standard request form, although individuals do not have to use this.
The data controller will aim to provide the relevant data within 30 days.
The data controller will always verify the identity of anyone making a data portability request before handing over any information.
Disclosing data for other reasons
In certain circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.
Under these circumstances, The TYF Group Ltd will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.
Providing information
The TYF Group Ltd aims to ensure that individuals are aware that their data is being processed, and that they understand:
- How the data is being used
- How to exercise their rights
To these ends, the company has a privacy statement, setting out how data relating to individuals is used by the company.
[This is available on request. A version of this statement is also available at https://www.tyf.com/privacy/]
Data Flow
The TYF Group Ltd is open and transparent about the way it processes data and uses systems and software to provide services.
3rd Party Data Processor Security
The following data processors who process data on behalf of The TYF Group Ltd have provided information on their own security measures.
MediaTemple
Security Statement: https://mediatemple.net/webhosting/shared/faq-2/
Privacy Policy: https://mediatemple.net/legal/privacy-policy/
Hubspot
Security Statement: https://www.hubspot.com/data-privacy/gdpr/
Privacy Policy: https://legal.hubspot.com/privacy-policy/
Cinolla
Security Statement: https://www.nccgroup.trust/uk/our-services/cyber-security/
Privacy Policy: https://www.nccgroup.trust/us/about-us/privacy-policy/
Flow
Security Statement: https://www.getflow.com/security/
Privacy Policy: https://www.getflow.com/privacy/
Google Drive
Security Statement: https://cloud.google.com/security/
Privacy Policy: https://policies.google.com/privacy/
JotForm
Security Statement: https://www.jotform.com/gdpr-compliance/
Privacy Policy: https://www.jotform.com/privacy/
Ninja Forms
Security Statement: https://ninjaforms.com/gdpr-compliance-wordpress-forms/
Privacy Policy: https://ninjaforms.com/privacy-policy/
Xero
Security Statement: https://www.xero.com/uk/campaigns/xero-and-gdpr/
Privacy Policy: https://www.xero.com/uk/about/terms/privacy/
Vend
Security Statement: https://support.vendhq.com/hc/en-us/articles/115015525327-Vend-and-the-General-Data-Protection-Regulation-GDPR-/
Privacy Policy: https://www.vendhq.com/privacy-policy/
Shopify
Security Statement: https://help.shopify.com/manual/your-account/GDPR/GDPR-Shopify/
Privacy Policy: https://www.shopify.com/legal/privacy/
Mailchimp
Security Statement: https://blog.mailchimp.com/getting-ready-for-the-gdpr/
Privacy Policy: https://mailchimp.com/legal/privacy/
D A T A R E T E N T I O N P O L I C Y
Context and overview
Key details
- Policy prepared by: Nayfe Slusjan, Head of Technology & Design, The TYF Group Ltd
- Approved by board / management on: 14/05/18.
- Policy became operational on: 14/05/18.
- Next review date: 10/01/19.
Purpose
The purpose of this Policy is to ensure that necessary records and documents are adequately protected and maintained and to ensure that records that are no longer needed by The TYF Group Ltd or are of no value are discarded at the proper time. This Policy is also for the purpose of aiding employees of The TYF Group Ltd in understanding their obligations in retaining electronic documents – including email, Web files, text files, sound and movie files, PDF documents, and all Microsoft Office or other formatted files.
Policy
This Policy represents the The TYF Group Ltd’s policy regarding the retention and disposal of records and the retention and disposal of electronic documents.
Administration
Attached as Appendix A is a Data Retention Schedule that is approved as the initial maintenance, retention and disposal schedule for physical records of The TYF Group Ltd and the retention and disposal of electronic documents. The Data Retention Policy Administrator (the “Administrator”) is the officer in charge of the administration of this Policy and the implementation of processes and procedures to ensure that the Data Retention Schedule is followed. The Administrator is also authorized to: make modifications to the Data Retention Schedule from time to time to ensure that it is in compliance with U.K laws and includes the appropriate document and data categories for The TYF Group Ltd; monitor U.K laws affecting data retention; annually review the data retention and disposal program; and monitor compliance with this Policy.
Suspension of Record Disposal In Event of Litigation or Claims
In the event The TYF Group Ltd is served with any summons or request for documents or any employee becomes aware of a governmental investigation or audit concerning The TYF Group Ltd or the commencement of any litigation against or concerning The TYF Group Ltd, such employee shall inform the Administrator and any further disposal of documents shall be suspended until shall time as the Administrator, with the advice of counsel, determines otherwise. The Administrator shall take such steps as is necessary to promptly inform all staff of any suspension in the further disposal of documents.
Applicability
This Policy applies to all physical records generated in the course of The TYF Group Ltd’s operation, including both original documents and reproductions. It also applies to the electronic documents described above.
This Policy was approved by the Board of Directors of The TYF Group Ltd on 14/05/18.
APPENDIX A – DATA RETENTION SCHEDULE
The Data Retention Schedule is organized as follows:
SECTION TOPIC
- A. Accounting and Finance
- B. Contracts
- C. Corporate Records
- D. Customer Records
- E. Correspondence and Internal Memoranda
- F. Electronic Documents
- G. Grant Records
- H. Insurance Records
- I. Legal Files and Papers
- J. Miscellaneous
- K. Payroll Documents
- L. Pension Documents
- M. Personnel Records
- N. Property Records
- O. Tax Records
- P. Contribution Records
- Q. Programs & Services Records
- R. Fiscal Sponsor Project Records
A. ACCOUNTING AND FINANCE
| Record Type |
Retention Period |
| Accounts Payable ledgers and schedules |
6 years plus current year |
| Accounts Receivable ledgers and schedules |
6 years plus current year |
| Annual Audit Reports and Financial Statements |
6 years plus current year |
| Annual Audit Records, including work papers and other documents that relate to the audit |
6 years plus current year |
| Annual Plans and Budgets |
6 years plus current year |
| Bank Statements and Canceled Checks |
6 years plus current year |
| Employee Expense Reports |
6 years plus current year |
| General Ledgers |
6 years plus current year |
| Interim Financial Statements |
6 years plus current year |
| Notes Receivable ledgers and schedules |
6 years plus current year |
| Investment Records |
6 years plus current year |
| Credit card records (documents showing customer credit card number) |
N/A |
B. CONTRACTS
| Record Type |
Retention Period |
| Contracts and Related Correspondence (including any proposal that resulted in the contract and all other supportive documentation) |
7 years after expiration or termination |
C. CORPORATE RECORDS
| Record Type |
Retention Period |
| Corporate Records (minute books, signed minutes of the Board and all committees, corporate seals, articles of incorporation, bylaws, annual corporate reports) |
Permanent |
| Licenses and Permits |
Permanent |
D. CUSTOMER RECORDS
| Record Type |
Retention Period |
| Enquiry Forms |
7 years |
| Activity Registration Forms |
7 years |
| Medical Declaration Forms |
7 years |
| Session Record Forms |
7 years |
| Feedback Forms |
7 years |
| Incident Report Forms |
7 years |
| Accident Report Forms |
7 years |
| Equipment Hire Agreements |
7 years |
| Retail History Records |
7 years |
| Retail Shipping Records |
7 years |
| Retail Billing Records |
7 years |
| Marketing Opt-in Email address |
Until Opt-out |
| Child welfare concerns that The TYF Group Ltd refers onto children’s social care or the police. For example this would include concerns about physical, sexual, emotional or neglect of a child, disclosures from a child about being abused or information from a third party which might suggest a child is being abused; concerns about a parent or another adult that uses The TYF Group Ltd, or a young person who has been abused by another young person. | The referral should be acknowledged in writing by children’s social care and The TYF Group Ltd keeps this on file.
Records should be kept for 6 years after the last contact with the service user unless any of the exemptions apply or if your organisation is required to comply with any other statutory requirements. |
| Child welfare concerns that The TYF Group Ltd decide, after consultation, do not necessitate a referral to children’s social care or the police. In such circumstances The TYF Group Ltd should make a record of the concern and the outcome. For example where a child has been bullied, overly pushy parents or a very distressed child where the distress is unrelated to child abuse. | 1 year after the child/adult concerned ceases to use the service unless the child or adult are continuing to use The TYF Group Ltd. |
| Concerns about people (paid and unpaid) who work with children and young people, for example, allegations, convictions, disciplinary action, inappropriate behaviour towards children and young people. For example where an employee has breached the code of conduct, a record of the behaviour, the action taken and outcome should be recorded. | Personnel files and training records (including disciplinary records and working time records) are retained for 6 years after employment ceases. However the records should be retained for a longer period if any of the following apply:
|
E. CORRESPONDENCE AND INTERNAL MEMORANDA
General Principle: Most correspondence and internal memoranda should be retained for the same period as the document they pertain to or support. For instance, a letter pertaining to a particular contract would be retained as long as the contract (7 years after expiration). It is recommended that records that support a particular project be kept with the project and take on the retention time of that particular project file.
Correspondence or memoranda that do not pertain to documents having a prescribed retention period should generally be discarded sooner. These may be divided into two general categories:
- Those pertaining to routine matters and having no significant, lasting consequences should be discarded within two years. Some examples include:
- Routine letters and notes that require no acknowledgment or followup, such as notes of appreciation, congratulations, letters of transmittal, and plans for meetings.
- Form letters that require no follow-up.
- Letters of general inquiry and replies that complete a cycle of correspondence.
- Letters or complaints requesting specific action that have no further value after changes are made or action taken (such as name or address change).
- Other letters of inconsequential subject matter or that definitely close correspondence to which no further reference will be necessary.
- Chronological correspondence files.
Please note that copies of interoffice correspondence and documents where a copy will be in the originating department file should be read and destroyed, unless that information provides reference to or direction to other documents and must be kept for project traceability.
- Those pertaining to non-routine matters or having significant lasting consequences should generally be retained permanently.
F. ELECTRONIC DOCUMENTS
- Electronic Mail: Not all email needs to be retained, depending on the subject matter.
- All email—from internal or external sources—is to be deleted after 6 years.
- Staff will strive to keep all but an insignificant minority of their email related to business issues.
- The TYF Group Ltd will archive email for 3 years after the staff has deleted it, after which time the email will be permanently deleted.
- All The TYF Group Ltd business-related email should be downloaded to a service center or user directory on the server.
- Staff will not store or transfer The TYF Group Ltd-related email on non-work-related computers except as necessary or appropriate for The TYF Group Ltd purposes.
- Staff will take care not to send confidential/proprietary The TYF Group Ltd information to outside sources.
- Staff with more than 2GB in their email account will be unable to send or receive messages until the size of their account is reduced. Staff will be notified by the IT Department as their account size approaches 2 GB.
- Electronic Documents: including Microsoft Office Suite and PDF files. Retention also depends on the subject matter.
- PDF documents – The length of time that a PDF file should be retained should be based upon the content of the file and the category under the various sections of this policy. The maximum period that a PDF file should be retained is 6 years. PDF files the employee deems vital to the performance of his or her job should be printed and stored in the employee’s workspace.
- Text/formatted files – Staff will conduct annual reviews of all text/formatted files (e.g., Microsoft Word documents) and will delete all those they consider unnecessary or outdated. After five years, all text files will be deleted from the network and the staff’s desktop/laptop. Text/formatted files the staff deems vital to the performance of their job should be printed and stored in the staff’s workspace.
- Web Page Files: Internet Cookies
- All workstations: Browsers should be scheduled to delete Internet cookies once per month.
The TYF Group Ltd does not automatically delete electronic files beyond the dates specified in this Policy. It is the responsibility of all staff to adhere to the guidelines specified in this policy.
Each day The TYF Group Ltd will run a digital backup copy of all electronic files (including email) on The TYF Group Ltd’s servers, as specified in the The TYF Group Ltd Disaster Recovery Plan. This backup is a safeguard to retrieve lost information within a one-year retrieval period should documents on the network experience problems. The digital backup copy is considered a safeguard for the data retention system of The TYF Group Ltd, but is not considered an official repository of The TYF Group Ltd records. All monthly and yearly backups are stored off-site according to The TYF Group Ltd’s Disaster Recovery Policy.
In certain cases a document will be maintained in both paper and electronic form. In such cases the official document will be the electronic document.
G. GRANT RECORDS
| Record Type |
Retention Period |
| Original grant proposal |
7 years after completion of grant period |
| Grant agreement and subsequent modifications, if applicable |
7 years after completion of grant period |
| All requested HMRC/grantee correspondence including determination letters and “no change” in exempt status letters |
7 years after completion of grant period |
| Final grantee reports, both financial and narrative |
7 years after completion of grant period |
| All evidence of returned grant funds |
7 years after completion of grant period |
| All pertinent formal correspondence including opinion letters of counsel |
7 years after completion of grant period |
| Report assessment forms |
7 years after completion of grant period |
| Documentation relating to grantee evidence of invoices and matching or challenge grants that would support grantee compliance with the grant agreement |
7 years after completion of grant period |
| Pre-grant inquiry forms and other documentation for expenditure responsibility grants |
7 years after completion of grant period |
| Grantee work product produced with the grant funds |
7 years after completion of grant period |
H. INSURANCE RECORDS
| Record Type |
Retention Period |
| Annual Loss Summaries |
10 years |
| Audits and Adjustments |
3 years after final adjustment |
| Certificates Issued to The TYF Group Ltd |
Permanent |
| Claims Files (including correspondence, medical records, injury documentation, etc.) |
Permanent |
| Group Insurance Plans – Active Employees |
Until Plan is amended or terminated |
| Group Insurance Plans – Retirees |
Permanent or until 6 years after death of last eligible participant |
| Inspections |
3 years |
| Insurance Policies (including expired policies) |
Permanent |
| Journal Entry Support Data |
7 years |
| Loss Runs |
10 years |
| Releases and Settlements |
25 years |
I. LEGAL FILES AND PAPERS
| Record Type |
Retention Period |
| Legal Memoranda and Opinions (including all subject matter files) |
7 years after close of matter |
| Litigation Files |
1 year after expiration of appeals or time for filing appeals |
| Court Orders |
Permanent |
| Requests for Departure from Data Retention Plan |
10 years |
J. MISCELLANEOUS
| Record Type |
Retention Period |
| Consultant’s Reports |
2 years |
| Material of Historical Value (including pictures, publications) |
Permanent |
| Policy and Procedures Manuals – Original |
Current version with revision history |
| Policy and Procedures Manuals – Copies |
Retain current version only |
| Annual Reports |
Permanent |
K. PAYROLL DOCUMENTS
| Record Type |
Retention Period |
| Employee Deduction Authorizations |
4 years after termination |
| Payroll Deductions |
Termination + 7 years |
| P45 and P60 Forms |
Termination + 7 years |
| Garnishments, Assignments, Attachments |
Termination + 7 years |
| Labor Distribution Cost Records |
7 years |
| Payroll Registers (gross and net) |
7 years |
| Time Cards/Sheets |
2 years |
| Unclaimed Wage Records |
6 years |
L. PENSION DOCUMENTS AND SUPPORTING EMPLOYEE DATA
General Principle: Pension documents and supporting employee data shall be kept in such a manner that The TYF Group Ltd can establish at all times whether or not any pension is payable to any person and if so the amount of such pension.
| Record Type |
Retention Period |
| Retirement and Pension Records |
Permanent |
M. PERSONNEL RECORDS
| Record Type |
Retention Period |
| Commissions/Bonuses/Incentives/Awards |
7 years |
| Employee Earnings Records |
Separation + 7 years |
| Employee Handbooks |
1 copy kept permanently |
| Employee Medical Records |
Separation + 6 years |
| Employee Personnel Records (including individual attendance records, application forms, job or status change records, performance evaluations, termination papers, withholding information, garnishments, test results, training and qualification records) |
6 years after separation |
| Employment Contracts – Individual |
7 years after separation |
| Employment Records – Correspondence with Employment Agencies and Advertisements for Job Openings |
3 years from date of hiring decision |
| Employment Records – All Non-Hired Applicants (including all applications and resumes whether solicited or unsolicited, results of post-offer, pre-employment physicals, results of background investigations, if any, related correspondence) |
2-4 years (4 years if file contains any correspondence which might be construed as an offer) |
| Job Descriptions |
3 years after superseded |
| Personnel Count Records |
3 years |
| Disclosure and Barring Service (DBS) Certificate |
Duration of employment |
N. PROPERTY RECORDS
| Record Type |
Retention Period |
| Correspondence, Property Deeds, Assessments, Licenses, Rights of Way |
Permanent |
| Original Purchase/Sale/Lease Agreement |
Permanent |
| Property Insurance Policies |
Permanent |
O. TAX RECORDS
General Principle: The TYF Group Ltd must keep books of account or records as are sufficient to establish amount of gross income, deductions, credits, or other matters required to be shown in any such return.
These documents and records shall be kept for as long as the contents thereof may become material in the administration of state and local income, franchise, and property tax laws.
| Record Type |
Retention Period |
| Tax-Exemption Documents and Related Correspondence |
Permanent |
| HMRC Rulings |
Permanent |
| Excise Tax Records |
7 years |
| Payroll Tax Records |
7 years |
| Tax Bills, Receipts, Statements |
7 years |
| Tax Returns – Income, Franchise, Property |
Permanent |
| Tax Workpaper Packages – Originals |
7 years |
| Sales/Use Tax Records |
7 years |
| Annual Information Returns |
Permanent |
| HMRC or other Government Audit Records |
Permanent |
P. CONTRIBUTION RECORDS
| Record Type |
Retention Period |
| Records of Contributions |
Permanent |
| The TYF Group Ltd’s or other documents evidencing terms of gifts |
Permanent |
Q. PROGRAM AND SERVICE RECORDS
| Record Type |
Retention Period |
| The TYF Group Ltd convenings |
Permanent (1 copy only) |
| Research & Publications |
Permanent (1 copy only) |
R. FISCAL SPONSOR PROJECT RECORDS
| Record Type |
Retention Period |
| Sponsorship agreements |
Permanent |
