Onward Shift Limited - Data Deletion Policy

Last updated: 01/November/2025

1. INTRODUCTION

1.1. This Data Deletion Policy explains how Onward Shift Limited (“we”, “our”, “us”) manages the deletion of personal data collected through the Check-In Buddy service and all other Onward Shift offerings.

1.2. This policy supports our obligations under the UK GDPR and the Data Protection Act 2018. It outlines how long data is kept, how it is anonymised, and how you can request deletion.

2. TYPES OF DATA COVERED BY THIS POLICY

This policy applies to all personal data collected through Check-In Buddy or other Onward Shift services, including:

2.1. Personal Identification Data

• Name

• Email

• Phone number

• Contact information

2.2. Check-In Buddy Wellbeing Data (Special Category Health Data)

• Mood ratings

• Stress/pressure levels

• Responses to wellbeing check-ins

• Optional free-text reflections

2.3. Technical and Usage Data

• Message timestamps

• Interaction logs from Make.com

• WhatsApp Cloud API metadata

• System usage patterns

2.4. Account or Registration Data

• Opt-in / opt-out records

• Consent history

3. RETENTION PERIODS

We retain personal data only for as long as necessary for service delivery, research, compliance and safety.

3.1. Check-In Buddy Wellbeing Data (Identifiable)

• Retained only while you are actively enrolled in Check-In Buddy.

• Once you opt out or withdraw consent, identifiable wellbeing data is deleted within 30 days.

3.2. Long-Term Research Data (Anonymised)

• We may convert wellbeing responses into permanently anonymised datasets.

• Anonymised data cannot be linked back to you and is retained indefinitely for research, statistical reporting and service improvement.

3.3. Phone Numbers and User Identifiers

• Retained for the duration of your participation.

• Deleted within 30 days after opting out.

3.4. WhatsApp Cloud API Message Logs

• Meta may retain metadata for 30–90 days for security purposes.

• We do not store WhatsApp message content outside the Check-In Buddy workflow.

3.5. Make.com Automation Logs

• Make.com retains execution logs for up to 30–90 days, depending on system usage.

• Logs are automatically deleted by Make.com.

3.6. Consent Records

• Retained for up to 6 years to meet legal and regulatory requirements.

4. HOW DATA IS DELETED

4.1. Automated Deletion

• Make.com automatically deletes operational logs within its retention window.

• WhatsApp Cloud API deletes delivery logs automatically.

4.2. Manual Deletion

We manually delete:

• Your identifiable wellbeing history in Google Sheets

• Your phone number and identifiers

• Any exported versions of your data

• Any backups containing your identifiable wellbeing data

4.3. Irreversible Anonymisation

After deletion or withdrawal:

• We may convert wellbeing data into anonymised form

• This process is permanent and cannot be reversed

• Anonymised data may be retained indefinitely for research purposes

4.4. Third-Party Deletion

Third-party processors delete data according to:

• Their own internal retention schedules

• Their GDPR-compliant deletion processes

5. YOUR RIGHT TO REQUEST DATA DELETION

Under UK GDPR, you may request deletion of your personal data at any time.

5.1. How to Request Deletion

Email: jo*****@*********ft.com
Subject line: “Data Deletion Request – Check-In Buddy”

Include:

• Your full name

• Phone number used for Check-In Buddy

• A clear confirmation that you want your data deleted

5.2. Timescales

We will:

• Acknowledge your request within 72 hours

• Delete identifiable data within 30 days

• Confirm deletion once completed

5.3. Exceptions

We may delay deletion if:

• Required to comply with legal obligations

• Necessary for safeguarding or risk-of-harm concerns

• Data is needed to resolve an active dispute

6. SAFEGUARDING EXCEPTION

If your responses indicate:

• Imminent risk of self-harm

• Risk of harm to others

• A safeguarding concern

We may temporarily retain relevant data beyond normal retention periods to protect your safety or comply with legal duties.

This is standard safeguarding practice.

7. CONTACT US

For questions or deletion requests:

Onward Shift Limited
Email: jo*****@*********ft.com
Website: onwardshift.com