Data retention policy
Overview
Medicinal Cannabis UK CIC retains personal data only for as long as necessary for the purpose it was collected, or as required by law. This policy sets out the retention periods we apply to different categories of data. For full details of how we collect and use your data, see our privacy policy.
Data protection principles
MCUK follows the UK GDPR principle that personal data must be kept for no longer than is necessary. Information may be retained where necessary to deliver MCUK services and support, maintain appropriate records, meet legal or regulatory obligations, demonstrate compliance, and protect the rights and interests of MCUK and individuals.
Retention periods
Contact form submissions
Data submitted via our contact form is retained for 2 years from the date of submission, after which it is deleted. This allows us to reference previous correspondence if you contact us again.
Newsletter subscriptions
Your name and email address are retained for as long as you remain subscribed to our newsletter. You can unsubscribe at any time using the link in any newsletter email, at which point your data will be removed from our mailing list within 30 days.
Blog post submissions
Submitted articles that are not published are retained for 6 months and then deleted. Published articles and associated author information are retained indefinitely as part of our editorial record. If you wish to request removal of a published article, contact us at hello@mcukcic.co.uk.
Membership and payment records
Membership records including your name, email address, membership tier, and payment history are retained for 6 years from the end of the relevant accounting period, in line with statutory financial record requirements. Payment card details are never stored by MCUK — these are processed and retained by Zeffy in accordance with their data retention policy.
Technical and server logs
Server logs generated by Vercel (our hosting provider) are retained for up to 30 days and then automatically deleted.
Safeguarding records
Records relating to safeguarding concerns are retained for a minimum of 7 years, or longer where required by applicable guidance or legal obligation.
Volunteer and staff records
Records relating to volunteers and staff are retained for the duration of their involvement with MCUK and for 6 years thereafter, in line with employment and contractual record requirements.
Deletion requests
You have the right to request deletion of your personal data in certain circumstances. To make a deletion request, contact us at hello@mcukcic.co.uk. We will respond within 30 days. Please note that we may be unable to delete data where we have a legal obligation to retain it.
Review
This policy will be reviewed annually, or following significant organisational, legal, or operational changes.