How Long We
Keep Your Data

Workforce data is sensitive, and biometric data is the most sensitive of all. This page explains, in plain terms, how long HFX keeps the data we process for you, what happens to it when it is no longer needed, and what you can expect from us when your contract ends. It summarises our internal Data Retention Policy, which is available on request.

The principle behind everything here is simple: we keep personal data only for as long as there is a genuine reason to hold it, and when that reason ends, we delete it properly. Every retention period we apply runs from a defined event, such as an employee being unenrolled or a contract ending, so there is never data sitting in our systems with no deletion date. This gives effect to the storage limitation principle of the UK GDPR and the Data Protection Act 2018.

For the employee data held in the Imperago platform, including biometric templates, clocking records, rosters and absence data, you are the data controller and HFX is your data processor. You decide what data is collected and how long it is needed, and we process and protect it on your instructions and under the terms of our data processing agreement. The periods on this page are the defaults we apply; your contract and your instructions can shorten them.

For the information we hold about you as a customer, such as contact details, contracts and support tickets, HFX is the controller, and the periods on this page apply directly.

The table below sets out our standard retention periods for the data most relevant to you as a customer.

Data category	How long we keep it	Why
Biometric templates (hosted platform)	While the employee is enrolled, then deleted within 30 days	A template is needed only for active verification. Deletion is triggered when you mark an employee as a leaver or unenrol them.
Biometric templates (terminals)	While enrolled, then removed at the next synchronisation	Terminals hold a synchronised copy of the hosted record; deletion in the platform flows to every terminal.
Employee records, clocking and roster data	Duration of your contract, then deleted within 90 days	You can request a full export before deletion. Statutory working time record-keeping remains your obligation as employer.
Your account and contract records	Duration of contract plus 6 years	Legal limitation periods for contractual claims.
Support tickets	3 years from closure	Service history and SLA evidence, and to spot recurring issues.

Statutory periods follow the legislation in force at the date of this statement and are reviewed at least annually.

What we actually hold

Our systems and terminals store biometric templates only, never images. A template is a small set of derived, non‑interpretable measurements created at enrolment; the original fingerprint, palm, facial or finger vein image is discarded during enrolment and is never stored. Templates are irreversible, meaning no one, including HFX, can reconstruct an image from them, and they are encrypted with AES‑256 at rest and in transit. Because no image is ever stored, there is no image to retain or delete.

When templates are deleted

A template exists only while an employee is enrolled for biometric verification. When you unenrol an employee, whether because they leave, change role, or switch to an alternative clocking method, the template is deleted from the hosted platform within 30 days and removed from all associated terminals at their next synchronisation. We recommend building biometric unenrolment into your leaver process, and our implementation team will help you set this up.

Terminal hardware

Any terminal returned to HFX, whether for repair, replacement or at the end of your contract, is factory reset and has all stored templates and user records securely erased before it is repaired, reissued or disposed of. We keep an erasure record for every returned device and will confirm erasure in writing on request. For terminals you own and retain, we provide a documented reset procedure so your own team can wipe them with confidence.

At the end of your contract we will, on request, provide a full export of your employee and clocking data in a usable format before deletion. All hosted data, including every biometric template, is then deleted within 90 days of termination, or earlier if you ask us in writing. Once deletion is complete, the data also ages out of our backup cycle automatically, as described below. Records we are legally required to keep, such as the contract itself and financial records, are retained for the statutory periods in the table above and no longer.

When a retention period ends, data is deleted from our live systems within 30 days. Database records are hard deleted or irreversibly anonymised; anonymised data can no longer identify anyone and may be used for statistical purposes only. Physical storage in servers, laptops and terminals is cryptographically erased or securely overwritten before reuse, and physically destroyed by a certificated disposal partner where erasure is not possible, with certificates of destruction retained.

Backups

Our backups exist for disaster recovery, not as an archive. Data deleted from live systems ages out of the backup cycle automatically as backups expire, and our maximum backup retention is 90 days, so deleted data is fully absent from all backup media at most 90 days after live deletion. If we ever restore from a backup taken before a deletion, the deletion is re‑applied as part of the restore, so expired data never re‑enters live systems.

Our suppliers

Where sub‑processors handle personal data on our behalf, our agreements with them require the same deletion standards and timescales described here, and deletion or return of all personal data at the end of the engagement.

Individuals whose data we process for you can exercise their UK GDPR rights, including access, rectification and erasure, through you as the data controller, and we will support you in responding within the statutory timescales. If we receive a request directly from one of your employees, we will refer it to you promptly.

You can raise deletion requests, ask for written confirmation of erasure, or request a copy of our full Data Retention Policy at any time. Download the full statement (PDF), or contact your HFX account manager or the support team at support@hfx.co.uk.