Retention Schedule
Last reviewed 19 June 2026 · Next review 19 June 2027
This page sets out every data-retention period LESSO applies to the personal data it processes as a data processor on behalf of schools. It is published to help school DPOs complete their own Record of Processing Activities (ROPA) and to provide a single authoritative source for any retention query.
Where figures appear in other Trust Hub documents (the DPA and the Security Overview), this page is the definitive source. If any discrepancy arises, please contact support@lesso.co.uk.
| Data category | Description | Retention period | Deletion trigger | Legal basis |
|---|---|---|---|---|
| Operational database backups (active service) | Daily encrypted database backups taken during the active term of the school agreement, retained within UK infrastructure (Civo LON1). | 30 rolling days | Backup rotation — oldest copy deleted on day 31. | Business continuity / UK GDPR Article 32 security obligations. |
| Backup copies — post-termination purge | Backup copies created during the active service that survive to the end of the school agreement. | Up to 90 days after agreement end | End of the School Agreement (termination or expiry). | DPA §10; UK GDPR Article 28(3)(g). |
| Teacher accounts and profile data | Active teacher account records: name, work email, role, school affiliation, account credentials (hashed), billing identifiers. | Duration of the school agreement, plus 30-day export window on termination | Termination / expiry of School Agreement. Deleted within 30 days of the end of the export window unless otherwise instructed. | DPA §10; UK GDPR Article 28(3)(g). |
| Chat / conversation history with Mrs J | Prompt and conversation history for each teacher session, used to deliver continuity and context-aware responses. | Minimum 12 months (active service); subject to termination deletion above | Retained for a minimum of 12 months from the date of the conversation to support service continuity. On termination of the School Agreement, subject to the 30-day production deletion window. | Contract performance / legitimate interests (UK GDPR Article 6(1)(b) and (f)). |
| Teaching materials, lesson plans, and generated artefacts | Lesson plans, worksheets, slide decks, and other curriculum artefacts created by or for the teacher in the LESSO platform. | Minimum 12 months (active service); subject to termination deletion above | Retained for a minimum of 12 months to support service quality and continuity. On termination of the School Agreement, subject to the 30-day production deletion window. | Contract performance (UK GDPR Article 6(1)(b)). |
| Audit and security logs | Authentication events, administrative actions, security-relevant events (failed logins, lockouts, MFA state changes). | Minimum 12 months | Rolling — oldest entries purged after 12 months; longer retention where a security investigation is ongoing. | UK GDPR Article 32 security obligations; legitimate interests (security monitoring). |
| Billing and legal records | Invoices, payment records, correspondence with legal significance. | 7 years | End of the calendar year in which the record was created, plus 7 years (HMRC statutory requirement). | Legal obligation (HMRC / Companies Act); UK GDPR Article 6(1)(c). |
| Sub-processor change notification subscriptions | Email addresses of DPOs and school staff who have subscribed to be notified of sub-processor changes. | Until unsubscribed | User unsubscribes via the link in any notification email. | Consent (UK GDPR Article 6(1)(a)). |
What is always excluded
- Pupil personal data — the current platform does not process this directly
- Special-category data — not requested or expected; covered by Acceptable Use clause
- Payment card data — handled by Stripe and never touches LESSO infrastructure
Data subject rights
Teachers (as data subjects) may request access, rectification, erasure, or portability of their personal data at any time by contacting support@lesso.co.uk. We respond within 30 days in line with UK GDPR Article 12.
This retention schedule is part of the LESSO Trust Hub. See also the DPA §10 and the ROPA entry template. Last reviewed 19 June 2026 in compliance with UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
LESSO Ltd | Registered in England and Wales