Data Retention and Document Handling Policy

Do not request passports, driving licences or personal ID at the initial EOI stage unless expressly required by an appointed provider later.

Separate business-energy documents from any sensitive personal documents if received by mistake.

Use SharePoint/Teams folders with role-based permissions rather than uncontrolled email attachments where possible.

Keep an audit trail of consent, document requests, referrals and deletion requests.

Delete or archive incomplete enquiries after a defined period unless there is a valid reason to retain them.

Restrict access to any sensitive document folder and do not load sensitive personal documents into a dialler or marketing spreadsheet.