How long do you keep my records?

How long an organisation keeps your information is one of the questions people ask us most often. Here is how it works at Credicorp Limited.

The principle

Under UK data-protection law (the UK GDPR and the Data Protection Act 2018) we are only allowed to keep your personal information for as long as we need it for the purpose we collected it for. "As long as we need it" is shaped by several rules at once:

• tax record-keeping rules (HMRC requires financial records to be kept for several years) and anti-money-laundering record-keeping under the Money Laundering Regulations 2017;
• HM Revenue & Customs rules on how long we must keep financial records for tax purposes;
• limitation rules — the period during which a legal claim could be brought against, or by, either party;
• specific complaint-handling and Ombudsman timelines.

For most customer loan files those rules taken together come out at around six years after the relationship ends. There are some categories — call recordings, marketing-consent records, employment-related records — with different (typically shorter) retention periods. Our full retention schedule is summarised in our Privacy Policy.

While your account is open

While your loan is active, we keep the full record. You can ask for a copy of your Business Loan Agreement or a statement of account at any time using the relevant form on the Forms & Requests page. There is no charge for a reasonable request.

After your account closes

After closure we hold the record for the period set out above. During that period you can still:

• ask for a copy of the closed account record under a subject access request (see subject access requests);
• raise a complaint about something that happened while the account was open (subject to the time limits in our complaints time-limits article);
• ask for the information held about you to be corrected if it is wrong.

Deletion at end of retention

When the retention period runs out, the information is securely deleted from our systems. We do not retain personal data "just in case" beyond what the rules allow. If you ever have a specific question about the data we hold about you, please contact our privacy team via the General Support Enquiry form.