PERSONAL DATA RETENTION POLICY FOR E-SHOT™
1. Introduction
This data Retention Policy outlines how Forfront collects, stores, and deletes personal data associated with e-shot™, the email and SMS communication platform and its activities. We are committed to complying with all relevant data protection regulations in the UK, including the UK General Data Protection Regulation (UK GDPR).
e-shot™ is a cloud-based Software as a Service (SaaS) platform that lets organisations design, send, and track targeted email and SMS campaigns. The platform is user-friendly, and it offers features such as automation, list management, and analytics to engage with an audience, nurture customer relationships, boost sales, and build customer loyalty.
2. Data Collected
The e-shot™ platform offers organisations the facilities to manage their contact lists by collecting and managing data that is relevant for their campaigns. The data collected is stored in the platform and is managed by the customer who is the Data Controller. It may hold some personal data such as:
Email address
Phone number (optional)
Name (optional)
Company (optional)
Other relevant contact information for personalisation (optional)
Other relevant criteria for targeting purposes such as Preferences (optional)
Digital activity (e.g., clicks on links in emails)
3. Data Controller
The e-shot™ clients are the Data Controllers.
4. Data Processor
e-shot™ is the Data Processor.
5. Legal Basis for Processing
We process personal data on your behalf based on your undertaking that you collect and manage any personal data strictly adhering to the six lawful bases of the General Data Protection Regulation (UK GDPR):
Consent: The individual gives clear and freely given permission for you to process their data for a specific purpose.
Contract: Processing is necessary to fulfil a contract with the individual or because they requested steps before entering a contract.
Legal Obligation: Processing is required by law (not including contractual obligations).
Vital Interests: Protecting someone’s life necessitates processing their data.
Public Interest: The processing serves a public good or fulfils a duty with official authority.
Legitimate Interests: You have a justified reason to process the data, as long as it doesn’t outweigh the individual’s rights.
6. Unsubscribe opt-out
e-shot enforces the ability for any recipient to withdraw their consent at any time by clicking the ‘unsubscribe’ (opt-out) link at the bottom of the email, by using the standard ‘one-click’ unsubscribe available on major email platforms (Gmail, Yahoo, etc.) or by contacting us directly.
Contact that have complained in their email client (Outlook, Gmail, etc.) or marked the email campaign as spam are automatically unsubscribed.
Contacts that were imported to e-shot as suppressed.
Contacts that unsubscribed through the client’s preference centre web page.
Unsubscribed contacts are forever blocked from sending to.
Unsubscribed contacts can re-subscribe, opt back in by using the same unsubscribe link at the bottom of the email.
7. Data Retention Periods
We retain personal data for email marketing purposes for the following periods:
Active Subscribers: retained for as long as the contact remains an active subscriber.
Campaign Performance Data: We may retain anonymised campaign performance data (e.g., open rates displayed, click-through rates) for the period that the account is active for trend analysis and campaign optimisation purposes.
Deletion and erasure rights
The right to be forgotten (Right to erasure)
GDPR introduced a right for individuals to have personal data erased also known as ‘the right to be forgotten’.
Individuals can make a request for erasure in writing and the customer and e-shot have one month to respond to the request and delete their contact.
When an individual requests to exercise their Right to erasure, there are 2 options:
If the account has only one subaccount, the contact is deleted in the platform.
If the account has multiple subaccounts, the request must be made to the e-shot support team who will identify which subaccounts the contact is in and delete it in all subaccounts.
This will remove any records including Personal Identifiable Information (PII) including the email address and any other data held for this contact record. If the contact is in unsubscribe status, e-shot will maintain the email address to comply with GDPR and prevent accidental re introduction into the system.
This right applies ONLY individually and cannot be applied in bulk.
What happens when a contact is deleted?
When a contact is deleted in e-shot; manually, in bulk or via the API, it begins a period of 30-day ‘Soft delete’ status.
As a Soft delete, the contact will not be included in any campaigns sent from that point onwards. During the 30-day period, all the details and the transaction history will be maintained in case it needs to be reinstated as active. After 30 days e-shot will automatically Hard delete the contact.
What happens when a contact Hard deleted?
When a contact is Hard deleted in e-shot, after the 30-day period of ‘Soft delete’ status, all identifying information is removed including the email address (which is anonymised). From that point onwards it is unidentifiable, but it will still be counted in the historic reports, to maintain the integrity of previous campaign analytics. This state is not reversible and if the same email address will be entered again, it will be treated as a new subscription with no previous history.
Unsubscribed contacts are not anonymised to comply with GDPR.
How do we comply with GDPR
Customers must ensure that all data has been acquired lawfully by opt in or adhere to the Lawful Basis guidelines.
If a contact unsubscribes/opts out, it is the Data Processor’s (e-shot) responsibility to ensure that this contact will NOT receive any further communication. e-shot enforces this rule by maintaining the contact email address in an Unsubscribe Status.
Termination of contract
Once a contract concludes and the account is closed, data remains held in an encrypted state for 30-90 days before being permanently erased. Data storage on physical media cannot be directly accessed. Data and storage media no longer required is securely wiped and sanitised so it cannot be recovered. Any sanitisation or wiping undertaken meets the NCSC standards: www.ncsc.gov.uk/guidance/secure-sanitisation-storage-media and Hardware is recycled by licensed third party.
8. Security
We take the appropriate technical and administrative measures to protect data from unauthorised access, disclosure, alteration, or destruction.
9. Review
We review this Data Retention Policy regularly and update it as necessary.
10. Contact Us
If you have any questions about this Data Retention Policy or your data protection rights, please contact us via the contact page.
Last updated 25 May 2025