Data retention schedule
Last updated: 16 August 2026 · Version 1.0
This page lists every category of data we hold, how long we keep it, why we are allowed to keep it, and — the part most retention notices leave out — whether the period is enforced by the system itself or by people following a process.
How to read this schedule
The last column is the one worth reading first. It says how each period is actually kept, and the two values mean different things:
- Automated — a scheduled job, a database rule or your own browser enforces the period without anyone deciding to act. An abandoned checkout, for example, is deleted 24 hours after you start it, whether or not anybody looks.
- Operational — the period is real but it is kept by people following a process, not by a timer. We mark these honestly rather than describing them as automatic, because claiming an automated period we do not enforce would be a false statement in a document you are entitled to rely on.
Every Automated period in the schedule below is checked against the code that actually enforces it, by a test that runs before any change ships. If the two ever disagree, the change is blocked rather than published.
The retention schedule
| Data category | Retention period | Lawful basis | How it's enforced |
|---|---|---|---|
| Abandoned checkoutsAn order you started but never paid for, including the name, email and phone number typed into the checkout form. | 24 hours | Legitimate interests (UK GDPR Art. 6(1)(f)) - holding an in-progress basket long enough for you to come back and finish it, then deleting it. | Automated |
| Webhook delivery recordsThe log of each outbound webhook a vendor's integration was sent, including the delivery attempt history. | 30 days | Legitimate interests (UK GDPR Art. 6(1)(f)) - letting a vendor debug a failed integration delivery, bounded so the log does not become an open-ended store. | Automated |
| Quarantined image uploadsThe raw bytes of an image a vendor uploaded, held in quarantine while the pipeline validates and re-encodes it. Only the validated derivative is kept afterwards; the raw upload is reclaimed. | 72 hours | Legitimate interests (UK GDPR Art. 6(1)(f)) - a declared horizon that lets a vendor's upload survive a broker outage instead of being destroyed as a 15-minute accident, while still bounding how long unvalidated bytes sit on the origin. | Automated |
| Customer sign-in cookiesThe jtoye-customer-refresh and jtoye-customer-id cookies that keep you signed in to a shop between visits. | 30 days | Strictly necessary (PECR reg. 6(4)) - these cookies exist only to deliver the sign-in you asked for; no consent is required and none is sought. | Automated |
| Customer access cookieThe short-lived jtoye-customer-access cookie carrying the access token for the current request. | The short sign-in session length set by our identity provider, renewed automatically while you stay signed in | Strictly necessary (PECR reg. 6(4)) - required to deliver the signed-in session you asked for. | Operational |
| Marketing opt-outs and opt-insThe record that you unsubscribed from a category, or that you opted in to marketing. | Kept indefinitely - deliberately never deleted | Legal obligation and legitimate interests (UK GDPR Art. 6(1)(c) and 6(1)(f)) - an opt-out that expired would resurrect a suppressed recipient, so honouring it permanently is the obligation, not an option. | Automated |
| Your personal details on completed ordersYour name, email, phone and delivery address as they appear on orders, customer records and reviews. | Removed on request - there is no automatic timer | Right to erasure (UK GDPR Art. 17), applied by anonymising rather than deleting so the vendor's financial record stays intact. | Operational |
| Audit historyThe append-only history of changes to records, used to answer who changed what and when. | Kept indefinitely | Legitimate interests (UK GDPR Art. 6(1)(f)) - integrity, dispute resolution and security investigation. Personal data inside this history is scrubbed when an erasure request is honoured (R-7). | Operational |
| Order and payment recordsCompleted orders and the financial transactions recorded against them. | For as long as the law requires | Legal obligation (UK GDPR Art. 6(1)(c)) - tax and accounting record-keeping. | Operational |
| Order-tracking email in your browserThe email address you type to look up an order, kept in your browser's session storage so the page does not ask again while you are on it. | Cleared when you close the tab | Strictly necessary (PECR reg. 6(4)) - it exists only to deliver the order lookup you asked for, and never reaches our servers as a stored record. | Automated |
| Saved checkout email in your browserThe email address you last used at a shop's checkout, kept in your browser's local storage so it can be filled in for you next time. | Until you sign out or clear your browser's site data | Strictly necessary (PECR reg. 6(4)) - it is a convenience within the checkout you asked for, stays on your device, and is never read by us as a stored record. | Operational |
| Order history in your browserThe orders you placed on this device, each with the email address it was placed with, kept in your browser's local storage so you can find them again. Signing out removes the list. | Until you sign out or clear your browser's site data | Strictly necessary (PECR reg. 6(4)) - it is what lets a guest find the order they just placed, and it stays on your device. | Operational |
| Your email address on a data requestWhen you ask us for a copy of your data or to erase it, the email address you give us, so that we can confirm the request with you, act on it and reply. We hold it only in encrypted form, and delete it when the request is completed, cannot be completed, or expires. | Until your request is closed, or 168 hours if you never confirm it | Legal obligation (UK GDPR Art. 6(1)(c)) - answering a data-subject request under Articles 12, 15 and 17 requires us to be able to reach the person who made it. | Automated |
| A copy of your data prepared for youWhen you ask for a copy of your data, the copy we prepare for you: what every shop on J'Toye holds about you, gathered into one file. We hold it only in encrypted form, behind a single-use link emailed to you, and delete it as soon as you download it. | Until you download it, or 168 hours if you never do | Legal obligation (UK GDPR Art. 6(1)(c)) - Article 15 requires us to give you a copy of your personal data, and keeping it until you collect it is part of giving it to you. | Automated |
| A pseudonym of your connection on a cash orderWhen you place a cash order, a keyed one-way code made from your connection's network address - never the address itself - so that one connection cannot flood a shop with cash orders. It is removed when the order is completed or cancelled, cleared by a daily job once it is older than the period here, and erased if you ask us to erase your data. | Up to 72 hours, or until the order is completed or cancelled if sooner | Legitimate interests (UK GDPR Art. 6(1)(f)) - protecting vendors from floods of fake cash orders, using a pseudonym rather than the address so the least data is held for the shortest time. | Automated |
Periods we do not publish as a number
Two rows above give a description instead of a number, and that is deliberate in both cases.
Order and payment records are kept for as long as the law requires. We have not printed a figure in years here, because the retention period for tax and accounting records is a legal position rather than something we measured, and publishing an unverified number in a document a regulator may rely on would be worse than publishing none.
The customer access cookie expires on a schedule set by our identity provider, not by us. Its lifetime is short and it is renewed while you stay signed in. We describe it rather than printing a number because the number is not ours to publish, and it would become false the moment that setting changed.
Asking us about retention or erasure
You can ask us what we hold about you, ask us to correct it, or ask us to erase it. Erasure of your personal details on completed orders is the Operational row above: we anonymise the record rather than deleting it outright, so the vendor's financial and tax records stay intact while your personal details are removed from them.
Reach us at:
- Crispins Manor Farm Lane, Michelmersh, Romsey, England, SO51 0NT
Related policies
- Privacy notice — what we collect, who is responsible for it and your rights.
- Cookie and browser-storage policy — every cookie and item of browser storage, and what each one does.
- Accessibility statement — our conformance status and how to report a problem.