Data relating to  

Document 

Conservation 

Customers and suppliers 

By way of example and without limitation, the following are some of the most significant documents. Invoices (issued by the company and drawn on the company). Contracts between traders (purchase and sale, commission, transport, provision of services, etc.) Contracts with individuals. Real estate contracts (leasing of business premises, sale, purchase, exchange, etc.) Business correspondence Bank contracts and documentation (current accounts, deposits, leasing, renting, etc.) Expense notes. 

Obligation to keep documentation for at least 6 years. It is advisable to keep it depending on the case of prescription of actions. Article 30 of the Commercial Code stipulates that entrepreneurs shall keep the books, correspondence, documentation and supporting documents relating to their business for six years from the date of the last entry made in the books. However, this rule merely establishes a minimum period of time during which, in the general interest, the trader must keep the documents that have been generated in the course of his business.  

Tax relevant documents and records 

Ley General Tributaria arts. 66 a 70 

4 previous financial years (years) 

Parties subject to the Prevention of Money Laundering Act, documentation accrediting compliance with AML obligations 

Law 10/2010 art. 25 

10 years 

Human Resources 

Payrolls, TC1, TC2, etc. 

10 years (Royal Legislative Decree 5/2000, of 4 August, approving the revised text of the Law on Offences and Penalties in the Social Order). 

CVs 

Until the end of the selection process, and for a further 2 years unless the data subject revokes consent or requests deletion. 

Training of workers 

Art 5.2, Order TAS/2307/2007 

4 years 

Working Time Records 

Art. 34.9 Royal Legislative Decree 2/2015, approving the revised text of the Workers' Statute Law. 

4 years 

Severance pay documents.  

Contracts. 

Data on temporary workers.  

RD 425/2005 par. 3 Additional Provision 1 

4 years 

Article 30 of the Commercial Code establishes a minimum period of 6 years. Organic Law 7/2012 recommends keeping it for 10 years. 

Worker's file. 

Up to 5 years after leaving (Royal Legislative Decree 5/2000, of 4 August, approving the revised text of the Law on Offences and Penalties in the Social Order). 

Documentation or computer records accrediting compliance with ORP regulations. 

RDL 5/2000 art. 4 

5 years 

Marketing 

Databases or web visitors. 

For the duration of treatment. 

Access control and video surveillance 

Visitor registration 

Instruction 1/1996 AEPD 

30 days  

Video surveillance 

The images/sounds captured by video surveillance systems shall be cancelled within a maximum period of one month from their capture. 

The recordings shall be destroyed within a maximum of one month from their recording, unless they are related to serious or very serious criminal or administrative offences in the field of public security, to an ongoing police investigation or to an ongoing judicial or administrative procedure. 

Instruction 1/2006 AEPD 

30 days 

Accounting 

Accounting books and documents. Annual accounts 

Shareholders' agreements and boards of directors, articles of association, minutes, regulations of the board of directors and delegated committees. 

Financial statements, audit reports 

Records and documents related to grants 

Commercial Code art. 30: 

6 years 

Corporate Documentation 

Deeds of incorporation of the company together with the articles of association, deeds of elevation of corporate resolutions, deeds of granting/renewal of powers of attorney, deeds of purchase/sale of shares, deeds of purchase/sale of assets, deeds of shares, dissolution/settlement, etc.). 

Books of minutes of meetings of the general meeting and the board of directors (commercial companies), register of shares, register of shareholders, register of contracts with the sole shareholder, other books. 

Other corporate documentation (private share purchase agreements, shareholder loans, pledges of shares, etc.) 

It is recommended to keep them throughout the life of the company, from its incorporation until at least 6 years after its dissolution and liquidation. In the event that the deeds will incorporate rights or obligations for the company, it is recommended to adhere to the above-mentioned limitation periods. 

Obligation to keep the documentation for at least 6 years. From the last entry made in the books. They must be kept throughout the life of the company from its incorporation until at least 6 years after its dissolution and liquidation. 

It is recommended to keep them throughout the life of the company, from its incorporation until at least 6 years after its dissolution and liquidation. 

Fiscal/ Tax 

Administration of the entity's administration, rights and obligations relating to the payment of taxes. 

Administration of dividend payments and withholding taxes. 

All documents that justify the taxpayer's tax actions (proof of income and expenditure), including both accounting and supporting documentation (contracts, invoices, receipts, delivery notes...) All types of tax declarations. 

Obligation to keep the documentation: Minimum 4 years. Articles 66, 67 and 68 of the General Tax Law. The general limitation period for tax obligations is 4 years. With regard to tax returns, the 4-year limitation period starts to run from the day on which the voluntary tax filing period ends. In the event that there has been a subsequent action by the administration (inspection, partial verification) or by the taxpayer (corrective return, appeal) that has interrupted the limitation period, a new 4-year period starts to run from that action. However, it is advisable to keep the physical documentation, as Organic Law 7/2012 recommends keeping it for 10 years. Order EHA/962/2007 provides for the possibility of destroying invoices received on paper if a certified digitalisation process has been previously carried out to obtain electronically signed digital copies. 

Health and Safety 

Clinical Histories. 

Workers' Medical Records 

Health data of Spa clients (wellness treatments). 

Article 17.1 of Law 41/2002 of 14 November, on patient autonomy and rights and obligations regarding clinical information and documentation.  

5 years  

Insurance  

Insurance policies 

6 years (general rule) 

2 years (damage) 

5 years (personal) 

10 years (life) 

Legal 

Intellectual and Industrial Property Documents. 

Contracts and agreements. 

5 years 

Permits, licences, certificates 

6 years from the expiry date of the permit, licence or certificate. 

10 years (criminal statute of limitations) 

Confidentiality and non-competition agreements 

Always the period of duration of the obligation or of confidentiality 

Data protection regulations 

Records and documents proving compliance with the requirements of the data protection regulation (audits, reports, contracts with data protection officers, etc). 

For the duration of the data processing and thereafter during  

3 years 

Documentation accrediting that requests for the exercise of data subjects' rights are dealt with. 

During  

3 years after application 

Logs/ Logs of accesses to information systems 

2 years 

If the processing is based on the data subject's consent, proof of consent 

For the duration of the data processing and thereafter during  

3 years 

Traffic data relating to internet connections, e-mails and calls sent or received from fixed-line telephony. 

User ID, IP address (source/destination), phone number, IMSI and IMEI (source/destination), date and time of communication (start/end), identification of the type of service or communication used (voice, data, SMS or MMS). 

Article 5 of Law 25/2007 on the retention of data relating to electronic communications and public communications networks. 

1 year 

Biometric data (fingerprint, facial recognition), if applicable, under the guidelines published by the AEPD. Their use is currently not permitted. 

Biometric data are registered in the tool/software enabled for this purpose by the entity, in case a positive Impact Assessment has been carried out, within the current legal framework. 

In compliance with the principle of limitation of the storage period, personal data may be processed for no longer than is necessary for the purposes of the processing, therefore, taking into account the provisions of article 34.9 of the ET, the company will keep the records for four years and they will remain at the disposal of the employees, their legal representatives and the Labour and Social Security Inspectorate. It will be the user who notifies and initiates the procedure for definitive sick leave. 

Access control buildings: 30 days, files to control access (Inst. 1/1996 AEPD) 

INACTIVE FOOTPRINTS: 6 MONTHS OF INACTIVITY. RECORDS: EMPLOYED, 4 YEARS, NON-EMPLOYED: 30 DAYS 

Academic data, academic history, student identification data, attendance data, sanctions, psycho-pedagogical reports, continuous assessment data and final results, scholarship and grant applications. 

Academic record, personal data file of the educational centre, academic history, disciplinary reports and reports, evaluation reports and report cards, scholarship application and decision files.  

Academic record and history: permanently. 

Disciplinary reports and reports: 5 years. 

Evaluation reports and report cards: permanently for reports and 5 years for report cards. 

Scholarship application and resolution files: 6 years from the resolution. 

Guests 

Check-in of travellers/guests. 

3 years (Ley Orgánica 4/2015 de protección de seguridad ciudadana, Orden INT/1922/2003 and in RD 933/ 2021, of 26 October (obligations of documentary registration and information of natural or legal persons carrying out accommodation activities).