Vending records multiply quietly. One collection creates a cash-up, a receipt, a commission figure and perhaps a bank deposit entry. Add site agreements, machine notes and contact details, and a small round soon has years of information spread across several places.
Keeping everything forever is not a sound policy. Deleting a record as soon as it feels old is risky too. A vending record retention schedule gives each type of record a reason, a review date and an owner.
Start with the rule that applies to the business
There is no single retention period for every vending record. The right period depends on what the record proves and how the business is structured.
HMRC says a self-employed person must keep business records for at least five years after the 31 January submission deadline for the relevant tax year. Its guidance for self-employed records also explains the different rule for very late returns.
A limited company normally needs to keep company and accounting records for six years from the end of the last company financial year to which they relate. The limited company record guidance lists circumstances where records need to be kept for longer.
VAT-registered operators have another requirement to check. HMRC says VAT records must normally be kept for at least six years, with a longer period for the VAT One Stop Shop and former Mini One Stop Shop schemes. Its VAT record guidance also covers invoices, sales records and digital record keeping.
Those periods are starting points, not a licence to delete every file on the same date. Check which records support the accounts, tax returns and VAT position, and take advice where an enquiry, claim or unusual transaction affects the normal period.
Give each vending record a purpose
A retention schedule works better when it describes real records rather than broad folders such as “admin”. For a vending operator, the list may include:
- cash-ups, collection entries and bank deposit records;
- commission calculations, statements and receipt copies;
- site agreements, rate changes and supporting correspondence;
- machine service, fault, cleaning and stock records; and
- site contact details, staff access records and route notes containing personal data.
Some records sit in more than one group. A commission statement may support the accounts and answer a site owner’s query. Keep it until the longest properly justified period has expired, but write down why that period applies.
Operational records need their own trigger. A cleaning record may follow the business’s food safety procedure, a site requirement or a contract. A machine fault record may be useful until the repair and any follow-up are complete, then remain relevant to maintenance history. Do not copy the tax period across every record without considering its actual use.
Use a trigger as well as a number of years
“Keep for six years” is incomplete unless the team knows when the clock starts. State the trigger beside the period. It might be the end of the financial year, the end of the site agreement, the final collection covered by a commission statement or the date a staff account closes.
A simple schedule should record:
- the record type and system where it is held;
- the business, tax, contractual or operational reason for keeping it;
- the event that starts the retention period;
- the standard review or deletion date;
- the person responsible for the review; and
- any reason to pause normal deletion.
This is much easier to apply than asking somebody to search every old folder and decide from scratch.
Keep the audit trail, not piles of unexplained copies
A retained record needs enough context to make sense later. Keep the site, machine, visit date, person responsible and the figures used. If a cash-up is corrected, preserve the original entry, the corrected figure and the reason rather than silently replacing the first total.
Link related records where possible. The collection entry, commission receipt, safe movement and bank deposit should be traceable without relying on matching handwritten totals. Our guide to reconciling vending cash from collection to bank deposit explains that chain in more detail.
Duplicate exports deserve attention. An old spreadsheet attached to an email may contain the same information as the main system but miss later corrections. Decide which copy is authoritative, restrict unnecessary downloads and include backups in the retention process. A backup protects against loss; it should not become a hidden permanent archive.
Treat personal data differently from machine data
Site contact names, telephone numbers, email addresses and staff activity can be personal data. The ICO’s storage limitation guidance says organisations must not keep personal data for longer than they need it. It recommends standard retention periods where possible, regular reviews, and erasure or anonymisation when the data is no longer needed.
The ICO does not set one fixed UK GDPR period for every category. Operators need to justify the period from the purpose. A current site contact may be needed to arrange access or answer a commission query. Details for somebody who left the site years ago may no longer serve that purpose, even if the underlying financial record still needs to be kept. In that case, consider whether the financial evidence can remain without retaining unnecessary contact details.
Make the review part of the working routine
Set a regular review date, then deal with exceptions before deleting anything. Check for an open HMRC enquiry, unresolved site dispute, insurance matter, legal claim or another documented reason to retain the record. Record the decision so the next review does not repeat the same investigation.
VendMetrix’s current features include cash-ups, printed or emailed receipts, a running safe balance, reports and site owner access to commission history. Those functions can support consistent round records. They do not decide how long an operator must keep each record, so the retention schedule still needs to reflect the business’s tax position, agreements and data protection responsibilities.
Start with the records that carry the most financial or personal detail. Give each one a clear purpose and trigger, then apply the schedule consistently. That produces a record set which is useful when a question arrives, without keeping old information simply because nobody chose a deletion date.