retain, securely, the details provided to, or recorded by, them for a period of 21 days beginning with the day on which the details are provided;

destroy those details as soon as reasonably practicable after the expiry of the period in paragraph (a) unless there is another basis outside these Regulations on which the details may lawfully be retained.