Keeping data for a reason
We do not keep data indefinitely by default. Each category of information has a purpose, a retention trigger and a limit, and we prefer shorter retention where the purpose can still be met.
Data we hold for our own operations is treated separately from customer data we process on instructions, because the two are governed by different arrangements.
How different data is treated
- Account records: kept for the active relationship, plus any recovery window and time needed to resolve outstanding matters.
- Research, verification and outreach records: governed by the customer's instructions and the deletion schedule in the Data Processing Agreement.
- Billing and tax records: kept for the period applicable accounting and tax rules require.
- Support and security logs: kept for the period needed to resolve issues, prevent abuse and investigate incidents.
- Backups: kept on a defined rotation, with restricted use, and deletion reapplied if a backup is ever restored.
- Suppression records: the minimum information needed to honour an opt-out, kept so that someone is not added back to a list.
Cancellation, export and closure
Cancelling billing does not automatically close an account. Before closure we explain what can be exported, what remains accessible and when deletion happens.
Copies you have exported, or that sit in your own connected tools, stay under your control. Deleting our copy does not remove a file already downloaded to your device.
Requests and how they are carried out
A deletion request is routed to whoever controls the data, or handled under the Data Processing Agreement where it relates to customer instructions. Identity checks are limited to what is needed to protect the data. Valid requests are carried out within the applicable deadlines.
Deletion covers active systems and propagates to relevant providers. Backups are isolated from ordinary processing and expire on their schedule, and a restored backup is brought back in line with any deletion instruction. Anonymisation is only an alternative where someone can no longer reasonably be identified.
Legal holds and necessary records
A legal obligation or a genuine dispute can require us to keep something longer. Where that happens we record the reason, restrict access to it and set a review date. Keeping data for one reason does not permit using it for another.
Where we have to refuse or limit an erasure request, we explain why and how to take it further. A hold is lifted once the reason for it ends.