Data Retention Policy

1) Introduction and scope

This policy sets principles and retention periods for all data Tanqory stores/processes/backs up/transfers/destroys (digital/physical/verbal) to meet legal requirements, reduce risk, and use resources efficiently.
Use with the Privacy Policy, DPA, Data Classification Policy, Incident Response, Data Disposal Standard, and contracts/Order Forms; if conflicts arise, the stricter/more specific document prevails.
Applies to employees, contractors, partners, third parties/processors, and all systems/media including backups/archives/logs.
Binding details rely on Appendix A and Order Forms for Enterprise customers; this document is the overarching framework.
Follows Storage Limitation and Data Minimization (GDPR Art.5), erasure/RTBF (Art.17), and PDPA/CCPA/PCI requirements.
Continued service use after notice of changes signifies acceptance, except for immediate safety/legal changes.
Incidents/court orders/special laws may extend or pause deletion (legal hold) with notice to relevant parties.
Portable/backup/archive data must follow the same periods as the source unless specifically set.
Queries/rights requests: dpo@tanqory.com, security@tanqory.com.

2) Principles and legal bases

Retain only as necessary for lawful/contractual purposes or legal obligations and delete or de-identify when no longer needed.
Legal bases: legal obligation (tax/accounting/AML), contract (service/support), legitimate interests (security/fraud prevention), consent (marketing/opt-in features), and safety/emergency exceptions.
Respect data subject rights (access/rectify/erase/restrict/object/portability/withdraw consent) unless limited by legal/contractual obligations.
For sensitive/PCI/incident data, keep to the lowest lawful minimum and delete when no longer necessary.
Conduct DPIA/legitimate interest assessments when retaining beyond normal limits or relying on legitimate interests.
Use de-identification/pseudonymization/synthetic data where suitable to reduce risk.
Cross-border transfers use SCC/IDTA/BCR or equivalent legal bases and follow Appendix A.
Be transparent about retention/criteria in notices/contracts; material changes will be communicated via durable medium (email/dashboard).
Customer data is not used across tenants to train models unless rights are granted or after de-identification.

3) Roles and responsibilities

Data Owner/Business Owner: set classification and retention, approve legal holds, and review regularly.
Security/IT: enforce controls (access, encryption, DLP, backup/restore, disposal) and record deletions/destruction.
DPO/Legal: advise on law/transfers/data subject rights, ensure compliance, approve exceptions.
Users/employees/contractors: follow retention/deletion; do not keep unnecessary copies.
Processors/vendors: comply with DPA/SCC/IDTA and delete/return data at end of contract or upon request.
Audit/Compliance: monitor, report gaps, and track remediation.
Management: provide resources and enforce within their units.

4) Primary retention schedule (summary)

Use Appendix A as a quick summary; if documents/contracts set longer periods, apply the longest required by law/contract.
Account/tax/finance: 7–10 years (strictest tax/accounting law).
Orders/transactions: contract term + 7 years (or longer if law requires).
Payments/PCI: per PCI DSS (minimize; do not store CVV/full PAN); tokenize/delete when no longer needed.
Security/system/incident logs: 1–3 years based on risk/law (e.g., AML/investigations).
Telemetry/analytics: short, necessary duration; delete/de-identify when no longer needed or after opt-out/withdrawal.
HR data: employment term + 7 years (or longer per labor/tax law).
Consent records: lifecycle + 7 years post-withdrawal for compliance proof.
Marketing/newsletter: until consent withdrawn + delete within SLA (e.g., 30 days).
Backups/archives: must mirror source retention and not be used for other processing.

5) Deletion, destruction, and backups/archives

Delete when due or no longer necessary, using secure delete/cryptographic erase for L3/L4; issue evidence (log/certificate) when required.
Physical media: destroy securely (shred/degauss/physical destruction) via contracted providers.
Backups/archives: must have scheduled deletion; do not restore erased data for normal processing except for security/legal needs with recorded reasons.
Restores must not reintroduce erased data without consent/legal mandate; delete promptly after restore if required.
Data under legal hold must pause deletion until lift approved by Legal.
Systems/subprocessors must support deletion/destruction per SLA in the DPA/contract.
Do not discard portable media containing data without proper destruction.
Maintain deletion/destruction records for audit/disputes.
Users must not create unmanaged shadow copies.

6) Handling rights requests and appeals

Channels: dpo@tanqory.com or dashboard form; identity verification required.
SLA: intake ≤2 Business Days, updates every 10 Business Days, target closure 30 days (notify if longer/complex).
Erasure/objection/withdrawal: delete or restrict when not barred by legal/contract obligations; if not possible, explain reasons and remaining retention.
Copies/portability: provide in common/machine-readable format where feasible without infringing others’ rights.
Requests affecting backups/locks: delete in the next feasible cycle and communicate timelines.
No fees unless requests are manifestly unfounded/excessive per law.
Regulator channels: PDPC (SG), ICO (UK), relevant EU DPAs, and applicable US state data/consumer authorities.
Enterprise: follow SLA/process in Order Form/DPA.
Log requests/outcomes to demonstrate compliance.
If requests affect service availability, explain impacts/options before action.

7) Processors/third parties and cross-border transfers

DPA/SCC/IDTA/BCR require processors to delete/return data at end of contract/on request and bar out-of-scope use.
Cross-border transfers need valid bases (SCC/IDTA/adequacy/consent) and must be recorded in ROPA/DTIA/TRA per EDPB/ICO guidance.
Cloud/AI/processors must specify retention/deletion in contracts and be monitored.
No sale/rental of personal data; sharing only under legal bases/contracts.
DR/HA region moves must maintain equivalent retention and notify customers if impacting data.
Provider changes will be notified (except safety emergencies) with contractual options.
Do not send sensitive/PCI/incident data to providers lacking adequate standards.
External AI/services must not use customer data cross-tenant unless de-identified/explicitly authorized.
Enterprise may request subprocessor lists/advance change notices per DPA.

8) Review and improvement

Review retention tables/procedures at least annually or when laws/contracts/services/incidents change.
Internal/external audits per ISO/SOC/PCI/GDPR/PDPA; remediate per improvement plans.
Metrics: on-time deletions, DLP events, offboarding revocation time, audit gaps.
Test deletion/RTBF/backup-restore processes periodically.
Update SOP/Runbook/FAQ and training (Section 9) after changes.
Keep review/improvement records for compliance and management reporting.
Security incidents or court orders may require temporary holds; record/communicate holds.
Changes adding burden/reducing rights: announce ≥30 days via durable medium unless emergency.
Management and Data Owners must approve changes affecting schedule durations.

9) Training and communication

All staff/contractors/providers with data access must complete retention/disposal training before access and refresh at least annually.
Training includes: Storage Limitation, labeling, erasure/hold requests, media destruction, backup handling, legal/contract requirements.
Provide cheat sheets/FAQ on erasure/hold processes and system use.
Communicate significant changes via email/dashboard (durable medium).
Keep training records for compliance (ISO/SOC/law) and measure effectiveness (quiz/score).
Promote “keep only what’s needed; delete on time” culture and reporting of over-retention risks.
Incorporate incident/audit lessons into training/process updates.
HR/Managers must ensure required training completion.
Questions: dpo@tanqory.com, security@tanqory.com.

10) Contact channels

General/policy info: info@tanqory.com
Data rights/complaints: dpo@tanqory.com
Security/urgent deletions: security@tanqory.com
Legal/contracts/transfers: legal@tanqory.com
Help Center: https://help.tanqory.com
Include system/data type/level/court order/timeline when requesting to speed responses.
Response SLA: intake ≤2 Business Days, updates every 10 Business Days, target closure 30 days; complex cases will include reasons.

Appendix A: Retention schedule (snapshot)

• Binding numbers: latest documents/dashboard/Order Form; this snapshot is for quick reference (update when laws/contracts change).
• For country/state-specific ceilings (e.g., US state tax/accounting, sector rules), attach sub-appendices or reference Order Form/customer appendix and apply the strictest.

Change history