2.7 DISPOSAL AND DESTRUCTION POLICY
We may collect and further process the following categories of data from Users:
Any Personal Data is deleted from our systems only after (a) obtaining a Userâs data deletion request in line with corresponding procedures by a Client or Subject or (b) the satisfaction of the purpose for data processing, including expiration of retention period prescribed by applicable law.
Any request to delete all or any Personal Data related to a User is fulfilled within thirty days. This period is justified by the complexity of the systems and technologies we operate to process the data.
Usersâ Personal Data may be retained for up to ninety days (from a Userâs request for data deletion) to comply with any applicable law, regulation, legal process, or governmental request and investigation; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of the Clientâs or our terms of service, or threats to the security of the Services or the physical safety of any person. We will delete such Personal Data of the affected User when no longer legally obligated or reasonably required to retain it.
When the processing purposes differ from those specified above, we maintain the following retention period considering the amount, nature and sensitivity of the Personal Data and the purposes for which we are permitted to process it.
When we develop and improve identity verification services to prevent and detect fraud and other illicit activity, we will keep Personal Data in a pseudonymised format for the period required to calibrate and select the perfect algorithm and model for detecting fraud and other illicit activity. We may also have to store some records that have been confirmed as relating to fraudulent applications or accounts or obtaining and maintaining records to prove our compliance with legal obligations. For example, regarding consent activity log history, the retention period is defined by the criteria derived from requirements by law regarding limitation periods, other applicable regulatory requirements, contractual provisions and industry standards.
When the purpose refers to the establishment, exercise or defence of legal claims, the retention period is limited to the duration of such proceedings in a specific case or circumstance.
In any case, we do not keep your data longer than we have a lawful basis for doing so.