1. Retention Principles

• We retain only the minimum amount of data necessary for the purpose for which it was collected.
• Retention periods are based on legal requirements, contractual obligations, operational needs, and risk management considerations.
• Where feasible, data is anonymised rather than retained in identifiable form.

2. Categories of Retained Data

• Contact and inquiry data may be retained for follow-up, customer support, and audit purposes.
• Contractual and transaction records may be retained for accounting, compliance, and dispute-resolution requirements.
• Security logs may be retained to investigate incidents, detect fraud, and maintain service integrity.
• Model training or evaluation data may be retained only where permitted by law, contract, and applicable consent terms.

3. Deletion and Anonymisation

When retention periods expire, data is securely deleted, irreversibly anonymised, or archived in accordance with legal or contractual requirements. We use processes designed to prevent unnecessary duplication and orphaned data storage.

4. Legal Holds and Exceptions

Where litigation, investigation, regulatory review, or contractual obligations require longer preservation, we may suspend scheduled deletion until the relevant matter is resolved.

5. Review and Accountability

We periodically review our retention schedules and storage practices to ensure they remain aligned with current legal requirements, business operations, and security expectations.