Retention periods
How long do we keep what?
The retention periods that apply to each kind of data – from cases to accounts, billing, logs and backups.
For every kind of data it is defined how long we keep it. The periods on this page come directly from that definition: if it changes, this page changes too.
“At most” means: the data is deleted no later than at the end of the period. “Required by law” means: we have to keep the data for that long and must not delete it earlier. Each period starts with the event in the last column.
Cases and placements
| Data | Period | Period starts |
|---|---|---|
| Draft of a case that was never published | at most 30 days | Last change to the content of the draft |
| Case data after a successful placement | at most 30 days | Case closed with a placement |
| Case data when a case ends without a placement | at most 30 days | Case closed without a placement |
| Case data of a withdrawn case | at most 30 days | Case withdrawn |
| Messages and team notes on a case | immediately | Deletion date of the related case |
| History of the placement | immediately | Deletion date of the related case |
| Proof of consent and authorisation | immediately | Deletion of the related case |
| Brief proof of a placement, only in a justified individual case | at most 3 years from the end of the calendar year | Case closed with a placement |
| Proof of consent, only in a justified individual case | at most 3 years from the end of the calendar year | Deletion of the related case |
Account, team and organisation
| Data | Period | Period starts |
|---|---|---|
| Registration that was not completed | at most 30 days | Registration started |
| Invitation to a team | at most 14 days | Invitation created |
| Membership of an organisation after it ends | at most 30 days | End of the membership |
| User account after its deletion | at most 30 days | Confirmed deletion of the account |
| Organisation and location after all services end | at most 30 days | End of all services |
| Key figures in the cockpit of an organisation | at most 24 months | End of the month of the key figure |
Billing
| Data | Period | Period starts |
|---|---|---|
| Invoices | 8 years from the end of the calendar year (required by law) | Invoice issued |
| Accounting vouchers | 8 years from the end of the calendar year (required by law) | Voucher created |
| Business letters | 6 years from the end of the calendar year (required by law) | Letter sent or received |
| Books, records and financial statements | 10 years from the end of the calendar year (required by law) | Books or record closed |
| Invoice recipient and accounting contact | at most 6 years from the end of the calendar year | End of billing for the recipient |
| Individual discounts | at most 6 years from the end of the calendar year | End of the discount |
Requests and data protection rights
| Data | Period | Period starts |
|---|---|---|
| Enquiries through the contact form of the website | at most 12 months | Enquiry received |
| Support requests | at most 12 months | Support request closed |
| Export files for download | at most 7 days | Export file created |
| Export jobs after the file has expired | at most 90 days | Export file expired |
| Requests about your data protection rights | at most 3 years from the end of the calendar year | Request completed |
| Record of a lifted restriction of processing | at most 3 years from the end of the calendar year | Restriction lifted |
| Record of the notices to recipients | at most 3 years from the end of the calendar year | Notice completed |
| Deletion log (without the content of the deleted data) | at most 3 years from the end of the calendar year | Deletion completed |
Technology and security
| Data | Period | Period starts |
|---|---|---|
| Technical logs of email delivery | at most 30 days | Last delivery attempt |
| Access logs of the web server | at most 7 days | Time of the logged event |
| Cleaned error logs | at most 14 days | Time of the logged event |
| Operations logs | at most 14 days | Time of the logged event |
| Sign-in attempts and security events | at most 30 days | Time of the logged event |
| Log of the operator’s access to cases | at most 6 months | Access by the operator |
| Administration data of the KIS connection after revocation or end | at most 90 days | KIS bridge revoked or KIS connection ended |
| Commands to the KIS bridge | at most 90 days | Command to the KIS bridge completed, cancelled or expired |
| Backups | at most 30 days | Backup created |
| Block list that keeps deleted data from returning from a backup | at most 60 days | Deletion completed |
How a deletion works, when data is exceptionally kept longer and what happens to backups is explained in the article “What happens when data is deleted?”.