Example Software, Inc.: data retention policy
Effective 1 November 2026; next review by 1 November 2027; owner: Head of Operations
1.Purpose
This policy sets how long Example Software, Inc. keeps personal information, why each period is that long, and what happens when it ends.
2.Scope
It covers every category in the schedule below, in every place a copy lives: our systems, shared drives, email, paper files, backups, and the systems of service providers who hold data for us.
3.The rule
Personal information is kept only as long as the purpose it was collected for needs it, and no longer.
For people covered by the GDPR, this follows the storage limitation principle in Article 5(1)(e): data is kept in a form that identifies people for no longer than is necessary for the purposes of the processing.
For California consumers, it follows Civil Code § 1798.100(a)(3): personal information is not kept for longer than is reasonably necessary for the purpose disclosed when it was collected.
4.Retention schedule
Each category is kept for the period below, counted from the event named, and then dealt with as the last column says.
Retention schedule Category Purpose Kept for, then Why this long 4.1Customer accountsNames, work emails and roles of customer users; workspace settings Run the subscription the customer signed 90 days after the account is closedthen: delete contract or claimsGives the customer time to export their data and us time to settle the final invoice 4.2Invoices and payment recordsBilling contact, billing address, invoices, payment references Bookkeeping and the tax returns they support 3 years after the tax return they support is filedthen: review, then delete or extend set by lawIRS: 3 years for most records; 6 or 7 years in the cases the IRS lists, so review before deleting 4.3Payroll and employment tax recordsPay, tax withholding and benefit deductions for each employee Pay staff and file employment taxes 4 years after the tax becomes due or is paid, whichever is laterthen: delete set by lawIRS: employment tax records at least 4 years 4.4Personnel files of former staffContract, role history, reviews, leaving paperwork Answer references and defend employment claims 1 year after employment endsthen: review, then delete or extend set by lawEEOC: personnel records one year; one year from the date of an involuntary termination 4.5Job applicants not hiredCVs, interview notes, test tasks Run the hiring process 1 year after the hiring decisionthen: delete set by lawEEOC: personnel and employment records one year 4.6Form I-9 (US hires)Identity and work-authorisation documents for US employees Prove each US hire's eligibility to work until 3 years after the date of hire or 1 year after employment ends, whichever is laterthen: delete set by lawUSCIS Handbook for Employers M-274, retaining Form I-9 4.7Support tickets and emailsQuestions from customer users, replies, attachments Answer support requests and spot repeat faults 24 months after the ticket is closedthen: delete our decisionCovers two annual renewals, long enough to see a fault come back 4.8Newsletter listEmail address, sign-up date, sign-up page Send the product newsletter until the person unsubscribes or withdraws consentthen: delete consentThe email address alone moves to a do-not-email list so the person is not added again 4.9Product usage analyticsPseudonymous user ids, feature events, device type Find which features are used and fix what is not 14 months after the event is recordedthen: anonymise our decisionLets us compare a month with the same month a year earlier 4.10Server and security logsIP addresses, login times, request paths Keep the service secure and investigate incidents 90 days after the log line is writtenthen: delete our decisionLong enough to look back over an incident found late 4.11Privacy request recordsWho asked, what they asked for, when and how we answered Show how each access, deletion or opt-out request was handled 24 months after the request is closedthen: delete set by lawCCPA regulations § 7101(a): at least 24 months 4.12Risk assessments (California)Risk assessment reports, original and updated versions Show the assessment behind the ad-pixel sharing as long as the processing continues or for five years after the completion of the risk assessment, whichever is laterthen: review, then delete or extend set by lawCCPA regulations § 7155(c) 4.13Trade-show leadsBadge scans: name, company, work email not set period not setthen: delete our decision 5.At the end of a period
Records are deleted or anonymised at the next scheduled clean-up after the period ends, unless the schedule says to review them first or a hold applies.
Backups are not edited record by record: deleted data drops out as each backup copy expires on its own cycle, and is not restored into live systems.
Service providers who hold the data are told to delete or return it when the service ends, as their contract requires.
6.Holds
When a claim, an investigation or a regulator's request is reasonably expected, Head of Operations can pause deletion for the records it needs. The hold is written down with its reason and lifted when the matter closes; the normal period then resumes.
7.Telling people
Our privacy notice gives the period for each category, or the criteria used to set it, as GDPR Articles 13(2)(a) and 14(2)(a) require. The same periods sit in our record of processing activities (Article 30(1)(f)).
Our Notice at Collection and privacy policy give the length of time we keep each category of personal information, or the criteria used to set it (Civil Code § 1798.100(a)(3); CCPA regulations § 7012(e)(4)).
8.Ownership and review
Head of Operations owns this policy and the schedule. Each team that holds a category tells Head of Operations before it starts collecting a new kind of personal information or moves it to a new system.
The schedule is reviewed every 12 months, and whenever a new category, system or law appears.
Built with the OptOutDeck data retention policy template. Information, not legal advice: check each period against the rules that reach your business before you adopt it.
