Data retention policy
We retain your Personal Data as long as we are providing the Services to you or our Business Users (as applicable) or for a period during which we reasonably anticipate providing the Services. Even after we stop providing Services directly to you or a Business User with which you are doing business, and even if you close your account or complete a transaction with a Business User, we retain your Personal Data in order to comply with our legal and regulatory obligations. We may also retain it to allow for fraud monitoring, detection and prevention activities. We also keep Personal Data to comply with our tax, accounting, and financial reporting obligations, where we are required to retain the data by our contractual commitments to our financial partners, and where data retention is mandated by the payment methods you used. In cases where we keep Personal Data, we do so in accordance with any limitation periods and records retention obligations that are imposed by applicable law.
Data archiving and removal policy
The need to retain operational and archived data will be reviewed on an ongoing basis.
Data no longer needed for routine operations and which need not be retained in archive will be destroyed in a timely manner in compliance with legal requirements and policies.
Data storage policy
Introduction
All data will be stored, backed-up, archived and disposed of in a manner consistent with its sensitivity, requirements and best practices. Data classification is a key component for making consistent and appropriate decisions related to data storage and retention.
Unneeded non-authoritative data (duplicate copies, outdated records, non-business-related files, test data) accumulate in operational locations need to be removed when no longer needed. Purging not only saves IT resources, but also avoids the possibility of compromising sensitive data in these sources that may not be as well protected as the authoritative masters.
Data Storage
All data is stored encrypted when at-rest. In addition to this, sensitive information is both encrypted on disk, but an additional layer within the database storage.
Employees will refrain from making duplicate copies or shadow files of authoritative data resources.
Temporary duplicate copies of electronic data created for legitimate reasons must be protected in a like manner to the authoritative data, and removed in a timely manner.
Standards for storing electronic data containing sensitive data will be created and periodically reviewed.
Data no longer needed for routine operations, but which must be retained, will be archived in a timely manner.
Data Backups
All backups preserve existing in-data encryption and encryption at-rest. Backups occur at regular intervals consistent with data classification standards applicable to the data being backed-up.
Data center location(s)
United Kingdom
Data hosting details
We use a kubernetes cluster in London which is hosted by DigitalOcean
Data hosting company
DigitalOcean
App/service has sub-processors
no
App/service uses large language models (LLM)
no