Deletion concept and retention periods

Passo dopo passo

1. 1

   Understand the deletion runs

   A daily run (03:00) and a weekly run carry out deletions; each run is logged. Jobs run under a lock so that they run exactly once even with several instances.

2. 2

   Look up key periods

   Examples: account after a deletion request 30 days’ grace, then anonymization; soft-deleted posts and messages 30 days; reports 12 months after closing; support requests 12 months; audit log and data-subject requests 3 years; security events 365 days; attendance 36 months; health notes on events 90 days after the end.

3. 3

   Classify data subject rights

   Erasure under Art. 17 happens in the account (Settings → Privacy) with 30 days’ grace; access and portability as an export. Requests concerning an organization’s data are for the organization – the platform forwards within 5 working days.

4. 4

   Deletion hold in legal disputes

   In an ongoing dispute or on official order, audit retention is suspended; this is an operator instruction and is documented.

5. 5

   Register a new feature

   Whoever builds a feature with new personal data adds, in the same piece of work, the deletion concept (row with period), the account deletion, the processing register and key rotation.

Errori comuni e soluzioni

A period in the concept says “to be clarified legally”.

It is marked as open (for example retention of bookings under commercial and tax law); nothing is deleted until clarified.

Inactive accounts are not deleted automatically.

After 3 years there is only a warning; automatic deletion is off by default.

Articoli correlati

• Operator duties: register, deadlines and evidence
• Processing register and data processing agreements