Data Retention Policy
Last updated: October 17, 2024
This Data Retention Policy describes how xuzolae ("we", "us", or "our") collects, retains, and disposes of data in connection with the services available at xuzolae.com. By using our services, you acknowledge the practices described in this policy.
1. Purpose
We retain data only for as long as necessary to fulfil the purposes for which it was collected, to provide and improve our services, to comply with applicable legal obligations, to resolve disputes, and to enforce our agreements. This policy establishes clear standards for how long different categories of data are kept and how they are securely removed when no longer needed.
2. Scope
This policy applies to all personal and non-personal data processed by xuzolae, including data collected through our website, platform, communications, and any related services. It applies to all staff, contractors, and third-party processors who handle data on our behalf.
3. Categories of Data and Retention Periods
The table below outlines the primary categories of data we process and the standard retention period applied to each.
| Data Category | Examples | Retention Period | Basis for Retention |
|---|---|---|---|
| Account and registration data | Name, email address, password hash, account preferences | Duration of account plus 2 years after closure | Contractual obligation, legitimate interest |
| Learning and session data | Course progress, session attendance, assessment results | Duration of account plus 3 years after closure | Service delivery, legitimate interest |
| Payment and billing records | Transaction history, invoice data, payment method references | 7 years from date of transaction | Legal and financial compliance |
| Communication records | Support tickets, emails, chat logs | 3 years from last interaction | Legitimate interest, dispute resolution |
| Usage and technical data | Log files, IP addresses, browser type, session identifiers | 12 months from collection | Security, fraud prevention, service improvement |
| Marketing and consent records | Email opt-in records, preference history | Until consent is withdrawn plus 2 years | Legal compliance, proof of consent |
| Cookies and tracking data | Analytics cookies, session cookies, functional cookies | As defined in our Cookie Policy, typically 1–13 months | User consent, legitimate interest |
| Backup and archive data | System backups containing any of the above | Up to 12 months from backup creation | Business continuity, disaster recovery |
4. Retention Principles
4.1 Minimum Necessary Retention
We do not retain data beyond the period required for its stated purpose. When a retention period expires, data is either securely deleted, anonymised, or aggregated so that it can no longer be linked to any individual.
4.2 Legal Hold
Where data is subject to a legal hold, regulatory investigation, or active dispute, standard retention periods are suspended until the matter is resolved. Data under legal hold is isolated and access is restricted to authorised personnel only.
4.3 Anonymisation as an Alternative to Deletion
In some cases, instead of deleting data, we may anonymise it so that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for statistical, research, or service improvement purposes and is no longer subject to this policy.
5. Data Deletion Procedures
5.1 Automated Deletion
Where technically feasible, deletion of data that has reached the end of its retention period is carried out automatically through scheduled processes. These processes are reviewed and audited on a regular basis to ensure they operate correctly.
5.2 Manual Deletion Requests
Users may request deletion of their personal data at any time by contacting us at support@xuzolae.com. We will process such requests within 30 days, subject to any legal obligations that require us to retain certain data beyond the requested deletion date. We will communicate any such limitations clearly.
5.3 Secure Disposal
All data deletion is carried out using methods appropriate to the sensitivity of the data and the medium on which it is stored. Electronic data is overwritten or cryptographically erased. Physical media containing personal data is destroyed in a manner that prevents reconstruction.
6. Third-Party Processors
Where we share data with third-party service providers and processors, we require them to adhere to retention standards consistent with this policy. Contractual agreements with processors include obligations regarding data retention, deletion, and return of data upon termination of the relationship.
A list of our current third-party processors is available upon request by contacting support@xuzolae.com.
7. User Rights Regarding Retained Data
Subject to applicable law, you have the right to:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your personal data, subject to legal retention requirements |
| Restriction | Request that we limit the processing of your data in certain circumstances |
| Portability | Request your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interest |
To exercise any of these rights, please contact us at support@xuzolae.com or write to us at Painestown, Castletown Kilpatrick, Co. Meath, C15 YA6H, Ireland.
8. Security of Retained Data
All data retained by xuzolae is protected by appropriate technical and organisational security measures. These include access controls, encryption at rest and in transit, audit logging, and regular security assessments. Access to retained data is restricted to personnel who require it for legitimate operational purposes.
9. Retention Review
This policy and the retention periods specified within it are reviewed at least once per year or whenever there is a material change to our services, legal obligations, or data processing activities. Any changes to retention periods will be reflected in an updated version of this policy, and users will be notified where required.
10. Contact
If you have any questions or concerns about this Data Retention Policy or how your data is handled, please contact us using the details below.
Email: support@xuzolae.com
Phone: +353 65 707 4403
Address: Painestown, Castletown Kilpatrick, Co. Meath, C15 YA6H,
Ireland
Website: xuzolae.com