Data Retention Policy
This is a version 1.0 draft prepared for review. It reflects our verified technical and data-protection practices but is pending final management and legal approval. Some sections contain items still under management or legal review and should not be relied upon as final policy.
This policy describes how long EDUMOVIA keeps different categories of personal data and the principles used to determine retention periods.
Effective date: 31 August 2026 · Version v1.0
Our approach
We keep personal data only for as long as necessary for the purpose it was collected for, and for any period required by applicable legal, accounting or dispute-resolution obligations. Retention is applied per data category under a defined retention standard and enforced through a tenant-scoped, auditable retention mechanism; when data is no longer needed it is deleted or anonymised, and each deletion is tenant-isolated and recorded in the audit log. Deletion never crosses tenant boundaries.
Active operational records
Where EDUMOVIA processes student and application records on behalf of a tenant, those records are retained for the lifetime of the tenant’s contract and service, under the tenant’s instructions and the Data Processing Addendum. The tenant, as controller, may set a shorter period consistent with its own legal obligations.
After a tenant contract ends
Operational personal data belonging to a terminated tenant is deleted or anonymised within 90 days of contract termination, except records that are under a legal hold or that must be retained to meet a statutory obligation.
Website enquiries
Contact, demo-request and quote-request submissions made through this website are retained only for as long as needed to handle the enquiry and reasonable follow-up, and are then deleted or anonymised.
Security and technical logs
Security and technical logs are retained for 12 months and then deleted, and are minimised so that they do not contain unnecessary personal data.
Audit and dispute records
Audit and dispute records are retained for 24 months, or for a longer period where a specific legal or dispute-resolution obligation requires it.
Integration credentials
OAuth tokens, refresh tokens and provider secrets are deleted or revoked immediately when an integration is disconnected; they are not subject to the general operational retention window. Any message history exchanged through an integration remains governed by its own retention category above.
Accounting and legally required records
Invoices and other records that applicable law requires us to keep are retained for the relevant statutory period, independently of the operational retention windows above.
Backups
Residual copies held in encrypted backups are cleared through the normal backup-rotation cycle, no later than approximately 90 days after the data is removed from live systems.
Certain items marked [MANAGEMENT INPUT REQUIRED] in the text (supervisory authority contact details, data protection / privacy officer, and jurisdiction-specific legal points) are being finalized by EDUMOVIA management and legal counsel and will be updated in a subsequent revision.
For questions about our legal and data protection practices, please contact us.
Contact us