Data retention and deletion
Updated last month
This is Gratona’s standard retention and deletion schedule for customer personal data. It applies when incorporated into an accepted Data Processing Addendum; any expressly agreed customer-specific schedule takes precedence.
When your subscription ends
Export access: 30 calendar days after the services end, unless a longer period is agreed in writing.
Active customer data: deletion within 30 calendar days after return is completed or an authorised deletion instruction becomes effective.
Residual backups: expiry within 90 calendar days after active-data deletion.
You may request deletion sooner. If you have not chosen return or deletion by the end of the export period, we will give you a further 15 calendar days to provide instructions before treating the absence of instructions as an instruction to delete. This does not extend the hosted-service entitlement.
What deletion covers
Deletion covers the customer records and associated content within the agreed service scope, including files, attachments and copies in active application stores. Deletion instructions are propagated to relevant subprocessors. Customer-controlled exports and independently connected services remain under your control.
Backups
Residual backup copies remain access-restricted and protected until expiry. They are not used for ordinary service delivery or other business purposes. If a backup is restored for disaster recovery, applicable deletion instructions are reapplied.
Records retained for specific obligations
We may retain information where required by applicable law. We restrict that information to the required purpose and delete it when the obligation ends. Our own billing, tax and necessary security records follow separate, purpose-limited retention rules under the Privacy Policy; this does not permit retaining your donor or beneficiary records indefinitely.
Requests and confirmation
Contact [email protected] to request return or deletion, discuss an export extension, or obtain confirmation of completed deletion. We verify the requester’s authority before acting.