Data & Document Retention Policy
Proposed version: 1.0 — Final effective date to be set upon legal approval.
1. Principle
Eb3at retains data only for as long as necessary for a legitimate purpose, or as required by law, contract, dispute, investigation, or other applicable obligation. When the purpose ends, data is securely deleted, masked, or archived as appropriate.
2. Operational Retention Schedule
| Data Category | Purpose | Proposed Operational Retention | Action After Purpose Ends |
|---|---|---|---|
| Account Data | Account management | While the account is active plus required statutory period | Secure deletion or masking |
| Shipment Data | Execution, tracking, disputes | Operational need plus any legally required period | Secure archive or deletion |
| COD and Financial Records | Accounting and settlements | As required by financial/accounting obligations | Secure archive or destruction |
| Identity and Licences | Verification and eligibility | Shortest period necessary, subject to legal obligations | Secure deletion or masking where permitted |
| GPS | Operations and tracking | Shortest period necessary for the purpose | Deletion or data minimization |
| Audit Logs | Security and investigations | According to security, investigation, and compliance needs | Controlled archive or deletion |
3. Exceptions
Where a dispute, investigation, audit, legal order, or other lawful requirement requires continued retention, deletion may be suspended for relevant records until the retention reason ends.
4. Secure Disposal
Removal of sensitive documents from operational storage must follow a controlled process. Backups are subject to their own retention and disposal cycle.
5. Review
Retention periods should be reviewed periodically and updated after legal, operational, and accounting review when necessary.