Retention periods
Storage limitation (Article 5(1)(e) GDPR) only works if the periods are concrete. This is what PrivaSearch does; as a client, you set the period per project yourself.
| Data | Period | What happens afterwards |
|---|---|---|
| Documents in a project: original, extracted text, search fragments and pseudonyms | The retention period the client sets per project | Access is blocked and the data is deleted automatically every day, unless a legal hold has been recorded for that project |
| A document that a staff member deletes | Immediately | The original, the fragments and the pseudonyms that occurred only in that document are erased. The activity log keeps a record that the document existed and who deleted it — without content |
| Activity log (access, searches, approvals, reveals, refusals) | For as long as the client's environment exists | The log exists for the accountability obligation (Article 5(2) GDPR) and contains no document content and no search queries. The entries in the activity log remain when a document is deleted. A configurable period per organisation is in development |
| Trusted devices | Thirty days | After that, a code by email is needed again; revoking is always possible earlier |
| Tokens for the connection with an AI assistant | Access token eight hours, refresh token thirty days | After that they expire; they can be revoked at any time in the settings |
| Results of the AI literacy training | For as long as the user account exists | Needed to be able to demonstrate the AI literacy obligation (Article 4 AI Act). When the account is deleted, they go with it |
| A user's profile photo | Until the user or an administrator of the organisation deletes or replaces it | Optional. When it is replaced or deleted, the file is erased immediately. When the agreement ends, the photo follows the client's environment |
| Demo requests via this website | 12 months after the request | Deleted automatically. See the privacy statement |
| Sign-ups for the referral programme, with their referrals | 12 months after the last activity | Deleted automatically, earlier on request. See the rules of the programme (Dutch) |
PrivaSearch sends a message by email to whoever manages a project 30 and 7 days before the end date of that project. The clean-up itself does not change as a result.
If a statutory retention obligation applies to a client file — for example the tax retention obligation of seven years (Article 52 of the Dutch General Tax Act (Algemene wet inzake rijksbelastingen)) or the twenty years under the WGBO (the Dutch Medical Treatment Contracts Act) in healthcare — the client records that as a legal hold on the project. PrivaSearch then does not clear up that project and shows in the overview why not.
When the agreement ends, we delete the client's environment or return the data, at the client's choice and within the period set out in the data processing agreement.
This page was translated from Dutch with the help of AI. In case of differences, the Dutch version applies. Read the Dutch version
