Data retention policy

We keep personal data for no longer than is necessary for the purposes for which it is processed. For each category of data, we set a retention period based on the purpose of processing, legal requirements and the limitation period for claims. Once the retention period has expired, we delete the data or anonymise it irreversibly.

We set the retention period based on four criteria: the time necessary to achieve the purpose, obligations arising from legal provisions, including tax and accounting rules, the limitation period for potential claims, and the terms of the consent given, where consent is the legal basis for processing. Where more than one criterion applies, we adopt the period resulting from the longest applicable criterion, to the extent this is justified.

We keep data from inquiries that did not result in a contract for up to 24 months from the last contact. We keep data related to a concluded contract for the duration of the contract and for the limitation period for claims, which as a general rule is 3 years for claims related to business activity and claims for periodic performance, and up to 6 years for other claims. We keep accounting and tax documentation for the period required by law, as a general rule 5 years counted from the end of the year in which the tax payment deadline fell.

We keep candidate data for the duration of the recruitment process, and in the talent pool for the period indicated in the consent, not longer than 24 months. We keep data processed on the basis of marketing consent until that consent is withdrawn. We keep logs and security data for the period necessary for the security of the site. We keep evidence of consent for the period during which it may be needed to demonstrate compliance.

Once the retention period has expired, we permanently delete the data or anonymise it, so that it can no longer be attributed to a person. We use anonymisation in particular where aggregated data remains useful for statistical purposes without the need to retain identifying data.

Processors handling data on our instructions are obliged, under processing agreements compliant with Article 28 GDPR, to delete or return the data after the provision of services ends and to observe the agreed retention periods, unless further storage is required by law.

We subject retention periods to periodic reviews and update them in the event of changes to the purposes of processing or the law. We delete data for which further storage no longer has a basis as part of these reviews.

Regardless of the retention periods set, you have the rights described in the Privacy Notice, including the right to request erasure of data and the right to object. We assess a request for erasure taking into account any legal obligations requiring the continued storage of specific data.