Data Retention Policy

Effective Date: 19 September 2026 · Version 2.1
We post changes here with a revised Effective Date; material changes are notified to business account administrators.

1. Introduction

This Data Retention Policy explains how long Delisys Technologies Ltd and its Partners retain data processed through the OPS360 platform, and how it is securely deleted. It supports our Privacy Policy and, for business customers, the Data Processing Agreement.

2. Scope & Jurisdictions

OPS360 serves customers operating in the United Kingdom, India, and the United States. Retention is applied per the law applicable to the customer’s Operating Region: the UK GDPR and Data Protection Act 2018 (UK), CCPA/CPRA and other applicable US state privacy laws (USA), and the Digital Personal Data Protection Act, 2023 (India). (EU/EEA is not offered at this time.) Personal data is not retained for longer than necessary for the purposes for which it is processed.

3. Standard Retention Periods

We retain data only as long as necessary for providing our services, legal/regulatory compliance, business operations, and security. Where legal requirements differ by jurisdiction (UK GDPR & DPA 2018, CCPA/CPRA & US state laws, India DPDP Act 2023), we apply the period required in the region your data is held in — keeping data no longer than that region’s law requires, in line with the data minimisation principle. Where a single record is subject to more than one jurisdiction, the longer period applies to that record.

3.1 Personal and Account Data

• Data Category: Personal & Account Data
• Retention Period: While you use our services + 3 years
• Includes: User profiles, account settings, authentication data, platform usage data, communication and support records.
• Legal Basis: Contractual obligations, legitimate interest.

3.2 Financial Data

• Data Category: Financial Data
• Retention Period: 6 years (UK), 8 years (India), 7 years (USA) — set by the statutory minimum in the region your data is held in
• Includes: Payment records, transaction history, invoices, billing data.
• Legal Requirement: Tax/accounting laws (UK, USA, India).

3.3 E-Signature Data

• Data Category: E-Signature Data
• Retention Period: 7 years
• Includes: Signed documents, audit trails, completion certificates, identity verification records.
• Legal Requirement: To ensure enforceability of electronic contracts.

3.4 Communication Data

• Data Category: Communication Data
• Retention Period: 2 years from last activity
• Includes: In-app chat, WhatsApp messages, voice messages, file sharing, notification history.
• Purpose: Business communication, collaboration, and compliance tracking.

3.5 File Storage

• Data Category: File Storage
• Retention Period: Until user deletion or account closure
• Control: Uploaded documents, files, and media. Business account admins can delete files at any time.

3.6 AI and Analytics Data

• Data Category: AI and Analytics Data
• Retention Period: Up to 12 months
• Notes: Chatbot conversations, AI assistant interactions, usage analytics. Anonymized or aggregated analytics data may be retained longer for service improvement and model performance analysis.

3.7 Audit Logs and Deletion Records

OPS360 maintains secure and immutable audit logs for all data and file deletions to ensure transparency, accountability, and compliance with data protection regulations.

Retention Periods

• Standard Deletion Logs: Retained for 3 years from the date of deletion.
• Financial or Contractual Data: Retained for 7 years to meet tax and regulatory requirements.
• AI Assistant Conversations: Content retained for up to 12 months; associated metadata (session ID, timestamp, user reference) retained for 1 additional year (total 2 years from content creation).

Scope of Logging

Audit records are maintained for:

• File deletions (manual or automated)
• Record or data entry deletions
• Account terminations or deactivations
• AI assistant data purge events
• System-initiated cleanup or expiry actions

Each log entry typically includes:

• User ID or system process initiating the deletion
• Timestamp of the event
• Record, file, or module identifier
• Action type and reason (if applicable)
• Data classification (personal, financial, communication, or AI)

Deletion Scenarios

• Active Account Deletions: Content is permanently removed, but minimal audit logs are retained for 3 years for traceability.
• Account Termination: When a business account is closed, all associated data is deleted per the retention schedule. Audit logs of these actions are retained for 3 years, or 7 years if financial or contractual data are involved.
• Automated Expiry: For chat and AI content that expires automatically, OPS360 retains non-personal audit metadata for 1 year beyond deletion for accountability.

Security and Integrity Controls

• Audit logs are stored in a secure, access-controlled environment separate from production data.
• Entries are immutable, encrypted at rest, and tamper-evident.
• Logs are automatically purged once the retention period expires.
• Audit data is not used for analytics or profiling beyond compliance verification.

3.8 Communication and Chat Deletion Logs

OPS360 retains communication and chat data according to defined schedules to protect privacy while maintaining compliance traceability.

Chat Content Retention

• In-app and WhatsApp messages: Retained for 2 years from last activity.
• AI and chatbot conversations: Retained for up to 12 months, and may be anonymized earlier for analytics or product improvement.

Deletion Handling

• Upon expiry, all chat content (messages, attachments, media) is permanently deleted from live systems and backups as per Section 8.
• Minimal audit metadata (message ID, user IDs, timestamp, action type) is retained for 3 years to support compliance and investigations.
• Audit logs contain no message content or personal communication details and are automatically purged after expiry.

8. Backups, Deletion & In-Region Persistence

Deletion is applied to live systems and to backups on a defined, in-region schedule:

• Live systems: personal data is deleted from active systems within 30 days of a valid deletion (account closure, tenant deletion, or expiry of a retention period).
• Backups: removed from backup systems within 90 days. Until a backup snapshot expires, residual copies of already-deleted data may persist only within time-bounded backup snapshots, after which they are irreversibly purged. This is a standard, lawful, time-bounded consequence of maintaining backups and is disclosed here for transparency.
• In-region only: all backups and snapshots are retained within the customer’s Operating Region (UK data in the UK; India data in India; USA data in the USA once that region is live). OPS360 does not replicate personal data or backups to any out-of-region or paired region.
• Deletion confirmation & logs: deletion is logged immutably (Section 3.7) and confirmation is available to business administrators on request.
• Legal hold: where a legal/regulatory hold or statutory minimum (e.g., financial records, 7 years) applies, that data is retained for the required period notwithstanding a deletion request, then deleted.

9. How to Request Deletion

Who to ask depends on whether the data sits in a business's OPS360 account or is the business account itself.

• If you use OPS360 through an employer or business (a staff account in the web app, the OPS360 Connect app, or the OPS360 POS till): that business controls your records. Ask its OPS360 account administrator, who can remove your access and delete your data in-app. If you cannot reach them, write to privacy@ops360.net and we will pass the request to the business responsible for it.
• If you are the business (tenant owner or administrator): email privacy@ops360.net from the address held on the account to request deletion of the business account and the data associated with it. We verify every request before acting on it.

What to include: the email address or account the request concerns, the business name, and whether you want specific records or the entire account removed.

What happens next: deletion follows the schedule in Section 8, removed from live systems within 30 days and from backups within 90 days. Where a legal or regulatory hold applies, that data is retained for the required period and deleted afterwards. Each deletion is logged immutably and confirmation is available to business administrators on request.

Access, correction, portability and objection are covered in the Privacy Policy. Data protection queries: dpo@ops360.net. India grievance officer: grievance.in@ops360.net.

Related: Privacy Policy · Data Processing Agreement · Sub-processor List

© 2026 Delisys Technologies Ltd and its Partners. All rights reserved.