Data retention and deletion
Planned storage periods, deletion procedures, and legally required exceptions.
- Version
- 2026-09-04
- Status
- Not approved for public launch
1. Principle
We retain data only for as long as needed for the stated purpose, then delete or irreversibly anonymise it unless law requires longer storage. The periods below are the operating policy to be approved before registration opens.
2. Retention schedule
| Category | Planned period |
|---|---|
| Active session and necessary cookie | 14 days from creation; signing out removes the current session |
| Email-verification token | 24 hours; deleted after use |
| Password-reset token | 1 hour; deleted after use |
| Account, organisation, Company Passport, evidence, alerts, and analyses | for the agreement term; planned removal from active systems within 30 days after a valid request or service termination |
| Uploaded documents and extracted text | until deleted by an authorised user or with the organisation; document deletion from the active system is immediate |
| Security and audit logs | 12 months, unless a specific record is needed longer for an incident investigation or legal claim |
| Billing and tax records | for the period required by tax and accounting law, calculated from the end of the relevant year |
| Correspondence and claims | until the matter is closed, then until the applicable limitation period expires |
| Backups | 14-day rolling window; deleted data disappears as backups are overwritten unless a backup is preserved for an incident |
3. Deleting a document
An authorised user can delete a document from the Company Passport. TenderHunter removes the encrypted object and extracted pages; evidence previously supported by that file loses verified status and becomes declared. A record of the deletion itself remains in the audit log for the security period.
4. Deleting an account or organisation
The current version does not provide a self-service button for deleting an entire organisation. The organisation owner may submit a request to privacy@juralex.eu. Before deletion, we will verify identity and scope, identify any records we must still retain by law, and arrange an export if needed.
5. Backups and restoration
Backup access is restricted to operational work. We do not restore deleted data to ordinary use. If a disaster recovery restores a record pending deletion, we will reapply the deletion request before returning the system to service.
6. Submit a request
Write to privacy@juralex.eu from the address associated with the account. We will respond without undue delay, generally within one month, as required by the GDPR.
This document reflects the current product architecture, but requires approval by Polish counsel together with processor agreements, rights-request operations, and the retention schedule.