Data Retention Policy

1. Introduction

1.1 Purpose of this Policy

This Data Retention Policy explains how Privi retains, manages and securely disposes of information collected during the operation of the Membership service.

Privi is committed to retaining personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, comply with legal obligations and protect the legitimate interests of Members, participating Businesses and Privi.

This Policy should be read alongside the Privi Privacy Policy.

1.2 Scope

This Policy applies to all personal information and business information processed by Privi in connection with:

• Membership accounts;
• Business Partner accounts;
• the Privi website;
• the Privi mobile application;
• customer support;
• payment administration;
• operational records.

2. Retention Principles

Privi follows the following principles when retaining information:

• information will only be retained where there is a legitimate business or legal reason to do so;
• information will not be retained indefinitely without justification;
• information will be securely deleted or anonymised when no longer required;
• access to retained information will be restricted to authorised personnel;
• retention periods will be reviewed periodically to ensure continued compliance with applicable legislation.

3. Types of Information Retained

Depending upon the services used, Privi may retain information including:

• Member account information;
• Business Partner information;
• Membership records;
• subscription records;
• payment records;
• customer support communications;
• technical logs;
• security records;
• fraud prevention records;
• website administration records;
• operational audit records.

Privi does not retain information that is unnecessary for the operation of the Membership service.

4. Membership Information

Member account information may be retained for as long as reasonably necessary to:

• provide Membership services;
• administer subscriptions;
• manage Member accounts;
• comply with legal obligations;
• investigate disputes;
• prevent fraud.

Where a Membership ends, certain records may continue to be retained where legally or operationally necessary.

5. Payment Information

Privi does not retain full payment card details.

Payment providers retain payment information in accordance with their own legal and regulatory obligations.

Privi may retain limited payment-related records necessary to:

• confirm payments;
• administer subscriptions;
• process refunds;
• maintain financial records;
• comply with accounting and taxation requirements.

6. Business Partner Information

Business information may be retained for as long as reasonably necessary to:

• administer Business Partner relationships;
• maintain operational records;
• investigate complaints;
• comply with legal obligations;
• resolve disputes.

Where a Business leaves the Platform, certain historical records may continue to be retained where appropriate.

7. Customer Support Records

Communications with Members and Businesses may be retained for purposes including:

• responding to enquiries;
• investigating complaints;
• improving customer service;
• protecting Privi against legal claims;
• maintaining operational records.

Support records will not be retained longer than reasonably necessary.

8. Technical and Security Information

Privi may retain technical and security records relating to:

• system access;
• login activity;
• security monitoring;
• fraud prevention;
• software errors;
• operational diagnostics.

Such records assist Privi in maintaining the security, integrity and reliability of the Platform.

9. Fraud Prevention

Where fraud or misuse is suspected, Privi may retain relevant information for longer where reasonably necessary to:

• investigate suspected misconduct;
• prevent repeated abuse;
• comply with legal obligations;
• establish, exercise or defend legal claims.

Retention in these circumstances will be limited to what is reasonably necessary.

10. Legal and Regulatory Requirements

Certain records may need to be retained in order to comply with:

• taxation legislation;
• accounting obligations;
• consumer protection legislation;
• data protection legislation;
• court orders;
• lawful requests from regulatory or public authorities.

Where legal obligations require longer retention periods, those obligations take precedence over standard operational retention periods.

11. Deletion of Information

When information is no longer required, Privi will take reasonable steps to ensure that it is:

• securely deleted;
• permanently erased where appropriate;
• anonymised where continued statistical use is beneficial and lawful.

Deletion methods will be appropriate to the nature of the information being removed.

12. Member Requests

Members may request the deletion of their personal information where applicable under data protection legislation.

Privi will consider each request in accordance with:

• applicable law;
• the Privacy Policy;
• legitimate business requirements;
• legal obligations requiring continued retention.

Where information cannot be deleted immediately, Privi will explain the reasons where appropriate.

13. Security of Retained Information

Information retained by Privi is protected through appropriate technical and organisational measures.

These may include:

• restricted administrative access;
• encrypted storage where appropriate;
• secure backup procedures;
• authentication controls;
• system monitoring;
• security updates.

Access to retained information is limited to authorised individuals who require access for legitimate business purposes.

14. Review of Retention Practices

Privi will periodically review its retention practices to ensure they remain:

• appropriate;
• proportionate;
• legally compliant;
• operationally necessary.

Where improvements are identified, this Policy may be updated accordingly.

15. Changes to this Policy

Privi may amend this Data Retention Policy from time to time to reflect:

• changes in legislation;
• operational improvements;
• developments in technology;
• changes to business practices.

The latest version will always be published on the official Privi website where applicable.