Legal document · v1.0
Data Retention & Deletion Schedule
Exactly how long each category of data is kept, why, and what happens when the period ends.
Not yet in force
This document is published for review and does not yet bind anyone. It commences on the date the Khepee lending service goes live with a licensed partner institution, and that date will be recorded here when it is set.
In plain language
This summary is provided to help you understand the document. It is not a substitute for the formal text below, which governs.
- Borrower records: five years after your loan closes.
- Audit records: the life of the relationship plus the statutory period, and they cannot be deleted.
- Technical logs: a short operational period only.
- Nothing is kept indefinitely simply because deleting it is inconvenient.
1Principles
1.1
Defined periods
Every category of data has a defined retention period. "Until we get round to it" is not a retention policy.
1.2
Driven by obligation
Periods are set by statutory, anti-money-laundering and evidential requirements, not by what might one day be useful.
1.3
Minimisation
We do not collect data we do not need, which is the most effective retention control available.
1.4
The controller decides
For borrower data the partner institution is the controller and may specify a longer period where its own obligations require it.
1.5
Deletion means deletion
At the end of a period data is deleted or irreversibly anonymised, not merely hidden from an interface.
2The schedule
2.1
Borrower profile and identity data — 5 years after closure
Name, date of birth, contact details, address, identity document details and images. Retained for five years after the loan closes, consistent with anti-money-laundering record-keeping expectations.
2.2
Verification records — 5 years after closure
The verification decision, reviewer, reason and automated check result, retained with the borrower record.
2.3
Unsuccessful applications — as required to evidence the decision
Retained for the period the institution must be able to evidence its decision, then deleted or anonymised.
2.4
Loan and repayment records — 5 years after closure
Application, decision, schedule, repayments and settlement.
2.5
Audit trail — relationship plus statutory period
Append-only and not deletable during the retention period. Personal values within it are stored as hashes rather than in clear.
2.6
Correspondence — 3 years
Messages between you and us, retained to evidence what was said.
2.7
Grievance records — 5 years
Complaints, investigations and outcomes, retained to evidence handling and to identify patterns.
2.8
Security logs — 12 months
Authentication events, access records and security telemetry.
2.9
Technical and diagnostic logs — 30 days
Application logs used for fault diagnosis, redacted of personal data before writing.
2.10
Backups — 35 days rolling
Operational backups. Deletion of a record propagates through the backup cycle rather than instantly.
2.11
Marketing contacts — until withdrawal plus 12 months
Where you have consented to hear from us, until you withdraw consent and for a short period after, to evidence the withdrawal.
2.12
Anonymised aggregates — indefinite
Statistics from which no individual can be identified may be retained indefinitely.
3Exceptions and mechanics
3.1
Legal hold
Where data is relevant to a dispute, investigation or regulatory enquiry, retention is extended until the matter concludes.
3.2
Erasure requests
We honour deletion requests to the extent retention obligations allow. We will tell you specifically what we cannot delete and why, rather than refusing generally.
3.3
The audit trail cannot be edited
Because it is append-only, a deletion request cannot remove audit entries. Personal values in the trail are hashes, so the trail does not itself hold readable personal data.
3.4
Backups
Deleted data may persist in backups until the rolling window expires. Backups are not used to restore individual deleted records.
3.5
On partner termination
Institution data is returned in structured form and deleted from our systems after the period in the service agreement, subject to any retention we are independently required to observe.
3.6
Questions
data@khepee.com for a request; privacy@khepee.com for a question about this schedule.