The following are the general information retention and deletion periods applicable to this website. Applicable legal requirements take precedence where they require otherwise.
1. Inquiry records for prospects who do not become clients
Inquiry emails and related correspondence: retain for 24 months after the last substantive contact, then securely delete or anonymize.
2. Ordinary website security logs
Retain for 90 days, then rotate or delete. Limit fields to what is needed for troubleshooting and abuse prevention, such as timestamp, request path, status code, and necessary IP information. Do not log email contents, passwords, or access tokens.
3. Logs relating to a security incident
Retain for 24 months after the incident is closed, unless a separate legal retention requirement applies.
4. Records of a security breach
Retain for at least 24 months after the breach is confirmed, and manage them in accordance with applicable law and security-incident procedures.
5. End-of-period disposal
At the end of the applicable period, authorized personnel must securely delete or anonymize the information. If the law requires retention, restrict access and delete it when the reason for retention ends. Do not retain information indefinitely merely because it may be useful.
6. Service providers and hosting records
Where records are independently retained or managed by website hosting, email, spam-filtering, backup, or platform service providers, the applicable retention period and deletion method may depend on the relevant service settings and applicable law.