Data Retention Policy

‍Effective Date: 01-01-2023
Last Updated: 28-11-2025
Company: SEINō B.V., Randstad 22-15, 1316 BN Almere, The Netherlands
Contact: legal@seino.ai

1. Purpose

This Data Retention Policy ensures that SEINō stores personal and business data only for as long as necessary to meet legal, contractual, and operational requirements. It supports compliance with the GDPR’s principles of storage limitation and data minimization.

2. Scope

Applies to:

All customer, partner, and employee data processed by SEINō.
All systems, integrations, and storage locations where SEINō data resides.
All employees, contractors, and subprocessors acting on behalf of SEINō.

3. Key Principles

Business Purpose Limitation: Data is retained only as long as required to provide contracted services or meet legal obligations.
Defined Retention Periods: Each category of data has a documented maximum retention period.
Minimal Storage: Only the minimum required data is retained.
Secure Disposal: Once retention expires, data is securely deleted, anonymized, or returned to the client.
Client Instruction: Where SEINō acts as a processor, retention follows the instructions of the client.

4. Retention Periods (Guidelines)

Customer Data (Platform Data): Customer Data will be available for export for 30 days after termination (see GTC §13). Data will then be securely deleted or anonymized within 90 days of termination unless retention is required by law.
System Logs / Audit Trails: Retained for 12 months for security and compliance purposes, then deleted or anonymized.
Support Tickets & Communications: Retained for 24 months for customer service history, unless deletion is requested earlier.
Marketing & Prospect Data: Retained up to 24 months after last interaction, unless consent is withdrawn sooner.
Employee Data: Retained according to Dutch labor and tax laws (up to 7 years for payroll records).
Backup Data: Encrypted backups are kept for up to 30 days, after which they are overwritten.

5. Secure Disposal

Data that reaches the end of its retention period will be securely erased using industry-standard deletion or anonymization methods.
Hardware and electronic media used to store personal data will be securely destroyed or wiped before disposal or reuse.

6. Roles & Responsibilities

Management: Approves and enforces this policy.
Information Security Officer (ISO): Ensures secure deletion and periodic audits.
Employees: Must comply with retention rules and not store personal data outside approved systems.
Vendors/Subprocessors: Must follow SEINō’s retention instructions and provide proof of secure deletion.

7. Exceptions

If data must be retained longer due to ongoing legal proceedings, regulatory obligations, or explicit client instructions, the retention period may be extended. Such exceptions must be documented.

8. Policy Review

This policy is reviewed annually or after major business/regulatory changes.