Data Retention and Deletion Schedule
- Document ID
- LEG-022
- Version
- 0.1
- Effective date
- Last updated
Use your browser's print or save-as-PDF to keep a copy.
Data Retention and Deletion Schedule
This Schedule states the default retention and deletion position of Virtik USA, Inc. It is part of the Agreement as to retention and deletion (Section 1.2 of the Terms), and the Terms (Sections 10.7 and 16.18) and the DPA (Section 13) refer to it. It supplements the Privacy Policy (LEG-002), the DPA (LEG-010) and the Cookie Policy (LEG-003). Capitalized terms not defined here have the meanings given in the Terms (LEG-001).
This Schedule applies to Customers and to visitors and users whose data Virtik holds as controller. It does not fix a retention or deletion period, and it does not describe an automated deletion process. Where it says that Virtik states no period, no period is promised. A statement about the website describes how the website behaves.
1. The two retention regimes, which are not the same
This distinction governs the whole document.
1.1 Customer-controlled data — the customer sets the period
Camera and video data, audio, still images, detections and detection metadata, alerts, spatial models and Virtual Sites, personnel and patrol records, geolocation, communications content and incident records inside a customer's Organization.
Virtik does not set a retention period for this data. The customer decides, by how it configures and uses the Service. Virtik is a processor for this data. Where a customer configures a long retention, that is the customer's lawful-basis decision and its accountability, not Virtik's. Where the Service provides no retention setting for a category, this Schedule states no period for it and does not state that the data is deleted automatically.
This Schedule states no configurable range, granularity, default or expiry behaviour for these periods. Retention fields that the Service provides are configurable by the customer and are not an automated purge.
1.2 Virtik-controlled data — Virtik sets the period
Account records, authorized user data, billing and tax records, support correspondence, security telemetry and audit records, consent and acceptance records, privacy request records, and website analytics.
Here Virtik is the controller. This Schedule states no fixed period for these records.
2. Schedule — Virtik as controller
This Schedule states no fixed period for these categories. The purpose column states why each category is kept.
| Data category | Purpose | Retention period | Trigger for deletion |
|---|---|---|---|
| Account records | Provide and secure the account | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Authorized user records | Access control | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Authentication metadata | Account security | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Billing and invoice records | Billing, tax, statutory records | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | Statutory retention period |
| Tax records | Statutory obligation | The period that applicable tax law requires. | As statute requires |
| Support correspondence | Provide support; evidence handling | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Security telemetry and audit records | Detect and investigate abuse | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Device and log data | Operate and secure the service | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Consent and acceptance records | Evidence what was agreed | See Section 4 | See Section 4 |
| Privacy request records | Receive and handle privacy-rights requests, and meet legal, security and recordkeeping obligations | No fixed period is stated. Virtik keeps these records only as long as necessary to handle the request and to meet applicable legal, security or recordkeeping obligations. This Schedule describes no automated deletion process for them; deleted data may persist in backups until they expire. | When neither purpose applies (Section 3) |
| Abuse-prevention identifiers | Rate limiting, fraud prevention | Held as a keyed hash. No retention period is stated | Not stated |
| Recruitment records | Assess an application | No fixed period is stated. Virtik keeps the record for as long as needed for the purpose in the second column and then deletes or de-identifies it (Section 3); deleted data may persist in backups until they expire. | When the purpose in the second column ends (Section 3) |
| Website consent decision | Evidence a cookie choice | Until cleared or withdrawn | User clears site data |
NEXT_LOCALE cookie | Remember a language preference | One year (a maximum age of 31,536,000 seconds, restarted each time the cookie is set) | When the cookie expires, or when the visitor deletes it |
Two rows carry stated values, which describe how the website behaves: the website consent decision persists in local storage until the user clears it or withdraws consent, and the language cookie is kept for one year. The abuse-prevention identifier row states the form of the identifier and states no period and no trigger for deletion, because enforcement of a stated period has not been verified.
3. Deletion mechanics, and why backups govern the promise
3.1 Deletion means the record is removed from the production system, or de-identified so it can no longer be attributed to a person without additional information.
3.2 This Schedule does not state whether, how often or for how long backups of the Service's databases are kept, and no backup frequency, retention or restoration objective is committed. Deleted data may persist in any backup until it expires, and this Schedule states no deletion period that backups would contradict.
3.3 This Schedule therefore states no period for the removal of data from backups.
3.4 Deletion is subject to legal holds: retention required by law, and preservation of evidence for the establishment, exercise or defence of legal claims. Virtik may suspend deletion for the affected records while a legal hold applies.
3.5 De-identification is not deletion where re-identification remains possible. Aggregate statistics derived under Terms (LEG-001) Section 10.5 may be kept without a fixed period only because they identify no one and cannot be re-identified.
4. Records that must outlive the relationship
Stated separately because deleting these records on account closure would destroy evidence of what was agreed and of how a request was handled.
| Record | Why it must persist | Period |
|---|---|---|
| Contractual acceptance records | Prove which version was agreed, by whom, when | No fixed period is stated. Virtik keeps the record for as long as it needs it to evidence what was agreed or how a request was handled, and may then delete or de-identify it by a manual administrative step (Section 3); deleted data may persist in backups until they expire. |
| SMS consent and withdrawal records | Prove consent existed and when it ended | No fixed period is stated. Virtik keeps the record for as long as it needs it to evidence what was agreed or how a request was handled, and may then delete or de-identify it by a manual administrative step (Section 3); deleted data may persist in backups until they expire. |
| Marketing consent records | Prove the basis for contact | No fixed period is stated. Virtik keeps the record for as long as it needs it to evidence what was agreed or how a request was handled, and may then delete or de-identify it by a manual administrative step (Section 3); deleted data may persist in backups until they expire. |
| Privacy request records and correspondence | Show how the request was received and handled | No fixed period is stated. Virtik keeps these records only as long as necessary to handle the request and to meet applicable legal, security or recordkeeping obligations, and may then delete or de-identify them by a manual administrative step (Section 3); deleted data may persist in backups until they expire. |
| Text that an acceptance record references | Prove which text was agreed | No fixed period is stated. Virtik keeps the text of each published version that an acceptance record references in its legal records for as long as it needs that acceptance record (Section 4.2). |
4.1 Where Virtik keeps a consent record, it keeps the record of a withdrawal as well as the record of the consent. Deleting the record of a withdrawal would leave Virtik unable to show that it stopped.
4.2 An acceptance record references a content hash, so it remains meaningful only while the text it points to can still be produced. That is why Virtik keeps the text that an acceptance record points to in its legal records for as long as it needs the acceptance record.
5. Customer-controlled data at termination
5.1 On expiry or termination, Customer Data is available for export for the period stated in the governing agreement — 30 days under Section 10.7 of the Terms and Section 5.6 of LEG-011.
5.2 After the export period, Virtik deletes or de-identifies Customer Data in accordance with the DPA, subject to legal holds. This Schedule does not describe an automated process for that deletion.
5.3 Virtik states no interval between the end of the export period and completed deletion, including backup expiry.
5.4 On the customer's written request, once Virtik has deleted or de-identified Customer Data in accordance with the DPA, Virtik will confirm that in writing, per DPA §13.4. The confirmation is a manual act and is not a certification of completeness: it does not state that no copy remains in backups, in which deleted data may persist until they expire, and no backup-expiry period is stated. Where the Standard Contractual Clauses apply, Section 13.4 of the DPA provides the certification that Clause 8.5 requires.
6. Changes
6.1 Virtik may update this Schedule by posting a new version with a version number and effective date and keeping prior versions available as Section 25.1 of the Terms provides. A modification that materially and adversely affects Customer's rights takes effect as Section 25.2 of the Terms provides.
Language. This Schedule is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.
Version history
| Version | Date | Status | Change summary |
|---|---|---|---|
| 0.1 | 10 September 2026 | draft | Structure drafted. Two verified values recorded; every other period unstated. Backup tail identified as the gating dependency for any published deletion promise; document remains blocked on system_inventory. |
| 0.1 (revised) | 3 October 2026 | draft | Finalization pass: NEXT_LOCALE row states the session-cookie duration; the privacy request row no longer uses the response-deadline variable; reviewer wording made neutral. Retention periods and backup facts remain open. |
| 0.1 (round 3 revision) | 3 October 2026 | draft | Round 3: the 30-day abuse-prevention retention is no longer stated (the implementation declares it but does not enforce it); the deletion promise is a written confirmation on request, as a manual act, not a certification. Retention periods and backup facts remain open. |
| 0.1 (round 5 revision) | 3 October 2026 | draft | Round 5: the Trigger column no longer states account-closure, ticket-closure or rolling-window deletion events that the Service does not run: each Virtik-controlled row (other than the tax, billing and website rows) states that deletion follows when the purpose in the second column ends (Section 3), and the abuse-prevention identifier row states no trigger; Section 5.1 cites Terms 10.7 as well as LEG-011 5.6. |
| 0.1 (round 6 revision) | 3 October 2026 | final | Round 6: customer-facing instrument. Purpose and scope statement added before Section 1; internal framing removed from the Section 1 and Section 4 introductions and Section 4.1; Section 1.1 states that the customer decides by configuration and use and that no period is stated where no setting exists; Section 3.2 no longer states that backups are kept; Section 3.4 no longer states that a legal hold is recorded; Section 3.5 and the archive row of Section 4 no longer state an indefinite or append-only position; Section 5.2 states that no automated deletion process is described. |
| 0.1 (factual corrections) | 26 October 2026 | final | Factual corrections before publication, on the Owner's decision of 26 October 2026: the text was aligned with what the website actually does. |
END OF DOCUMENT