Data Retention & Deletion Policy
Corporate guidelines specifying retention schedules by data category, statutory log preservation mandates, and secure purging mechanisms.
1. Purpose & Scope
This Data Retention & Deletion Policy establishes the operational retention schedules and secure destruction standards applied to data processed by Arzenlabs ("Arzenlabs").
Arzenlabs balances data minimization principles under the DPDP Act 2023 with mandatory statutory retention mandates imposed by cyber security directives and tax regulations.
2. Category-Specific Retention Schedule
| Data Category | Examples of Records Included | Retention Period | Governing Justification |
|---|---|---|---|
| Account & Contact Records | User name, email, phone, business profile | Duration of active account + 180 days | Contract performance & support |
| Security & Audit Logs | IP access logs, firewall connection logs, auth events | 180 Days | CERT-In Cyber Security Directions |
| Financial & Transaction Records | Invoices, payment receipts, tax statements | 8 Years | Indian Income Tax Act & Companies Regulations |
| Support & Correspondence | Email tickets, technical feedback, consultation notes | 3 Years | Service quality & legal dispute defense |
| Verification / KYC Records | Business registration certificates, authorized rep IDs | 5 Years post-relationship termination | Anti-fraud & statutory compliance |
3. Secure Erasure & Purging Standards
Upon expiration of the applicable retention period (or upon a verified data erasure request under the DPDP Act 2023), Arzenlabs executes secure data destruction protocols:
- Database Records: Hard deletion from active relational database tables and removal from index caches.
- Encrypted Backups: Purged during rolling backup overwrite cycles within 30 days.
- Cryptographic Erasure: Destruction of encryption keys for dedicated encrypted volumes.
4. Requesting Data Erasure
To submit a formal request for personal data deletion, contact our privacy desk:
Arzenlabs seeks to comply with applicable data protection and privacy laws including the Digital Personal Data Protection Act (DPDP) 2023, Information Technology Act 2000, and applicable international privacy principles.