Data Retention Policy

Retention decisions follow the principles of lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.

Personal information is not retained indefinitely or merely because it may be useful later. Every extension must have a current purpose, lawful basis, documented owner, review date, and access boundary.

The schedule is designed around GDPR and UK GDPR storage-limitation, purpose-limitation, data-minimization, accuracy, security, accountability, and erasure principles. These sources do not prescribe one universal retention duration; they require periods that are purpose-based, justified, documented, reviewed, and followed in practice.

The stated periods are maximums. Records are reviewed for continued necessity and may be deleted or anonymized earlier. If information is shown to be inaccurate or misleading, reasonable steps are taken to correct or erase it without delay.

Requests for access, correction, restriction, objection, or erasure may be made verbally or in writing. Identity verification is limited to what is reasonably necessary. Erasure is not absolute, but any refusal or limitation must be tied to an applicable legal basis and explained to the requester.

A retention period may be extended only for an active business relationship or a specific legal obligation, dispute, fraud or abuse investigation, security incident, or establishment, exercise, or defense of legal claims.

An extension must identify the affected records, purpose, legal or operational justification, accountable owner, restricted access group, and next review date. A hold does not authorize unrelated reuse. Records are deleted or anonymized when the hold is released and no other justified purpose remains.

Deletion removes information from active systems and instructs applicable processors to delete their active copies. If immediate removal from a protected backup is not technically possible, the information is placed beyond ordinary use, remains protected, is not restored except for disaster recovery, and expires through the backup cycle.

Anonymization must be irreversible in the circumstances. Pseudonymized or key-coded information remains personal information and continues to follow this schedule.

Service providers are limited to the information and period needed for their assigned purpose. Provider settings and contracts should support deletion, return, or anonymization when processing ends. Where information has been shared, each relevant copy must be addressed rather than treating deletion from one system as complete.

The privacy owner reviews this schedule at least every six months and whenever a purpose, form field, provider, system, legal requirement, or analytics configuration changes. The review confirms that categories, purposes, periods, deletion actions, processor settings, and public disclosures still match actual practice.

Operational evidence should record the review date, decisions, completed deletions or anonymizations, unresolved exceptions, and the next review date without recreating the personal information that was deleted.

Questions, challenges to retention, and requests to exercise privacy rights may be sent to privacy@largepeoplemodel.com. Business location: Kansas, United States.