Data Retention & Deletion Policy

Last Updated: December 15, 2025.

This Data Retention & Deletion Policy (“Policy”) explains how DigiBioLink collects, stores, retains, and deletes user data in compliance with applicable data protection laws, including (where applicable) GDPR, CCPA, PDPA, and other regional privacy standards.

This Policy forms an integral part of DigiBioLink’s Terms of Service, Privacy Policy, and Acceptable Use Policy. By using DigiBioLink, you agree to the practices described below.

1. Purpose of This Policy

The purpose of this Policy is to:

- Define how long data is retained on DigiBioLink systems
- Establish clear rules for account deletion, data removal, and backups
- Ensure transparency regarding storage, processing, and purging of personal information
- Provide guidelines for users, partners, and resellers on data lifecycle management

DigiBioLink follows the principles of data minimization, necessity, and purpose limitation.

2. Categories of Data Collected & Retained

2.1 Account Information

- Email address
- Username
- Encrypted login credentials
- Profile data associated with each account

2.2 Digital Business Card Data

- Profile details (name, title, contact information, media, links)
- Custom configurations, templates, images, and uploaded content
- Client IDs, workspace labels, and reseller-assigned metadata

2.3 Platform Usage Data

- Login timestamps
- IP address and device metadata
- Analytics data (page views, QR scans, interactions)

2.4 Payment & Billing Information (If Applicable)

Handled exclusively by the payment provider; DigiBioLink does not store full card information.

2.5 Communication Records

- Support tickets
- Emails, chat logs, or inquiries
- Verification or compliance-related communication

3. Data Retention Principles

DigiBioLink retains data only for as long as:

- It is necessary to deliver services
- It is required for legal, regulatory, or accounting purposes
- The user’s account remains active
- The user has not requested deletion
- There are no outstanding disputes or investigations

Data is securely archived when no longer actively in use but still required.

4. Specific Data Retention Timeframes

4.1 Active User Accounts

All data remains stored indefinitely while the user account is active.

4.2 Deleted or Deactivated Accounts

When a user requests deletion or an account becomes inactive:

- Profile data → deleted permanently within 30–90 days
- Uploaded media files → deleted within 30–90 days
- Analytics logs → anonymized after 90 days
- Support logs & tickets → retained for 12–24 months for auditing and customer service record-keeping
- Billing records → retained for 5–7 years as required by financial compliance laws

4.3 Reseller Data

Since reseller-client relationships involve workspace assignments and ID structures:

- Workspace metadata, client IDs, and campaign labels are retained for audit and verification even after client removal.
- Anonymous version (no personal data) may be stored indefinitely to maintain URL consistency, QR/NFC routing history, and fraud prevention.

4.4 Backup Systems

Data stored in automated backups may persist for up to 180 days before being overwritten, encrypted, and purged.

5. How Data Is Deleted

5.1 User-Initiated Deletion

Users may request deletion by contacting DigiBioLink support.

Upon request:

- The account is scheduled for deletion.
- Personal data and uploaded content are removed from active servers.
- Backups containing the data will purge the deleted entries automatically during lifecycle rotation.

5.2 Automatic Deletion

Accounts may be automatically deleted if:

- They remain inactive for extended periods (as defined by platform policy)
- A reseller’s subscription expires or is terminated
- DigiBioLink terminates an account due to AUP or legal violations

5.3 Irreversible Deletion

Deleted data is anonymized or destroyed using secure, irreversible methods. After deletion:

- Data cannot be restored
- URLs associated with vCards may stop functioning unless the reseller reassigns or restructures them
- Cached copies may temporarily remain in search engines until cleared by third-party indexing systems

6. Exceptions & Legal Retention

Certain data must be retained even after deletion requests:

- Data required for legal claims
- Fraud-prevention or security logs
- Financial transaction records
- Internal compliance documentation

In such cases, DigiBioLink retains only the minimum necessary information and restricts access to authorized personnel only.

7. Data Retention for Resellers & PRO Accounts

7.1 Client Removal Does Not Erase Workspace Records

Removing a client from the reseller panel:

- Does not delete the workspace metadata
- Does not delete URL structures used for dynamic routing

This ensures long-term stability of QR/NFC redirections and historical accuracy.

7.2 Responsibility for Customer Data

Resellers are responsible for:

- Informing clients about how their data is stored
- Requesting deletion when a client demands erasure
- Maintaining lawful, non-abusive usage of data collected

If a reseller requests deletion on behalf of a client, verification is required.

8. How Users Can Request Their Data or Deletion

Users may:

- Request a copy of all personal data
- Request correction of inaccuracies
- Request partial or full deletion

To initiate such requests:

📧 Email: support@digibiolink.com

Verification may be required to prevent unauthorized requests.

9. Security of Stored Data

DigiBioLink uses:

- Encrypted databases
- Role-based access control
- Server-side firewalls
- Automated threat detection
- Secure backup systems

Data retention does not compromise security at any point.

10. Updates to This Policy

DigiBioLink may update this Policy periodically. Updates take effect upon publication. Continued use of the platform implies acceptance of the current version.

11. Contact Information

For questions regarding this Policy:

📧 Email: support@digibiolink.com
📧 Email: support@digitetc.com
🌐 Website: https://digibiolink.com

By using DigiBioLink platform, you acknowledge that you have read, understood, and agree to these Policies.