Data Retention Policy

Overview

This Data Retention Policy explains how long we retain different types of data and our obligations under applicable regulations, including the 5-year retention requirement for due diligence compliance (Ley Debida Diligencia).

Retention Periods

Data Type	Retention Period	Legal Basis
Shared Documents (Due Diligence)	5 years after access revocation	Ley Debida Diligencia
Active Documents	While account is active	Contract
Audit Logs	Minimum 7 years	Compliance
Account Data	Active period + 30 days after deletion	Contract
Terms/Policy Consent Records	7 years	Legal obligation
Backup Data	90 days rolling	Business continuity

5-Year Retention Requirement

Important: Documents shared for due diligence purposes are subject to a mandatory 5-year retention period after access is revoked or expires.

This means:

When you share documents with auditors or other parties, those documents enter a retention period
After access is revoked, the documents remain in "retention" status for 5 years
During retention, documents cannot be permanently deleted
After 5 years, documents may be deleted according to your organization's policies

Document Lifecycle

Active

→

Document is active and accessible

Shared

→

Document shared with external parties

In Retention

→

Access revoked, 5-year retention period active

Eligible

→

Retention complete, eligible for deletion

Deletion Procedures

When data is deleted:

Data is permanently removed from primary storage
Backup copies are removed within 90 days
Deletion is logged in the audit trail
A deletion confirmation can be provided upon request

Your Rights

You may request deletion of your data, subject to:

Mandatory retention requirements (e.g., 5-year due diligence retention)
Legal holds or ongoing investigations
Contractual obligations

To request deletion, contact your organization's administrator or email privacy@nimbbo.com.

Legal Holds

Data subject to a legal hold will be preserved regardless of standard retention periods until the hold is released. Legal holds are applied in response to litigation, regulatory investigations, or other legal requirements.