Data retention and disposal policy

Data controller

• Owner: Arlenys Arocha Diaz
• Tax ID (NIF/CIF): 60842001D
• Address: Avenida Europa 121, 4A, 28341, Valdemoro, Madrid, España
• Contact: proyectos@azucar-estudio.com

Purpose

This policy sets out, by category of data, how long we keep personal data and how we dispose of it once it is no longer needed, in line with the data-minimization and storage-limitation principles of the GDPR (Article 5.1.e).

Retention periods by category

• Bank account and transaction data (PackTrack Finanzas bank connection): 12 months from collection, or until the customer disconnects the linked account and requests deletion, whichever comes first.
• Customer and user account data (name, email, company details): for as long as the contractual relationship is active, plus the periods required by Spanish commercial and tax law afterward (generally up to 6 years for accounting and tax records).
• Contact-form and email/WhatsApp inquiries from people who are not yet customers: for as long as needed to respond to the inquiry, and deleted afterward unless a business relationship begins.
• Operational logs and backups: kept on a rolling basis for as long as needed for security and business continuity, and overwritten or deleted on a routine schedule.

Disposal method

When a retention period ends, data is either permanently and irreversibly deleted from our production databases and any backups as they are rotated, or anonymized so that it can no longer be linked to an identifiable person, whichever is appropriate for that category of data. Deletion requests from data subjects are honored within one month, as required by the GDPR.

Review of this policy

We review this policy at least once a year, and whenever we change how we process personal or financial data, to make sure the retention periods above are still accurate and still comply with applicable data protection law.

Contact

For questions about this policy or to request the deletion of your data, write to proyectos@azucar-estudio.com. You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es).