Category, trigger, period, legal-hold, backup, anonymisation, deletion, and evidence rules for information processed through Bibeno.
This schedule explains Bibeno's default retention and deletion rules for customer data, personal information, platform evidence, and Bibeno business records. It supplements the Privacy Notice and Data Processing Agreement. It applies only to systems and processing included in the approved service boundary; any system without a verified inventory, owner, retention trigger, deletion method, backup treatment, and evidence remains outside the enabled production boundary.
Where Bibeno acts as operator, it follows the customer's lawful documented retention and deletion instructions within the supported service. Bibeno may retain a limited record where law requires it or where reasonably necessary for a legal claim, security, fraud, tax, or dispute, and will inform the customer of that boundary where legally permitted.
Current configuration, users, products, customers, orders, inventory, suppliers, workforce, support, and related operational records are retained while the account and purpose are active, subject to category-specific minimisation, user deletion, correction, and archive controls. An active account is not authority to retain every historical raw payload indefinitely.
Account closure first suspends operational access and starts the approved export and reconciliation window. Customer-controlled data that is not allocated to a longer category is quarantined for up to 90 days after the effective closure date, then anonymised or purged following inventory, legal-hold, approval, and completion-report checks.
Closure does not erase tax, consumer, contract, payment, workforce, gift-card, security, acceptance, dispute, or other records that remain subject to a specific period. Those records are restricted to the minimum fields and authorized purposes required for the remainder of that period.
Synthetic sandbox data may be quarantined 30 days after the sandbox ends and purged after approval if no hold applies. A live pilot or trial follows the account-closure process and is never hard-deleted as one undifferentiated tenant because it may contain financial, consumer, payment, employee, support, or security records with longer obligations.
Final invoices, credit notes, accounting entries, settlement and reconciliation evidence, tax classifications, financial approvals, and related source references are retained for seven years after the end of the financial or tax period to which they relate, unless a longer period applies because a return is outstanding, an audit, objection, appeal, investigation, prescription period, or legal hold remains open.
This seven-year policy is a conservative business-record period and does not claim that every underlying raw payload must be retained for seven years. Redundant personal fields are removed or tokenised where the evidential purpose can still be met.
Sale, online order, supplier and policy-version disclosure, acceptance or rejection, item and option, collection or delivery, receipt, refund, return, substitution, warranty, complaint, gift-card issue, value, redemption, reversal, closure, and related consumer evidence is retained for five years after the later of final performance, final redemption, complaint closure, or the end of the applicable warranty or statutory validity period. Tax or active dispute records follow the longer applicable category.
Delivery instructions, order notes, and optional allergy or safety information are separated from the minimum transaction evidence and removed or irreversibly anonymised earlier when they are no longer needed for fulfilment, a food-safety or consumer issue, a legal obligation, or an active dispute. A five-year transaction record is not permission to keep the full free-text order payload for five years.
Tokenised payment references, provider events, refund and reversal evidence, fraud decisions, chargebacks, disputes, and settlement links are retained for seven years after final settlement or closure of the last related dispute where needed for finance, fraud, contract, tax, or legal claims. Bibeno does not retain full payment-card data outside an expressly approved PCI scope.
Employee identity, agreement, time, attendance, leave, remuneration input, payroll export, tip or service-charge allocation, advance, deduction, correction, and termination evidence is retained for five years after the later of the relevant payroll or tax period, settlement of the amount, or termination of employment, unless a longer labour, tax, injury, dispute, collective, prescription, or legal-hold period applies.
Unsuccessful applicant or unneeded monitoring data uses a shorter approved purpose-specific period and is not retained under the employee-record period by default.
Orders, contract versions and hashes, presentation and acceptance evidence, billing choices, cancellation, notices, material changes, complaints, and final decisions are retained for seven years after the later of contract end, final payment, or closure of the matter, subject to a longer dispute, prescription, regulator, or court requirement.
Privacy-rights and PAIA requests, identity-verification decisions, searches, disclosures, refusals, fees, communications, complaints, and regulator correspondence are retained for five years after final closure, or longer while a review, complaint, enforcement action, litigation, or legal hold remains open. Identity evidence is minimized and removed earlier where it is no longer needed to prove verification.
Ordinary support content is retained for up to three years after ticket closure. Privileged-access, security, fraud, incident, breach-notification, audit, and material correction evidence is retained for up to seven years after final closure where necessary for accountability, claims, regulator, or security learning. Attachments and raw diagnostics are reviewed for earlier removal when their evidential purpose ends.
Consent, existing-customer basis, notice, audience, NCC cleansing, content, send, delivery, opt-out, and complaint evidence is retained for five years after the last reliance or closure of the related complaint. A minimal suppression record is retained while the responsible party conducts the relevant marketing and for five years thereafter so that a withdrawal or objection is not silently lost.
Raw device, offline queue, synchronization, delivery, and operational telemetry is retained for no longer than two years after final processing unless it is quarantined for a specific incident, dispute, fraud, or legal hold. Normalized sale, payment, financial, inventory, acceptance, and security evidence follows its own longer category.
Backups are protected, access-restricted, and expire through the approved rolling cycle within 90 days unless a tested recovery, incident, or legal-hold need requires a controlled exception. A deleted record is not restored to active use merely because it exists in a backup. If a backup is restored, applicable deletion and suppression instructions are re-applied.
A legal hold overrides ordinary disposal only for the identified people, systems, records, dates, and purpose. The hold record identifies authority, owner, reason, start, scope, review date, access, and release. Holds are reviewed periodically and released promptly when no longer justified.
Anonymisation is used only when re-identification is not reasonably likely using available means and the remaining data no longer relates to an identifiable person. De-identification, tokenisation, masking, archive, or disabled access is not described as deletion. A purge removes the approved primary records and expires from backups through the documented cycle.
Production disposal uses a dry-run inventory, policy version, category and trigger, hold check, record count, dependency check, authorized requester, independent approver, idempotency key, item-level result, error handling, and immutable completion-report hash. A failed or partial operation is not represented as complete.
Periods are reviewed when law, product purpose, vendor, territory, customer instruction, litigation exposure, or system design changes. A material reduction or expansion is versioned and approved. A person may ask about retention or exercise a privacy right through the verified contact in the Privacy Notice, subject to lawful exceptions and preservation duties.
Essential storage is always active. Optional analytics and marketing tools remain off unless you allow them. Read more.
