Data Retention and Deletion Policy
Organisation: tolinax UG (haftungsbeschränkt), operator of the aYOUne platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director
Review cycle: at least annually
1. Principles
- Personal data is kept only as long as needed for the purpose it was collected for, or as long as a legal retention obligation applies (for example German commercial and tax law, §§ 147 AO, 257 HGB).
- Customers (tenants) are the controllers of the data they process in aYOUne; tolinax deletes or returns that data on their instruction.
- Where a legal retention obligation prevents deletion, the data is restricted (blocked from further processing) and pseudonymised instead of deleted, and deleted once the obligation ends.
2. Data subject requests (implemented controls)
- Erasure (Art. 17 GDPR): the platform provides an erasure workflow for end-customer records (consumers). It first produces a plan (dry run) listing every affected record, then executes on explicit confirmation by an authorised user holding dedicated rights. Records are deleted, unlinked from related records, or — where a retention obligation applies — pseudonymised and blocked. Every run is written to an audit log.
- Access and portability (Art. 15 / 20 GDPR): the platform generates a data export for a data subject as an asynchronous job. The result is stored encrypted and made available through a time-limited signed download link; exports are removed after 30 days by default.
- Requests are answered within one month (Art. 12(3) GDPR).
3. Backups
- Tenant backups can be created on request and on a schedule; scheduled backups are pruned according to a per-tenant retention rule.
- Deleted data may persist in backups until those backups expire under the backup retention period. Backups are not restored into production except for disaster recovery, and any data deleted earlier is deleted again after a restore.
4. End of contract
On termination of a customer contract, tolinax:
- offers the customer an export of its data;
- deletes the customer's tenant data from the production systems within 30 days after contract end, unless a legal obligation requires retention;
- lets the remaining copies in backups expire within the backup retention period.
Current implementation status: strong (second-factor) confirmation for tenant deletion is implemented; the automated tenant archive-and-delete workflow is in development. Until it is available, tenant deletion at contract end is carried out as a documented manual operation by the operator.
5. Logs
Application and audit logs are retained for operational and security purposes. Request data passed to error reporting is reduced to an allow-list of fields with query secrets redacted. Logs are kept only as long as needed for operation and security and are then deleted.