Data Retention Policy
Official documentation
Data Retention Policy
This Data Retention Policy explains how long Everify retains personal information collected through our employment verification services and the criteria we use to determine retention periods.
We are committed to retaining your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations.
General Retention Principles
Our data retention practices are based on the following principles:
- Purpose Limitation: We retain data only for as long as necessary to fulfill the original purpose for which it was collected.
- Legal Compliance: We retain data to comply with applicable laws, regulations, and legal obligations.
- Minimal Retention: We aim to minimize the amount of time we retain personal data while balancing operational needs and legal requirements.
- Secure Disposal: When retention periods expire, we securely delete or anonymize personal data.
Specific Retention Periods
Verification Data:
| Data Type | Retention Period | Reason |
|---|---|---|
| Personal Information (Name, DOB, Address) | 30 days after verification completion | Operational needs and dispute resolution |
| Employment Information | 30 days after verification completion | Verification record keeping |
| Identity Documents (ID, Passport) | 30 days after verification completion | Security and fraud prevention |
| Financial Documents (W-2, Pay Stubs) | 30 days after verification completion | Verification accuracy and compliance |
| Verification Results | 7 years | Legal compliance and audit requirements |
Account and Authentication Data:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account Information | 3 years after account closure | Legal compliance and security |
| Login Credentials | Immediately upon account deletion | Security best practices |
| Session Data | 24 hours after session end | Technical functionality |
Technical and Analytics Data:
| Data Type | Retention Period | Reason |
|---|---|---|
| Server Logs | 90 days | Security monitoring and troubleshooting |
| Analytics Data (anonymized) | 2 years | Service improvement and analysis |
| Error Logs | 1 year | Technical support and debugging |
| Audit Logs | 7 years | Compliance and regulatory requirements |
Extended Retention Circumstances
We may retain personal data for longer periods in the following circumstances:
- Legal Holds: When data is subject to legal proceedings, investigations, or regulatory inquiries.
- Ongoing Disputes: When data is relevant to pending disputes or claims.
- Regulatory Requirements: When specific laws or regulations require longer retention periods.
- Consent: When you have specifically consented to longer retention for legitimate purposes.
- Vital Interests: When retention is necessary to protect vital interests of individuals.
Data Deletion Process
When retention periods expire, we follow a secure deletion process:
- Automated Deletion: Our systems automatically identify and delete data that has reached its retention limit.
- Secure Erasure: We use industry-standard secure deletion methods to ensure data cannot be recovered.
- Backup Removal: Data is also removed from backup systems within 90 days of deletion.
- Third-Party Data: We ensure that data shared with third parties is also deleted according to our agreements.
- Verification: We maintain logs of deletion activities for audit purposes.
Your Rights Regarding Data Retention
You have certain rights regarding how long we retain your data:
- Right to Erasure: You can request early deletion of your personal data in certain circumstances.
- Right to Information: You can request information about how long we will retain your specific data.
- Right to Object: You can object to certain data processing that affects retention periods.
- Right to Restriction: You can request that we restrict processing of your data pending resolution of retention questions.
To exercise these rights, please contact us using the information provided below or visit our GDPR Rights page.
Policy Updates
We may update this Data Retention Policy from time to time to reflect changes in our practices, legal requirements, or business needs. When we make significant changes, we will:
- Update the "Last Updated" date at the top of this policy
- Notify users via email or through our services for material changes
- Provide notice through our website for minor updates
- Maintain previous versions for reference when legally required
Contact Information
If you have questions about our data retention practices or wish to request information about your data, please contact us:
Everify
Email: privacy@everify.me
Data Protection Officer: dpo@everify.me
Address: 222 2nd St, San Francisco, CA 94105, United States.
For specific requests regarding data retention or deletion, please include:
- Your full name and contact information
- Details of your verification session(s) if applicable
- Specific data or retention period you're inquiring about
- Proof of identity for security purposes
