Data Retention Policy
How long we keep different categories of data and how we securely dispose of it.
Effective 6 September 2026
This Data Retention Policy explains how long Zorvetska Limited retains different categories of data, the principles that guide our retention decisions, and how we securely dispose of data once it is no longer required.
Our approach is guided by the data minimisation and storage limitation principles of the Kenya Data Protection Act, 2019: we keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
1. Retention Principles
- We retain data only as long as it serves a legitimate business, legal, or contractual purpose.
- Retention periods are proportionate to the purpose and sensitivity of the data.
- Where data is no longer needed, it is securely deleted or anonymised.
- Legal, regulatory, tax, and audit obligations may require longer retention of specific records.
2. Retention by Category
- Contact and enquiry submissions: retained for up to 24 months after the last interaction, unless an ongoing relationship requires longer.
- Lead and marketing data: retained while the lead remains active and for a reasonable period thereafter, or until consent is withdrawn.
- Customer account and service data: retained for the duration of the service agreement and for an agreed period afterwards to support reactivation, disputes, and legal obligations.
- Billing and financial records: retained for the period required by applicable tax and accounting laws.
- Website analytics data: retained in aggregated or pseudonymised form in line with our Cookie Policy and analytics configuration.
- Security and system logs: retained for a limited period to support security monitoring, troubleshooting, and incident investigation.
3. Data Processed on Behalf of Customers
For data we process as a processor on behalf of our customers, retention is governed by the customer’s instructions and the applicable Data Processing Agreement. On termination of the service, such data is deleted or returned in line with that agreement, subject to any legal retention requirements.
4. Secure Disposal
When data reaches the end of its retention period, we delete it using secure methods appropriate to the media and system involved, or we irreversibly anonymise it so that it can no longer be associated with an individual.
5. Review
This policy and our retention schedules are reviewed periodically to ensure they remain appropriate and compliant with applicable law.
6. Contact
For questions about data retention or to exercise your data rights, contact [email protected].