Security
Data Retention & Deletion Policy
This policy explains how Candaply manages the retention and secure deletion of information stored within the platform.
Purpose
This policy explains how Candaply manages the retention and secure deletion of information stored within the platform.
Retention principles
Personal information shall be retained only for as long as necessary to fulfil legitimate business and legal purposes.
Retention periods
Candidate Profiles
24 months from last activity.
Candidate CVs
24 months from last activity.
Compliance Documents
24 months from last activity.
Professional Registrations
Duration of active profile plus 24 months.
Right to Work Documentation
Employment duration plus 2 years where applicable.
DBS Information
Retention limited to information necessary for compliance purposes.
Customer Accounts
7 years following termination.
Invoices and Billing Records
7 years.
Audit Logs
7 years.
Deletion requests
Clients may request:
- Record deletion
- Account deletion
- Data export
- Data anonymisation
Backups
Deleted records may remain within encrypted backups until the backup lifecycle expires.
Secure destruction
Data is securely deleted using recognised deletion procedures designed to prevent recovery.
Policy review
This policy will be reviewed annually.