7. Data Retention Policy
7.1 Overview
Verdantix is committed to retaining your personal and operational data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
Key Principle: Data is automatically scheduled for secure deletion or anonymization once its retention period expires, unless a longer retention period is required by applicable law or regulatory framework.
Our retention periods are defined based on three primary factors:
- Service Requirements: Duration needed to maintain energy grid stability, carbon audit continuity, and service functionality.
- Legal Obligations: Compliance with environmental regulations, tax laws, and data protection statutes (e.g., GDPR, CCPA).
- Business Interests: Legitimate interests such as fraud prevention and aggregate analytics for sustainability reporting.
7.2 Data Retention Schedule
The following table outlines the specific retention periods for different categories of data processed by Verdantix systems, including our IoT energy monitoring infrastructure, carbon analytics platforms, and customer relationship management tools.
| Data Category | Description | Retention Period | Disposal Method |
|---|---|---|---|
| Energy Telemetry IoT / Sensors |
Real-time energy consumption logs, voltage/current metrics from smart meters and solar inverters. | 7 Years Regulatory |
Anonymized for aggregate grid analytics; raw logs purged via secure overwrite. |
| Carbon Audit Reports Analytics |
Client-generated carbon footprint assessments, ESG scorecards, and offset verification records. | 10 Years Compliance |
Archived in immutable storage; deleted upon client request after legal hold expires. |
| Account Data PII |
Names, email addresses, organizational roles, and authentication credentials. | Account Lifecycle + 3 Years | Secure cryptographic deletion upon account closure + retention buffer. |
| System Logs & Security Ops |
Access logs, error traces, and security event data used for incident response. | 12 Months Security |
Automated rotation and shredding; encrypted backups retain for 90 days. |
| Marketing Communications Comms |
Email open rates, newsletter engagement, and event registration records. | 24 Months or until opt-out |
Removed from active lists; aggregated metrics retained indefinitely (anonymized). |
| Transactional Records Finance |
Invoice data, payment processing details, and service contract terms. | 7 Years Tax/Legal |
Archived to cold storage; compliant with financial auditing standards. |
7.3 Anonymization & Deletion Procedures
Anonymization Standards
When data is no longer needed for its original purpose but may be useful for aggregate sustainability research or grid optimization, Verdantix applies strict anonymization protocols. This includes:
- Removal of all direct identifiers (e.g., client names, site IDs).
- Aggregation of sensor data to regional or sector-level granularity.
- Application of differential privacy techniques to prevent re-identification.
Anonymized data is not considered personal data and may be retained indefinitely for scientific and public interest purposes.
Secure Deletion
Data subject to deletion is processed according to industry best practices:
- Digital Storage: Overwritten using NIST SP 800-88 guidelines to prevent recovery.
- Physical Media: Destroyed via degaussing or shredding for hardware containing residual data.
- Backups: Retention periods apply to active systems; backups follow a staggered deletion schedule.
7.4 Exceptions to Retention Policy
We may retain data beyond the standard periods in specific circumstances:
- Legal Disputes: If data is required for pending litigation or investigation.
- Regulatory Holds: Environmental agencies may require extended retention of emission records.
- Contractual Agreements: Specific client contracts may dictate customized retention terms, which will be documented separately.
In such cases, data is placed in a "Legal Hold" status, suspended from automated deletion processes, and accessed only by authorized compliance personnel.
7.5 User Rights Regarding Retention
Under applicable data protection laws, you have the right to:
- Request a status report on how long your data is retained.
- Request early deletion of data, subject to legal obligations.
- Withdraw consent for processing, which triggers the start of the deletion timeline.
To exercise these rights, please contact our Data Protection Officer using the details below.
7.6 Contact & DPO
If you have questions about this Data Retention Policy or wish to submit a data request, please contact:
Verdantix Data Protection Officer
Email: dpo@verdantix.com
Address: 1200 Green Way, Suite 400, San Francisco, CA 94105
Response Time: Within 30 calendar days
This document is part of the comprehensive Verdantix Privacy Framework. For related policies, see our 6. Data Security or 8. International Data Transfers sections.