Politique de conservation des données

1Principles

Oodser retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to:

• Legal and regulatory obligations requiring minimum retention periods
• Legitimate business purposes including dispute resolution and enforcement of agreements
• The rights of Data Subjects, including the right to erasure

Where data is no longer required for its original purpose, Oodser either permanently deletes it or anonymises it so it can no longer be linked to an individual. Anonymised data is not subject to data protection law and may be retained indefinitely for intelligence and analytics purposes.

2Retention Schedule

2.1 Professional Account Data

• Active profile data: retained for the duration of the account
• Inactive accounts (no login for 24 months): users notified and given 90 days to reactivate before deletion
• Deleted accounts: personal data deleted within 90 days of account deletion request, except where legal retention applies

2.2 Application and Hiring Data

• Submitted applications: retained for 36 months from date of submission
• Interview notes and assessments: retained for 24 months from date of creation
• Offer and contract data: retained for 60 months from date of offer
• Rejected candidate data in employer ATS: retained for 24 months, then deleted or anonymised

2.3 Communications Data

• Platform messages between professionals: retained for 24 months from last message in a conversation thread
• ATS communications between employers and candidates: retained for 36 months
• System notifications and automated messages: retained for 12 months

2.4 Verified Work History

• Employer-confirmed work history entries: retained for the duration of the account plus 36 months
• Verification request logs: retained for 60 months for dispute resolution purposes

2.5 Behavioral and Platform Activity Data

• Individual behavioral data (clicks, searches, application interactions): retained for 24 months in identifiable form
• After 24 months: anonymised and retained indefinitely as part of the intelligence graph
• AI model training contributions: retained in anonymised form indefinitely

2.6 Event Data

• Event registration and attendance records: retained for 24 months from event date
• Event content and recordings: retained for 12 months unless the organiser extends

2.7 Encounter Reviews

• Published reviews: retained while the account is active and for 24 months after account deletion
• Private company reviews: retained for 36 months from submission date

2.8 Financial and Transaction Data

• Payment transaction records: retained for 84 months (7 years) in compliance with financial record-keeping requirements
• Invoices and billing records: retained for 84 months

2.9 Security and Audit Logs

• Authentication and access logs: retained for 24 months
• AI processing audit logs: retained for 36 months
• Security incident records: retained for 60 months
• Data breach records: retained for 60 months

2.10 Legal Hold Data

Where data is subject to a legal hold — due to ongoing litigation, regulatory investigation, or legal obligation — standard retention periods are suspended until the hold is lifted. Legal holds are managed by Oodser's designated legal contact.

3Deletion and Anonymisation Process

At the end of a retention period, data is subject to one of the following:

• Permanent deletion: data is irreversibly deleted from all production and backup systems within 90 days of the retention period end date
• Anonymisation: all directly and indirectly identifying information is removed, leaving only aggregate behavioral data that cannot be linked to any individual

Backups: Backup systems are purged on a rolling schedule. Data deleted from production systems is removed from backups within 90 days.

4Data Subject Requests for Early Deletion

Data Subjects may request deletion of their data before the end of the standard retention period. Oodser will action such requests within 30 days except where:

• Retention is required by applicable law
• The data is necessary for the establishment, exercise, or defence of legal claims
• The data has been anonymised and can no longer be linked to the individual

Erasure requests should be submitted to data@oodser.com.

5Roles and Responsibilities

• Oodser's designated data protection contact is responsible for overseeing compliance with this policy
• Engineering and infrastructure teams are responsible for implementing automated deletion schedules
• Legal and compliance functions are responsible for maintaining legal hold registers
• All staff with access to personal data are trained on this policy

6Review

This policy is reviewed annually and updated to reflect changes in law, technology, or business operations. Material changes will be communicated via the Platform and Privacy Policy update notices.

7Contact

• Email: data@oodser.com
• Company: Oodser Ltd
• Website: oodser.com