Data Retention & Deletion
1. Retention principle
ELA and its customers should retain personal information only as long as necessary for documented recruitment, contractual, security and legal purposes. The periods below must be set by the responsible organisation; this draft does not invent fixed periods.
2. Retention approach
- Candidate profiles and CVs: set by the responsible customer’s documented retention policy and applicable law; no fixed period is published yet.
- Unsuccessful applications: set by the responsible customer’s documented retention policy and applicable law.
- Customer account and user data: to be defined in the customer agreement and operational deletion procedure.
- Support records and audit logs: to be defined according to documented operational and legal needs.
- Backups: retention and expiry schedule not yet confirmed.
- Billing and legal records: retained according to applicable statutory and contractual requirements.
3. Deletion and export
Document how authorised customers can request export, correction or deletion, how deletion propagates to active systems and backups, and what records may need to be retained for legal or security reasons. Any exceptions should be documented and access restricted.
4. Customer responsibilities
Customers should establish lawful retention rules for candidate records, inform candidates as required, review records periodically and ensure that users have appropriate permissions. ELA should provide clear administrative procedures consistent with the contracted service.
5. Request and contact
For privacy or deletion requests, contact privacy contact details to be published before accepting personal information. Last updated: 27 October 2026. This page must be updated to match implemented ELA functionality and the final DPA.
