Public Data Retention Schedule
The default periods Reedleys uses for keeping account, assessment, identity, review, payment and technical records, and when information is deleted or anonymized.
Version 1.0 · Effective 31 July 2026 · The current online version controls.
Applies to: Reedleys and the Reedleys website, applications, directory, verification and recognition services.
Important: These are default maximum periods, not promises that every record will be kept for the full period. Where mandatory local law gives a person greater or non-waivable rights, that law prevails.
1. Purpose
This schedule explains the default periods Reedleys uses for major categories of personal and assessment information. It supports data minimization, legal compliance, certificate integrity, fraud prevention and consistent record management.
These are default maximum periods, not promises that every record will be kept for the full period. Reedleys may delete or anonymize information earlier when it is no longer needed.
2. How retention periods are applied
A period usually begins when an account closes, an assessment ends, recognition expires, a transaction completes or the last meaningful interaction occurs. Reedleys may keep information longer where necessary for:
- an active appeal, complaint, dispute, legal claim or investigation;
- a legal, tax, accounting or regulatory obligation;
- fraud, identity, security or certificate-integrity concerns;
- a preservation request or legal hold;
- backup restoration and system continuity.
When full records are no longer needed, Reedleys may retain a minimized, de-identified or statistical record.
3. Default schedule
| Record category | Default retention | Why Reedleys keeps it |
|---|---|---|
| Basic account and login records | While active, then up to 3 years after closure | Account administration, reactivation, security, disputes and fraud prevention |
| Public organization or professional profile content | While active; removed or archived after closure, with limited records for up to 6 years | Directory accuracy, claims, disputes and historical status |
| Unclaimed public business information | While relevant and reasonably accurate; reviewed or removed when no longer justified | Public directory and legitimate business information |
| Recognition application, assessment evidence and decision record | 6 years after the later of decision, expiry or withdrawal | Appeals, consistency, legal claims, quality control and fraud prevention |
| Minimal certificate and rating verification record | Up to 10 years after expiry or withdrawal; a limited anti-fraud reference may be retained longer | Preventing false certificate use and confirming historical validity |
| Raw identity-document images, selfies, videos and liveness material held by Reedleys | Normally deleted or de-identified within 90 days after verification | Short-term verification, dispute handling and fraud checks |
| Identity verification result, date, provider reference and audit metadata | While the account or recognition is active, then up to 6 years | Account integrity, appeals, security and decision evidence |
| Provider-held identity or biometric data | According to the provider agreement, settings, legal duties and provider notice; Reedleys seeks the shortest practical period | Specialist verification and legal/security requirements |
| Appeals and complaint files | 6 years after final closure | Consistency, legal claims, repeated issues and accountability |
| Reviews, responses and public user content | While published; moderation records up to 6 years after removal or account closure | Platform integrity, disputes, fraud and legal claims |
| Service requests and lead communications | Up to 3 years after the request or last interaction | Service delivery, complaints and fraud prevention |
| Support correspondence | Up to 3 years after closure | Service history, training and dispute resolution |
| Contracts, invoices, payment and tax records | 7 years after the transaction or end of the relationship | Accounting, tax, audit and legal obligations |
| Marketing contacts and consent records | Until opt-out or inactivity, then up to 2 years; suppression record retained as needed | Marketing administration and proof of consent/opt-out |
| Cookie and analytics identifiers | Commonly 13 to 26 months, depending on tool and consent settings | Analytics, security and service improvement |
| Security, access and application logs | Normally 12 to 24 months | Security monitoring, incident investigation and fraud prevention |
| Data-rights request records | 6 years after completion | Demonstrating compliance and preventing repeated identity fraud |
| Recruitment records, if applicable | Unsuccessful candidates: usually up to 12 months; successful candidates: employment record schedule | Recruitment, equality monitoring and legal claims |
| Backups | Rolling deletion, normally within 90 days after removal from live systems | Disaster recovery and system continuity |
4. Identity and biometric information
Identity documents and biometric materials are high-risk data. Reedleys aims not to retain raw copies longer than necessary. Where Reedleys receives only a pass/fail result or limited provider reference, Reedleys may never receive the raw document or biometric template. Full detail is in the Identity and Evidence Verification Policy.
A longer period may apply if there is suspected impersonation, a disputed decision, a security incident or a legal preservation requirement. Access remains restricted.
5. Public status and historical integrity
Removing a public profile does not always require deletion of every related record. Reedleys may retain a minimal record of the profile name, certificate number, rating, relevant dates and inactive status to prevent an expired or withdrawn recognition from being presented as current. This supports the verification page and the Recognition Status Policy.
6. Deletion and anonymization
At the end of the applicable period, Reedleys may:
- securely delete the record;
- anonymize it so that it no longer identifies a person;
- aggregate it for statistical use;
- restrict it to a legal, security or anti-fraud archive.
Deletion from backups may occur through the normal backup cycle rather than immediately, provided the data is not restored for ordinary use.
7. Service providers
Reedleys seeks contractual retention and deletion terms from providers. Some providers may have independent legal duties or act as a separate controller for limited purposes. Their privacy notices may apply in addition to this schedule.
8. Individual rights
A person may request deletion or restriction under applicable law. A request may be limited where Reedleys needs information for legal obligations, freedom of expression, public directory accuracy, fraud prevention, certificate integrity, disputes or legal claims. Rights and how to exercise them are described in the Global Privacy and Data Protection Notice.
9. Review
Reedleys reviews this schedule periodically and when a new system, verification provider, jurisdiction or data category is introduced.
Related policies
This schedule forms part of the Reedleys Legal & Terms framework. See also the Global Privacy and Data Protection Notice, the Identity and Evidence Verification Policy and the Recognition Status Policy.