Data Retention Policy
1. Purpose
This Data Retention Policy is intended to:
(a) provide clear, customer-facing transparency on how StackCX retains and manages data within its systems;
(b) set out the retention periods that apply to different categories of data generated, processed, or stored by StackCX; and
(c) ensure we retain data only for as long as necessary to meet legitimate business needs and to comply with applicable legal and regulatory obligations.
2. Scope
This policy applies to all data collected, processed, and stored by StackCX on behalf of our customers while delivering its Software as a Service (SaaS) offerings. It includes information processed within StackCX applications, backups, logs, and operational data related to invoicing, billing, and contracting.
Application Data Backups
Retention Period: 1 month
Purpose: Performance of contract; recovery in case of data loss, corruption, or disaster.
System and Application Logs
Retention Period: 6 months
Purpose: Performance of contract; for auditing, debugging, and security analysis.
Invoicing, Account, Billing, and Contract Data
Retention Period: 7 years
Purpose: To comply with audit and legal obligations in the jurisdictions in which it operates.
Voice Recording Data
Retention Period: Data will be purged by default 12 months after initial processing, subject to customer configuration / election. All data will be purged within 3 months of termination of contract (or such earlier time if instructed in writing). Additional fees may apply where customer elects to retain recordings for periods beyond 12 months.
Purpose: StackCX only processes call recording data in accordance with the data controller's instructions and in the performance of the contract with the customer.
Call Transcripts
Retention Period: Data will be purged by default 12 months after initial processing, subject to customer configuration / election. All data will be purged within 3 months of termination of contract (or such earlier time if instructed in writing). Additional fees may apply where customer elects to retain recordings for periods beyond 12 months.
Purpose: StackCX only processes call recording data in accordance with the data controller's instructions and in the performance of the contract with the customer.
Integration Keys and authentication details
Retention Period: Purged at the end of the contract.
Purpose: For the performance of the contract; to provide agreed integrations.
3. Legal and Regulatory Compliance
StackCX retains data in accordance with applicable legal and regulatory obligations, including but not limited to privacy, tax and corporate reporting legislation and requirements in the jurisdictions in which it and its subsidiaries operate.
4. Legal Hold
Notwithstanding the retention periods set out in this Policy, StackCX will preserve relevant data (including copies, backups, logs and metadata) for longer than the stated periods where StackCX reasonably determines that a litigation hold (also referred to as a legal hold) is required to comply with legal or regulatory obligations, or to establish, exercise or defend legal rights (including the rights of its customers and users).
A litigation hold may be implemented where litigation, regulatory action, investigation, audit, inquiry, or other legal process is actual, threatened, or reasonably anticipated, including proceedings or potential proceedings initiated by a third party or a regulator.
While a litigation hold is in place, retention and deletion processes that would otherwise apply to the relevant data may be suspended (including automated deletion) and StackCX may take reasonable steps to identify, collect, preserve and restrict alteration of relevant data.
A litigation hold will be lifted when StackCX reasonably determines that the matter has concluded and the relevant data is no longer required to be preserved. Once lifted, the data will be handled in accordance with this Policy and any applicable legal requirements.
5. Data Disposal
At the end of the retention periods specified above, StackCX will securely delete or anonymise data in accordance with industry best practices, ensuring that it cannot be reconstructed or retrieved.
When a contract ends and StacKCX no longer has a reason to process or store customer supplied data, StacKCX will promptly take steps to irretrievably delete data in accordance with industry best practice.
6. Policy Review
This policy is reviewed annually and may be updated from time to time to ensure continued compliance with legal requirements and industry standards.