Data Retention & Deletion Policy

Introduction

This Data Retention & Deletion Policy outlines how SecNinjaz retains and disposes of personal data and service data in compliance with Section 8(7) of the Digital Personal Data Protection Act, 2023 and Rule 5 of the DPDP Rules, 2025, which mandate erasure of personal data when the specified purpose is no longer being served or consent is withdrawn.

1. Guiding Principles

1. Purpose Limitation — Data is retained only as long as it serves the specific purpose for which it was collected.
2. Minimization — We collect the minimum data necessary and delete it at the earliest opportunity.
3. Automation — Deletion is automated, not dependent on manual processes.
4. Irreversibility — Deleted data cannot be recovered. There are no backups or archives of personal data after deletion.
5. Transparency — Retention periods are clearly communicated and consistently enforced.

2. Retention Schedule

Time 0          : Scan completes, report generated
  |
  | [Active Access Period - 72 hours]
  |   Report accessible via session token
  |   Report can be exported (JSON/Markdown/PDF)
  |
Hour 72         : Report access expires (HTTP 410 Gone)
  |
  | [Grace/Cleanup Period - 72 hours]
  |   Data awaiting automated deletion
  |   No access possible
  |
Hour 144        : ALL DATA PERMANENTLY DELETED
  |
  | [Nothing remains]

3. Automated Deletion Process

4. On-Demand Deletion (Data Erasure Requests)

In compliance with Section 12(2) of the DPDP Act, you may request immediate deletion of your personal data before the automated retention period expires.

How to request:

1. Email dpo@secninjaz.com with the subject "Data Erasure Request."
2. Provide the email address and/or domain associated with your submission for identification purposes.
3. We will process your request within 72 hours.
4. You will receive confirmation once deletion is complete.

What gets deleted:

• Your email address and all encrypted PII
• Domain and target URL records
• All scan results, findings, and reports
• All verification tokens and session data
• All associated log entries are purged or rendered non-identifiable

5. Data That Is NOT Retained

We explicitly do not maintain:

• Backups of personal data — There is no backup retention after the 144-hour lifecycle.
• Shadow copies or archives — No data is moved to cold storage or archives.
• Aggregated personal data — We do not create aggregate datasets from personal data.
• Third-party copies — We require our Data Processors to delete personal data in accordance with our retention schedule.

6. Exceptions to Retention Schedule

Data may be retained beyond the standard retention period only if:

1. Legal obligation — Required by an order of the Data Protection Board of India, a court, or under applicable Indian law.
2. Active legal proceeding — Data is relevant to an ongoing legal dispute or investigation.
3. Active security incident — Data is needed for investigation of a confirmed security breach.

In such cases:

• Only the minimum necessary data is retained.
• Retention is limited to the duration required by the legal obligation.
• The Data Protection Officer oversees and documents the extended retention.
• The affected Data Principal is notified where legally permissible.

7. Third-Party Data Processor Retention

Our Data Processors are contractually required to:

• Process personal data only for the purposes specified by SecNinjaz.
• Delete or return personal data upon completion of the service or upon our instruction.
• Not retain copies of personal data beyond what is strictly necessary for service delivery.
• Comply with the same retention timelines outlined in this policy.

8. Contact

For questions about data retention or to request data deletion: