Axeten shall delete from its servers, any personal information that is controlled by the customer within 90 days from receipt of payment that relates to the processing event.
Axeten deletes personal data as soon as it is no longer needed, in compliance with the GDPR (UK and EU) and the DPA 2018.
Investigations
All personal data relating to an investigation is deleted from Axeten servers three months after the payment date. This includes the Case eBundle, the original instruction and all backups.
From that date, the Case eBundle held by the client is the only copy in existence. Please read The Axeten Case eBundle.
A record of each instruction is retained in the Axeten Research Register, with no personal subject data.
Backups
Axeten servers are backed up each night. A client may ask for its case data to be excluded from the backup process.
Axeten Group operates an internal and local data backup, where files are purged after three months.
Customers may request exclusion from the back-up process
Why Axeten Deletes Case Data
The GDPR (UK and EU) requires personal data to be kept for no longer than is necessary for the purpose for which it was processed. This is the storage limitation principle, Article 5(1)(e). Once an investigation has been delivered and paid for, its purpose is complete, and Axeten has no lawful basis to keep the subject's personal data.
This protects the subject of the investigation, and it protects you. Investigation material held indefinitely by a third party is a data protection risk for the instructing client as well as for Axeten.
Clients have asked Axeten for a Case eBundle more than a year after it was delivered. By then it had been deleted, as this policy requires, and it could not be supplied. To avoid this:
- download the Case eBundle as soon as you receive the link, and store it safely
- if you need Axeten to keep it for longer, state the period you require in your instruction, or tell Axeten within three months of the payment date