Data Retention Policy

Last Updated: May 30, 2025

This Data Retention Policy describes how Luz Seranoya collects, retains, and disposes of personal data and other information gathered through the use of our platform and services. By using our services, you acknowledge that your data will be handled in accordance with this policy.

---

1. Purpose and Scope

This policy applies to all personal data and non-personal information collected by Luz Seranoya through its website, platform, and associated services. It governs how long we retain different categories of data, the reasons for retention, and the processes we follow when data is no longer needed.

This policy applies to:

• Registered users and account holders
• Visitors to our website
• Individuals who contact us through support or inquiry channels
• Any person whose data we process in connection with our services

---

2. Categories of Data We Retain

2.1 Account and Identity Data

This includes your name, email address, username, password credentials, and any profile information you provide during registration or account management. This data is retained for as long as your account remains active and for a defined period following account closure.

2.2 Usage and Activity Data

We collect data about how you interact with our platform, including pages visited, features accessed, content consumed, session duration, and navigation paths. This data helps us improve our services and is retained for a limited operational period.

2.3 Communication Data

Records of communications between you and our support team, including emails, messages, and feedback submissions, are retained to ensure continuity of service and quality assurance.

2.4 Payment and Transaction Data

Where financial transactions occur, we retain records necessary for accounting, fraud prevention, and dispute resolution purposes. Sensitive payment details such as full card numbers are not stored directly by us.

2.5 Technical and Device Data

This includes IP addresses, browser types, device identifiers, operating system information, and log files generated during your use of the platform. This data is used for security monitoring, diagnostics, and service improvement.

2.6 Cookies and Tracking Data

Data collected through cookies and similar technologies is subject to the retention periods described in our Cookie Policy. Session cookies are deleted when you close your browser, while persistent cookies remain for defined periods.

---

3. Retention Periods

3.1 Active Account Data

Data associated with an active account is retained for the full duration of the account's existence. We do not delete or anonymize data belonging to active users unless specifically requested.

3.2 Inactive Account Data

If an account has shown no activity for a continuous period of twenty-four months, we may notify the account holder and, in the absence of a response, proceed to anonymize or delete the associated data.

3.3 Data Following Account Closure

Upon closure or deletion of an account, personal data is retained for a period of up to ninety days to allow for account recovery requests and to fulfill any outstanding obligations. After this period, data is deleted or irreversibly anonymized unless a longer retention period is required by applicable law or legitimate business necessity.

3.4 Support and Communication Records

Records of support interactions are retained for up to three years from the date of the last communication to maintain service history and resolve potential disputes.

3.5 Financial and Transaction Records

Transaction records and related financial data are retained for a minimum of seven years to comply with standard accounting and audit requirements.

3.6 Security and Log Data

System logs and security-related records are retained for up to twelve months, after which they are deleted or aggregated in a manner that no longer identifies individuals.

3.7 Marketing and Consent Records

Records of consent to receive marketing communications are retained for the duration of the consent and for a reasonable period thereafter to demonstrate compliance. If you withdraw consent, your data will be removed from active marketing lists promptly, though records of the consent interaction may be retained for compliance purposes.

---

4. Legal Bases for Retention

We retain data only where we have a lawful basis to do so. The primary bases for retention include:

• Contractual necessity: Retention is required to fulfill our obligations under a service agreement with you
• Legal obligation: Applicable laws or regulations require us to retain certain records for specified minimum periods
• Legitimate interests: We have a legitimate interest in retaining data for fraud prevention, security, dispute resolution, and service improvement, where this interest is not overridden by your rights
• Consent: Where you have provided explicit consent for a specific processing purpose, we retain data for as long as that consent remains valid

---

5. Data Deletion and Anonymization

5.1 Deletion Process

When data reaches the end of its retention period or a deletion request is fulfilled, we permanently remove it from our active systems. Deletion is applied across primary databases, backup systems, and any copies held by authorized processors, subject to technical feasibility and backup rotation schedules.

5.2 Anonymization

In some cases, rather than deleting data entirely, we anonymize it so that it can no longer be linked to any individual. Anonymized data may be retained indefinitely for statistical, research, or analytical purposes without further restriction.

5.3 Backup Retention

Data contained within backup archives may persist beyond the standard retention period due to the nature of backup systems. Such backups are subject to secure access controls and are overwritten or deleted according to our backup rotation schedule, which does not exceed ninety days beyond the primary deletion date.

---

6. Your Rights Regarding Retained Data

You have the right to request information about the data we hold about you, to request correction of inaccurate data, and to request deletion of your personal data where no lawful basis for retention applies. To exercise these rights, please contact us using the details provided below.

We will respond to all verified requests within thirty days. In cases of complexity or high volume, we may extend this period by an additional thirty days, in which case we will notify you of the extension and the reason for it.

Please note that certain retention obligations may limit our ability to fulfill deletion requests in full. Where this is the case, we will explain which data must be retained and why.

---

7. Data Held by Third Parties

We may share data with trusted third-party service providers who process data on our behalf. These providers are contractually required to retain data only for as long as necessary to perform their services and to apply data protection standards consistent with this policy. We do not sell personal data to third parties.

---

8. Security During Retention

All data retained by us is protected by appropriate technical and organizational security measures, including encryption, access controls, and regular security assessments. Access to retained personal data is limited to authorized personnel who require it for legitimate operational purposes.

---

9. Changes to This Policy

We may update this Data Retention Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the date at the top of this document and, where appropriate, notify users through our platform or by email. We encourage you to review this policy periodically.

---

10. Contact Us

If you have questions about this Data Retention Policy, wish to exercise your data rights, or want to report a concern regarding how your data is being retained, please contact us: