7. For how long do we keep information about you?
We retain your personal data for as long as necessary to fulfill the purposes for which your personal data was collected. For this reason, we will delete or anonymize personal data (or equivalent) once they are no longer necessary to achieve the purposes, subject however (i) to any applicable legal or regulatory requirements to store personal data for a longer period (e.g. for tax or accounting reasons), or (ii) if we have an overriding interest (e.g. an interest for reasons of proof to establish, exercise and/or defend actual or potential legal claims, investigations or similar proceedings, including legal holds, which we may enforce to preserve relevant information, or if we have an interest in non-personalized analysis).
On that basis, we normally process personal data subject to the following rules and obligations:
For contract related personal data (including business records and communication), we retain personal data as long as the contractual relation is ongoing and for ten years after the termination of the contractual relationship unless (i) a shorter or longer statutory storage obligation is applicable on a case-by-case basis, (ii) the retention is required for reasons of proof or another valid reason based on applicable law, or (iii) the deletion of the data is required earlier (because e.g. the data is no longer required or we are required to delete the respective data);
For operational data containing data (e.g. protocols, logs), we retain personal data for a period of 3 – 12 months.