Data Retention Policy

1. Introduction

Caribbean 360 Media Ltd ("Caribbean360", "we", "us") is committed to processing and retaining personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and protect our legitimate interests.

This Data Retention Policy explains how long we keep different categories of data, the legal basis for these retention periods, and how data is handled when retention periods expire.

This policy should be read alongside our Privacy Policy, which provides full details on how we collect and use personal data.

2. Retention Principles

We apply the following principles when determining how long to retain data:

• Purpose limitation: Data is kept only as long as necessary for the purpose it was collected

• Legal compliance: Certain data must be retained to meet regulatory and legal requirements

• Legitimate interests: Some data may be retained to protect our legal rights or for security purposes

• Data minimisation: We regularly review and delete data that is no longer needed

• Secure disposal: When data is deleted, it is done so securely and irreversibly

3. Retention Schedule

The following table summarises our retention periods for different categories of data:

4. Detailed Retention Categories

4.1 Account and Profile Data

This includes your email address, display name, profile picture, and account preferences.

• Active accounts: Retained while account is active

• Inactive accounts: Accounts with no login for 3 years may be flagged for deletion with prior notice

• Closed accounts: Core profile data retained for 2 years to handle disputes, then deleted

• Founding Member status: Retained permanently as part of subscription history

4.2 Subscription and Payment Data

We retain subscription and payment records to comply with UK tax and accounting regulations.

• Active subscriptions: Full records retained

• Cancelled subscriptions: Records retained for 7 years from cancellation

• Payment card details: Not stored by us; held by Stripe under their retention policies

• Invoices and receipts: 7 years (HMRC requirement)

• Geographic pricing eligibility: Duration of subscription

4.3 Content Interaction Data

This includes your reading history, saved articles, and content preferences.

• Reading history: 26 months (used for recommendations and analytics)

• Article access meter: Rolling 30-day count for free tier metering

• Saved articles and bookmarks: Duration of account

• Deep Dive panel access logs: 12 months

• Download history: 12 months

4.4 Ask360 and AI Interaction Data

When you use our Ask360 assistant, we retain query data to improve the service.

• Query text and responses: 12 months

• Query metadata (timestamp, context): 12 months

• Aggregated, anonymised usage patterns: Indefinitely

Ask360 queries are not linked to your account for longer than 12 months. After this period, any retained data is anonymised.

4.5 Analytics and Technical Data

We use analytics to understand how our service is used and to improve it.

• Google Analytics data: 26 months (controlled by our GA settings)

• Internal usage analytics: 26 months

• Error logs: 90 days

• Performance monitoring data: 30 days

4.6 Security and Compliance Data

Certain data is retained for security and legal compliance purposes.

• Authentication logs: 12 months

• Failed login attempts: 90 days

• IP address logs: 90 days

• Consent records (cookies, marketing): Duration of consent plus 3 years for accountability

• Data subject requests: 3 years from completion

4.7 User-Generated Content

Comments and other content you create on our platform.

• Published comments: Retained while account is active and for 1 year after account closure

• Deleted comments: Removed within 30 days of deletion request

• Reported/moderated content: May be retained for 2 years for legal purposes

4.8 Communications

Records of communications between you and Caribbean360.

• Customer support tickets: 3 years from resolution

• Email correspondence: 3 years

• Feedback and surveys: 2 years (anonymised thereafter)

5. Data Deletion and Anonymisation

5.1 Automated Deletion

We operate automated systems that identify and delete data that has exceeded its retention period. These systems run regularly to ensure compliance with this policy.

5.2 Manual Deletion Requests

You may request deletion of your data at any time by contacting us or through your account settings. Upon receiving a valid deletion request:

• We will delete or anonymise your data within 30 days

• Some data may be retained where we have a legal obligation or legitimate interest (e.g., fraud prevention, legal claims)

• Backup copies are purged within 90 days of deletion from live systems

5.3 Anonymisation

Where possible, we anonymise data rather than delete it entirely. Anonymised data cannot be linked back to you and may be retained indefinitely for statistical and research purposes.

6. Special Circumstances

6.1 Legal Holds

If we are involved in litigation or anticipate legal proceedings, relevant data may be retained beyond normal retention periods until the matter is resolved.

6.2 Regulatory Investigations

Data relevant to regulatory investigations will be retained as required by the relevant authority.

6.3 Fraud and Abuse

Data related to suspected fraud, abuse, or Terms of Service violations may be retained for up to 7 years to protect our legal interests.

7. Third-Party Data Retention

Some of your data is processed by third-party service providers. Their retention practices are governed by their own policies:

• Stripe (payments): Subject to Stripe's data retention policy

• Google Analytics: 26 months (configured by us)

• Supabase (hosting): Subject to our instructions and their data processing agreement

We ensure all third-party processors are contractually bound to appropriate data protection standards.

8. Backup and Archive Data

We maintain backups for disaster recovery purposes:

• Daily backups: Retained for 30 days

• Weekly backups: Retained for 90 days

• Monthly archives: Retained for 1 year

When data is deleted from live systems, it is also removed from backups within the backup retention cycle (maximum 90 days).

9. Your Rights

Under UK data protection law, you have the right to:

• Request access to your personal data

• Request correction of inaccurate data

• Request deletion of your data (subject to legal retention requirements)

• Object to processing based on legitimate interests

• Request restriction of processing

• Data portability

To exercise these rights, contact us at info@caribbean360.com. For more information, see our Privacy Policy.

10. Policy Review

This Data Retention Policy is reviewed annually and updated as necessary to reflect changes in our practices, legal requirements, or business needs.

11. Contact Us

For questions about this policy or our data retention practices:

• Email: info@caribbean360.com

• Website: caribbean360.com/contact

Data Controller: Caribbean 360 Media Ltd, United Kingdom