Data Retention Policy

Last updated: June 2026

1. Introduction and purpose

Xertilox Ltd (“Xertilox”, “we”, “us”, “our”) is committed to protecting the personal data we process and ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Digital Identity and Attributes Trust Framework (DIATF).

This policy defines how long personal data is retained when collected and processed through the Xertilox mobile application and associated systems. It ensures that:

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected.
Retention periods are defined, documented, and adhered to in line with legal, regulatory and business requirements.
Data is securely deleted or anonymised when no longer needed.

2. Scope

This policy applies to all personal data processed via the Xertilox mobile app and supporting systems, including:

Wallet holder data
Document verification data
Biometric data (for example facial recognition scans)
Device data and session logs
Transactional and audit trail data

This policy covers all Xertilox staff, contractors, and authorised third-party processors who handle mobile app data.

3. Legal and regulatory framework

This policy has been designed to comply with:

UK GDPR (Articles 5, 13, 17, 30, 32)
Data Protection Act 2018
Digital Identity and Attributes Trust Framework (DIATF)
Other applicable UK regulatory and contractual obligations

Key principles derived from these frameworks:

Lawfulness, fairness and transparency: Data retention periods must be clearly communicated to users.
Purpose limitation: Data is retained only for the original purpose for which it was collected.
Storage limitation: Data is not kept longer than necessary.
Integrity and confidentiality: Data must be securely stored and disposed of.

4. Data categories and retention periods

Data category	Purpose	Retention period	Disposal method
Wallet holder personal data (name, email, phone, etc.)	Creation and maintenance of user identity.	Active account: retained for the duration of wallet use. Inactive or deleted account: retained for 12 months to meet regulatory obligations.	Secure deletion from all systems.
Document verification data (passport, driving licence, etc.)	Verify authenticity of identity.	Retained for 90 days post-verification, then securely deleted unless required for ongoing compliance investigations.	Encrypted purge from verification system.
Biometric data (facial recognition scans)	Liveness detection and identity matching.	Retained for 24 hours post-verification, then deleted.	Secure deletion and cache clearance.
Device and session data	Security monitoring and fraud prevention.	Retained for 12 months from collection.	Automatic log expiry and secure deletion.
Transactional data and audit logs	To evidence DIATF-compliant verification activities.	Retained for 7 years as required by DIATF audit requirements.	Encrypted archival; deletion after expiry.

5. Secure disposal

At the end of its retention period, personal data collected via the Xertilox mobile app will be securely disposed of in accordance with guidance from the UK National Cyber Security Centre (NCSC) and NIST SP 800-88 Rev.1 standards. Depending on the storage medium, one or more of the following techniques will be used:

Cryptographic erasure: where data is encrypted, secure destruction of the encryption keys will render the data inaccessible.
Overwriting (“Clear”): applying one or more passes of random data to securely overwrite information on storage media.
Secure purge: for SSDs and flash storage, using manufacturer-supported purge commands compliant with NIST Purge standards.
Physical destruction: where digital deletion is not sufficient, storage devices will be shredded, degaussed or destroyed to NCSC-recommended standards.
Factory reset for mobile devices: any data temporarily stored on mobile devices will be securely wiped using a full factory reset process.

Where data is processed by authorised third-party processors, they must provide written confirmation that secure deletion has been completed in line with NCSC guidance and DIATF compliance requirements.

6. User rights

Under the UK GDPR, users of the Xertilox mobile app have the following rights regarding data retention:

Right of access: users can request confirmation of what data is stored and for how long.
Right to erasure: users can request deletion of their data unless retention is required by law.
Right to object: users can object to processing where lawful grounds allow.

Requests should be submitted to privacy@xertilox.com.

7. Roles and responsibilities

Data Protection Officer (DPO): Ensures compliance with this policy and relevant laws.
Engineering and product teams: Implement automated retention and deletion controls.
Third-party processors: Must comply with this policy and provide evidence of secure deletion.

8. Review and updates

This policy will be reviewed annually, or sooner if required by changes in:

Regulatory or legislative requirements (for example DIATF updates)
Business operations or mobile app architecture
Security threats or risk assessments

9. Related policies

Xertilox Privacy Policy
Xertilox Information Security Policy
Xertilox Data Protection Policy
Xertilox Incident Response Plan

Contact

If you have any questions about this Data Retention Policy, you can contact us at:

Email: info@xertilox.com
Phone: +44 20 4538 0684