Data Retention, Deletion and Anonymization Policy
This policy explains how long personal data processed in connection with the platform by Visual Memory Works GmbH (“VMW”) is stored and under what conditions it is deleted or anonymized.
RETENTION PERIOD
Personal data is stored only for as long as necessary for the purposes of the processing (Art. 5(1)(e) GDPR). In doing so, the retention periods provided for in applicable law are taken into account. The following applies to the main data types:
- Account and customer content: They are stored for as long as the account is active. When the account is terminated, access is closed and deletion is carried out without delay. The account and customer content are removed from the active systems and from the associated backups within 30 days at the latest. If data is restored from a backup, data that has already been deleted must not be made usable again.
- AI chat history: Where necessary, the history of a conversation is stored for a maximum of six months from the last interaction in that conversation. After that, it is deleted or effectively anonymized. Justified requests for earlier deletion are reviewed separately.
- Invoices and accounting records: They are stored for the duration of the applicable statutory retention obligations. Statutory obligations and specific legal disputes are each handled with their own required periods; they do not justify retaining all account content.
- Support correspondence and technical logs: They are stored for as long as necessary for processing, traceability and security; after that, they are deleted or anonymized. No fixed period applies to them. The support targets of 24 and 48 hours are response targets, not retention periods.
The retention period of data that customers upload to the platform depends on the respective account; for this data, the respective businesses are controllers, and VMW processes it as a processor on their instructions. Upon termination of the account, the deletion period of 30 days applies.
DELETION AND ANONYMIZATION
Personal data is deleted, destroyed or anonymized when
- the purpose that required its processing no longer applies,
- the retention period provided for in applicable law has expired, or
- a justified request for deletion by the data subject exists and there is no longer any statutory retention obligation.
Deletions are carried out using specific technical procedures, taking into account the system architecture and backup processes.
ACCOUNT DELETION AND TERMINATION OF THE SERVICE
When users terminate their account, access to the account is closed and deletion is carried out without delay. The account and the customer content are removed from the active systems and from the associated backups within 30 days at the latest.
Individual data may be retained for longer insofar as a statutory obligation (for example retention of invoices under commercial and tax law) or a specific legal dispute requires this for that data. This retention is limited to the documents concerned and is not a reason to keep further account or customer content.
BACKUPS AND DELETION PROCESSES
System backups are created to ensure service continuity. Deleted data is also removed from the associated backups within the period of 30 days. If data is restored from a backup, data that has already been deleted is not made usable again.
AI CHAT HISTORY
The history of conversations with the AI functions is, where necessary, stored for a maximum of six months from the last interaction in the respective conversation and is then deleted or effectively anonymized. Justified requests for earlier deletion are reviewed separately.
A distinction is made between three purposes for the chat history: (1) to provide and continue the service (for example so that a conversation stays coherent), (2) for error analysis and quality improvement, and (3) for training AI models.
On (2): Where VMW uses chat content for error analysis and quality improvement, it does so not across the board and not indefinitely for all conversations, but only for this specific purpose, to the extent necessary for it, and on the basis of Art. 6(1)(f) GDPR. In doing so, it is first checked whether the goal can also be achieved with anonymized or non-personal data; where this is possible, data is effectively anonymized. Our interests are weighed against your interests, fundamental rights and freedoms. You may object to this processing on grounds relating to your particular situation under Art. 21 GDPR.
On (3): We do not use personal chat content to train AI models. Should such use be considered in the future, we will inform you separately beforehand and ensure the required legal basis. Whether providers of AI functions use inputs for their own purposes under their own terms depends on the service used and the configuration; the providers describe the details in their privacy notices.
REQUESTS FROM DATA SUBJECTS
Data subjects may request the deletion of their data in accordance with the GDPR (Art. 17 GDPR). These requests are reviewed taking into account statutory retention obligations and technical limitations. If the request concerns data for which a business as a customer is the controller, VMW forwards the request to that business where necessary.
Please direct requests to Visual Memory Works GmbH, Elbestraße 10, 45768 Marl, Germany, e-mail: erguen.kalayci@visualmemoryworks.de (contact person for data protection inquiries: Prof. Ergün Kalaycı). Further information is provided in the document “Personal Data Requests — Access, Correction, Export and Deletion”. You also have the right to lodge a complaint with a data protection supervisory authority.
CHANGES
This policy may be amended in the event of changes in the law or updates to the system infrastructure. The current text applies from the day of its publication.