This policy defines exactly how long VIGIL retains each category of data, the legal basis for each retention period, and how data is securely deleted when it reaches the end of its life. No data is held longer than necessary. No exceptions.
Data held longer than necessary is not an asset — it is a liability. Every retention period in this policy is the minimum required to fulfil a legal obligation or a legitimate operational purpose. When that purpose ends, the data is deleted. That is the standard we apply to all data, without exception.
This Data Retention Policy establishes the periods for which Anshin Risk and Resilience Consulting Private Limited (trading as ARRC Global) retains data processed in connection with the VIGIL platform and its associated operations. It applies to:
This policy applies to all ARRC Global personnel, contractors, and any third party acting on ARRC Global's behalf in connection with the VIGIL platform. Compliance is mandatory.
Where a client's Data Processing Agreement specifies retention periods that differ from the defaults in this policy, the DPA terms govern for that client's data. The defaults in this policy apply in all other cases.
The following schedule defines the retention period for each data category processed by ARRC Global in connection with VIGIL. All periods run from the date specified in the "Period Starts" column.
| Data Category | Retention Period | Period Starts | Legal Basis & Rationale |
|---|---|---|---|
| Platform User & Account Data | |||
| Active user account data — name, email, job title, role | Duration of active subscription | Account creation | Contract performance — necessary to provide the platform service |
| Account data post-termination | 30 days | Subscription termination date | Legitimate interest — allows data export and dispute resolution window before deletion |
| Authentication credentials — hashed passwords, MFA tokens | Duration of active account + 30 days | Account creation | Contract performance; security — credentials deleted with account |
| Session tokens | Session expiry + 24 hours | Token issuance | Security — expired tokens retained briefly to detect replay attacks |
| Client-Uploaded & Assessment Data | |||
| Client-uploaded site intelligence and documents | Duration of active subscription + 30 days | Upload date / subscription termination | Contract performance; DPA. Default 30-day post-termination window for client export. Overridden by DPA if client specifies otherwise. |
| Assessment outputs — MSI, MCI, MRI scores, reports | Duration of active subscription + 30 days | Assessment completion / subscription termination | Contract performance — outputs belong to the client and are deleted with client data |
| Risk registers and recommendation records | Duration of active subscription + 30 days | Record creation / subscription termination | Contract performance |
| Website & Enquiry Data | |||
| Contact form and demonstration request submissions | 12 months | Date of submission | Legitimate interest — reasonable follow-up period if no engagement proceeds. Deleted at 12 months if no active relationship. |
| Marketing consent records | Until consent withdrawn + 3 years | Date consent withdrawn | Legal obligation — consent records retained as evidence of lawful basis for prior marketing |
| Website analytics data (anonymised) | 26 months | Collection date | Legitimate interest — industry standard for year-on-year trend analysis. Data is anonymised; no individual is identifiable. |
| Security & Operational Logs | |||
| Platform access and activity logs | 12 months | Log creation date | Legitimate interest; legal obligation — security audit trail, incident investigation, and regulatory compliance |
| Authentication and failed login logs | 12 months | Log creation date | Legitimate interest — brute force detection and security investigation |
| Security incident records | 5 years | Incident closure date | Legal obligation; legitimate interest — regulatory reporting obligations and insurance/litigation purposes |
| VAPT reports and findings | 5 years | Report date | Legitimate interest — evidence of security diligence for client assurance and regulatory purposes |
| System and infrastructure logs | 90 days | Log creation date | Legitimate interest — operational troubleshooting and performance monitoring |
| Commercial & Legal Records | |||
| Executed contracts and agreements — subscriptions, DPAs, NDAs | 7 years | Contract expiry or termination | Legal obligation — limitation periods for contractual claims under applicable law |
| Invoices and financial records | 7 years | Financial year end | Legal obligation — tax and accounting requirements under Indian law (Companies Act 2013; Income Tax Act 1961) |
| Client correspondence relevant to disputes | 7 years | Date of correspondence | Legitimate interest — evidence preservation within limitation periods |
| General business correspondence | 3 years | Date of correspondence | Legitimate interest — operational record and reasonable follow-up period |
| Personnel & Vendor Records | |||
| Employee and contractor records | 7 years | End of employment or engagement | Legal obligation — employment law, tax, and provident fund requirements under Indian law |
| Recruitment records — unsuccessful candidates | 12 months | Outcome notification date | Legitimate interest — potential re-engagement and discrimination claim defence period |
| Vendor and sub-processor agreements | 7 years | Agreement expiry or termination | Legal obligation — contractual limitation periods |
Client data — meaning all data uploaded by or generated for an enterprise client within the VIGIL platform — is subject to heightened retention controls reflecting its sensitivity and the contractual relationship under which it is held.
Client-specified retention. Clients whose compliance obligations require data to be retained for longer than 30 days post-termination — or deleted sooner — should specify this in the Data Processing Agreement. Contact contact@arrcglobal.com to discuss bespoke retention terms.
A legal hold suspends the normal deletion of data that may be relevant to actual or anticipated litigation, regulatory investigation, or audit. Legal holds override the retention periods in Section 3 for the duration of the hold only.
Client data and legal holds. If ARRC Global receives a legal order or regulatory requirement to retain client data beyond the contracted retention period, ARRC Global will notify the client promptly — unless the order or legal requirement prohibits such notification — and will retain the specific data required by that order only, for only as long as the order requires.
When a retention period expires and no legal hold applies, deletion is executed in accordance with the following standards. The method applied depends on the data sensitivity and storage medium.
ARRC Global does not use physical media (USB drives, external hard drives, printed documents) to store client data in the ordinary course of operations. Where physical media is used in exceptional circumstances, it is subject to secure physical destruction at end of life.
Individuals whose personal data is processed by ARRC Global have the right to request deletion of their data under applicable data protection law — the "right to be forgotten." ARRC Global will action deletion requests as follows:
To submit a deletion request, contact contact@arrcglobal.com with subject line "Data Deletion Request — VIGIL."
The complete Data Retention Policy — including implementation procedures, deletion confirmation templates, and legal hold documentation — is available as a formal document to enterprise clients and procurement teams on request.