Data Return, Retention, Deletion and Legal Hold Policy

1. What this policy covers

This policy says what happens to what is in a MandateRoom data room: how you get your data back, how long we keep it, how it is deleted, what we keep as evidence, and how a legal hold works. It is part of the Terms of Service and the Data Processing Addendum. "Customer Content" means the documents and other material you upload and the content users create in a Room.

2. While your subscription runs

A Room's administrators control the Room. They can withdraw anyone's access at once; move a Room to the trash and restore it; archive a Room, which freezes it and records a sealed snapshot of what it held; and place a legal hold on it (section 7). Archiving does not shorten a paid term and does not delete anything.

3. When a subscription ends

A subscription ends at the end of its term, or on termination under the Terms of Service. If it ends because a term was not extended or an invoice is unpaid, the Room is read-only for 14 days first. We then do the following.

• Copy window: 30 days. From the day access ends we keep your Customer Content for 30 days so that you can ask for a copy. If you write to hello@mandateroom.com with "Data return" in the subject line during that window, we make available to you a copy of the files you uploaded, and the audit and legal exports the Service can produce for your Plan, in the form in which they exist. We do not create other formats. The Service does not offer a one-click export of an entire Room.
• Deletion: within 30 days after the copy window. Unless you tell us to delete sooner, we then delete your documents, the converted page images and previews made from them, and their search entries, from our storage and from our providers' storage, so that their storage is no longer addressable. A legal hold, a legal requirement or section 5 can stop or limit deletion.
• Sooner, on instruction. You may instruct us in writing to delete at any time. We will do so within 30 days of a verified instruction, subject to the same exceptions.
• Written confirmation. On request, we confirm in writing what we deleted and when, and what we kept and why.

4. Deleted means deleted, with limits

When we delete Customer Content we delete the stored files and derived files, not just hide them. We cannot recall a copy that someone has already downloaded or photographed, and we cannot undo what a person has seen. Backups held by our providers are not used to restore individual deleted items; they expire on the providers' own cycles, and we aim for deleted data to leave backups within 90 days. If we ever restore from a backup to recover from a failure, we delete again whatever was deleted before.

5. Records we keep as evidence

A data room is a record of who saw what, and that record is worth little if it can be rewritten. We therefore keep these records as evidence, and do not delete them when a Room or an account is deleted: the audit ledger of security-relevant actions; the records of who opened, downloaded or asked about what; the questions and answers asked in a Room and the records of requests; the records of NDA and Terms acceptances; and the records of legal holds, exports and deletions. We keep them for at least seven years from the date they were made, and the audit ledger is pruned only after that period and only where no legal hold applies. They can contain the text of questions asked in a Room, the names and email addresses of participants, and IP addresses.

When an erasure request is granted for a person (section 8), we do not delete these records; we make the person's identifiers in them permanently unreadable by destroying the encryption key that protects them. The record that an event happened remains. This protects the people who relied on the record, and the person who asked for erasure, in the way the law allows.

6. What the law may require

Some laws require us to keep records for a minimum period, for example tax and accounting records, for up to eight years after the end of the financial year. A court or an authority can require us to preserve data. Where a legal requirement or a legal hold applies, it takes precedence over a deletion or erasure request, over the Room's own retention setting, and over the periods in this policy, in that order of strength: a legal hold first, then a legal minimum, then an erasure request, then a business retention period.

7. Legal holds

A Room's administrators can place a Room under a legal hold, and a person authorised on behalf of a Customer can ask us in writing to do so; we act within one business day of a verified request. We may also preserve data where a court or an authority lawfully requires it, and we will tell the Customer unless the law forbids it. While a hold is in place, nothing in the Room is destroyed and no erasure that touches it is carried out. A hold ends when the Customer releases it, or when we are lawfully told that it has ended. After it ends, deletions and erasures that it blocked proceed.

8. Erasure requests from individuals

If you ask for personal data about you to be erased, we handle the request as our Privacy Policy describes. Where the data is in a Room, we pass the request to the Customer, which decides, and we help it carry it out. An erasure that a legal hold or a legal minimum blocks is not refused: we accept it, record it with the reason and the earliest date it can proceed, and carry it out automatically when the block ends, and we tell the requester.

9. Retention periods in brief

10. How to ask

Write to hello@mandateroom.com with one of these subject lines: "Data return", "Deletion request", "Legal hold" or "Erasure request". We reply within five business days, and tell you what we will do and by when.