Principles
- Personal data is kept only as long as needed for the purpose it was collected for, to comply with the law, or to establish, exercise or defend legal claims. After that it is securely deleted or anonymised.
- Data of declined applicants and of borrowers who have paid everything they owe is never kept indefinitely.
- Retention periods are reviewed at least once a year.
Retention periods
| Data | Kept for |
|---|---|
| Personal data in general (account, identity verification, credit line, cash-outs, payments, statements, agreements, support) | At most 3 years after your account is closed, unless a law requires us to keep it longer |
| Declined or withdrawn applications and their assessments | 12 months after the decision or withdrawal |
| Device push tokens | Until you turn notifications off or the token is no longer active |
| Marketing consent | Until you withdraw it |
Where a law requires a record to be kept longer, it is kept only for that legal period and only for that purpose.
Legal holds
A complaint, a legal case, a regulator's request or an investigation suspends deletion of the records concerned until it is resolved.
How data is deleted
- Records are deleted, or replaced by anonymised statistics.
- Stored files, such as identity document images, are deleted.
- Deleted data disappears from backups when the backup period ends.
- Deleting one person's data never affects another borrower's data.
Your rights
You may ask our Data Protection Officer, through Support in the Alwan app, which of your data we still hold and when it will be deleted. See the Privacy Notice.