Data Retention & Deletion Policy

This Policy explains how 42 Scandinavia AB retains and deletes information processed through its Services.

It should be read together with the:

• Master Terms of Service
• Privacy Policy
• Data Processing Agreement
• Backup & Disaster Recovery Policy

42 Scandinavia follows these principles:

• retain data only where necessary;
• delete data when no longer required;
• comply with legal retention obligations;
• minimise retained personal data;
• enable Customers to export their own data.

While a Subscription remains active:

• Customer Data remains available through the Services;
• backups are performed according to the Backup Policy;
• Customers may export their data using available export functionality.

When a Subscription ends:

Day 0

• The Subscription ends.
• Access to the Services may be disabled.

Days 1–30

• Customer Data remains available for recovery and export where technically possible.
• Customers are encouraged to export all required information during this period.

After Day 30

• Customer Data is scheduled for deletion from production systems.
• Deletion may occur sooner where requested by the Customer, provided no legal obligation requires continued retention.

Deleted Customer Data may continue to exist in encrypted backup media for up to 90 days.

Backup copies are retained solely for disaster recovery purposes.

Backup data is not restored except where necessary to recover systems following an operational incident.

When backup retention expires, backup copies are automatically removed through the normal backup lifecycle.

Certain information may be retained beyond the standard retention periods where required by applicable law.

Examples include:

• invoices;
• accounting records maintained by 42 Scandinavia;
• tax documentation;
• records necessary to establish, exercise or defend legal claims.

These obligations apply only to information that 42 Scandinavia is legally required to retain.

Customers are responsible for:

• exporting required data before deletion;
• complying with their own legal retention obligations;
• ensuring they maintain copies of information they are legally required to retain.

For 42 Ekonomi, the Customer remains responsible for complying with Swedish bookkeeping and accounting legislation.

Use of the Service does not transfer those statutory obligations to 42 Scandinavia.

Personal Data is retained only for as long as necessary for the purposes described in the Privacy Policy and applicable agreements.

Where Personal Data is processed on behalf of Customers, deletion is performed according to the Customer's instructions as reflected in the Agreement and applicable Product Schedule.

Customers may request deletion of Customer Data before the standard retention period.

42 Scandinavia will comply unless:

• continued retention is required by law;
• deletion would prevent compliance with contractual obligations;
• retention is necessary for the establishment, exercise or defence of legal claims.

42 Scandinavia uses reasonable technical and organisational measures intended to ensure that deleted Customer Data is no longer available in production systems after the applicable retention period.

Residual copies may continue to exist only within the normal backup lifecycle.

This Policy may be updated from time to time.

Material changes will normally be announced at least thirty (30) days before taking effect.

Questions regarding this Policy may be directed to:

42 Scandinavia AB

Organisation No. 556827-3204

P O Hallmans gata 3

SE-112 06 Stockholm

Sweden

Email: magnus.backlund@42scandinavia.se