Privacy and retention addendum

Version

2026-08-23-final-live-v3

Effective from

2026-08-22T23:00:00.000Z

SHA-256

7ad2e73f5175c696b1dd0aa958e1df403a15458de13925dc7bd84196fbe41a49

1

This addendum does not replace the current privacy policy or alter its existing hash. It becomes effective only as a newly published version after approval.

2

Retention periods: transaction, acceptance, and accounting records for 6 years; DAC7 and due-diligence data for 10 years; security logs for 12 months unless an incident or legal duty requires longer.

3

Inactive profile data is deleted or anonymised after 24 months without activity unless mandatory retention applies. Disputed data is kept until closure and the relevant claims period.

4

KYC documents and bank data remain with Stripe; Vestoora stores only necessary references and statuses. Access is limited, audited, and minimised.

5

These periods may be shortened or extended where data-subject rights or binding ES, PL or EU duties require it.