Data Retention Schedule
Version 2026-08-11 - Karri AB, org. no. 559250-7700
This schedule forms Annex 3 to the data processing agreement. Where a customer organisation instructs a shorter period, the shorter period applies, except for records we must keep by law.
| Data category | Retention period |
|---|---|
| Account data (email, alias, role, membership status) | While the account exists; deleted within 30 days of account deletion |
| Activity and training entries (type, value, date, note) | While consent is active and membership continues; erased immediately on consent withdrawal, workspace exit or account deletion |
| Uploaded photos | Same as activity entries; erased with the entry or on account deletion |
| Training routines and exercise plans | While the account exists; deleted with the account |
| Coaching relationships and messages | Until the relationship is ended by either party, then 30 days |
| Consent and legal-acceptance records | Kept as evidence of compliance for 3 years after the consent ends, then deleted |
| Data-processing agreement acceptances | Kept for the duration of the customer relationship plus 3 years |
| Privacy-rights requests and their outcome | 3 years from completion |
| Security and audit logs of administrative actions | 12 months |
| Support tickets and correspondence | 24 months from closure |
| Billing and invoice records | 7 years, as required by the Swedish Accounting Act |
| Backups | Managed by the hosting platform. Deleted data can persist in backups until the backup lifecycle completes, and we do not selectively edit historical backups. We do not control the exact backup schedule; restored data is re-deleted. |
Deletion events
- Consent withdrawal. All activity entries are erased immediately. The account remains so the member can re-consent or delete it separately.
- Leaving a workspace. Activity entries belonging to that workspace are erased and the membership record is removed.
- Account deletion. Profile, activity data, photos, training plans and coaching links are deleted; consent evidence, audit entries and billing records are kept for the periods above. Deletion applies to the live service; copies may remain in platform backups until those backups expire.
- Workspace deletion. All member profiles, activity data and content in the workspace are deleted within 30 days, or returned in a machine-readable export first if the customer requests it.
Questions about retention: info@upzdownz.com.