Version 24 September 2026
1.1 In this Retention Schedule the following terms have the following meanings. Capitalised terms not defined here have the meanings given in the Privacy Policy.
1.2 A period expressed in days runs from the event stated in the column "Period runs from". Where no event is stated, the period runs from the creation of the Record.
2.1 The Company retains Personal Data only for as long as necessary for the purposes for which it is processed, and for no longer than the periods set out in this Schedule.
2.2 The Deletion Routine runs at least once every 24 hours. A Record whose period has ended is deleted within 24 hours after the end of the period.
2.3 Deletion means erasure from the Production Database and from every other system of the Company in which the Record is held, save for copies of the Production Database, which are governed by Section 5.
2.4 Records that do not relate to an identified or identifiable natural person, including aggregated statistics, may be retained without limit.
| # | Record | Content | Retention period | Period runs from | Also deleted on |
|---|---|---|---|---|---|
| 3.1.1 | Account | Email address; password verifier; dates of creation and last use; version of the Terms accepted and time of acceptance | Life of the Account. The Company may delete an Account that has not been accessed for 730 days, after 30 days' notice to its email address | Last access | Deletion of the Account |
| 3.1.1A | Application Data | Full name; company; telephone number; company email address, as stated in the application; and the decision on it — opened or refused, by whom, when and why | Life of the Account; the decision itself for five years as a screening record under row 3.5.4 | The application | Deletion of the Account, except the screening record |
| 3.1.2 | Starred Items | Well Library entry identifiers and names | Life of the Account | — | Unmarking; deletion of the Account |
| 3.1.3 | Customer Content | Saved Calculations: input values, results, document parameters and labels | Until deleted by an Authorised User. Where access depends on a paid plan: 30 days after the end of the plan, unless a plan giving access is again in force. Where the Company closes the Account otherwise than at the Customer's request: 30 days after closure, save as provided in Section 13.6 of the DPA | End of the plan; closure of the Account | Deletion of the Saved Calculation; deletion of the Account |
| 3.1.4 | Activity Records | Time; calculation type; document type; name of the Well Library entry, or a fixed label for values entered or read from a Local File; for a Saved Calculation, its identifier only | 400 days | Creation | Deletion of the Account |
| 3.1.5 | Sign-in records | Time; method; browser, operating system and device class; country associated with the Truncated IP Address; combination of device class and country used to detect unfamiliar sign-ins | 90 days | Sign-in | Deletion of the Account |
| 3.1.6 | Sign-in sessions | Hash of the session token; Account; method; times of creation and last use | 30 days without use; 90 days in any case | Last use; creation | Sign-out; "Sign out everywhere"; setting, change or removal of a password (other sessions); deletion of the Account |
| 3.1.7 | Known-browser identifiers | Hash of the browser identifier; Account; time | 180 days; not more than ten per Account | Registration | "Sign out everywhere"; setting, change or removal of a password (other browsers); deletion of the Account |
| 3.1.8 | Sign-in code records | Email address as entered; hash of the code; hash of the requesting browser's identifier; time; attempts | 1 hour | Issue | Use of the code; issue of a new code to the same address; deletion of the Account |
| 3.1.9 | Counters of code requests, failed codes, exhausted codes, letters and new-device notices | Keyed hash of an email address (with a browser hash), an Account identifier or a mail pool name; type; time | 24 hours | Creation | Deletion of the Account |
| 3.1.10 | Counters of failed password attempts | Keyed hash of an email address; time | 15 minutes | Creation | Correct password; deletion of the Account |
| 3.1.11 | Consent Records | Choice or act; version of the notice or of the Terms; time; environment; Visitor Identifier where consent to Usage Measurement was given | 1,100 days | Creation | Visitor Identifier removed on withdrawal of consent or request for deletion |
| # | Record | Content | Retention period | Period runs from | Also deleted on |
|---|---|---|---|---|---|
| 3.2.1 | Measurement Data — events | As described in Annex A of the Privacy Policy | 400 days | Day of the event | Withdrawal of consent; request for deletion |
| 3.2.2 | Measurement Data — visits | As described in Annex A of the Privacy Policy | 400 days | Day of the visit | Withdrawal of consent; request for deletion |
| 3.2.3 | Daily totals | Counts only, without any identifier | 10 years | Day counted | — |
| # | Record | Content | Retention period | Period runs from | Also deleted on |
|---|---|---|---|---|---|
| 3.3.1 | Access log entries in the Production Database | Time; requested address; status; size; referring host name; user-agent string; Truncated IP Address; automated-request indicator | 90 days | Request | — |
| 3.3.2 | Web-server access log files | Time; requested address; status; size; referring address; user-agent string; Truncated IP Address | 14 days | Request | — |
| 3.3.3 | Web-server error log files | Error description; request; full IP address of the request | 14 days | Event | — |
| 3.3.4 | Service fault records | Reason; sample of the rejected input, with any email address reduced to its domain | 30 days | Event | — |
| 3.3.5 | Rate-limit counters held in memory | Email address, keyed hash or Truncated IP Address; count | Until the limit window ends, and in any case until the service restarts | Creation | — |
| # | Record | Content | Retention period | Period runs from | Also deleted on |
|---|---|---|---|---|---|
| 3.4.1 | Service Communications | Recipient email address; message content | Not retained by the Company after transmission, save in the message logs and mailbox copies kept by the mail provider identified in the Subprocessor List for the periods set by its terms and by the settings of the Company's account | Transmission | — |
| 3.4.2 | Correspondence Data | Messages to and from the Contact Email and other mailboxes of the Company | 3 years | Last message in the correspondence | Request for erasure, subject to Section 6 |
| 3.4.3 | Records of data-subject requests | Request; verification; response; dates | 3 years | Closure of the request | — |
| # | Record | Content | Retention period | Period runs from | Also deleted on |
|---|---|---|---|---|---|
| 3.5.1 | Business Contact Data | Name; employer; title; business contact details; notes of contact | 3 years | Last contact | Objection (a suppression entry containing the email address only is kept for as long as necessary to give effect to the objection) |
| 3.5.2 | Tester Data | Signed confidentiality undertakings and the data recorded on them: name; employer; title; country of residence or jurisdiction; registration number; postal address; email address; permitted users; signature; date | 5 years, or until the final resolution of any claim then pending; thereafter the signed undertaking alone, without contact details not recorded on it, for as long as an obligation of confidentiality under it remains in force, with review at least every 5 years | End of the evaluation period | — |
| 3.5.3 | Billing Data | Invoices; payment records; billing contact; tax identifiers | seven years | End of the financial year of the transaction | — |
| 3.5.4 | Compliance Data | Screening results; information and documents provided under the Sanctions Policy; records of decisions, reports and communications under it | five years, or longer where a Trade Control Law requires | The act to which the Record relates | — |
| 3.5.5 | Register of personal data breaches | Facts, effects and remedial action of each breach | 5 years | Closure of the entry | — |
| 3.5.6 | Superseded versions of the Terms, the Privacy Policy, the Cookie Policy, the DPA and this Schedule | Texts only | Without limit | — | — |
| # | Record | Content | Retention period | Period runs from | Also deleted on |
|---|---|---|---|---|---|
| 3.6.1 | Directory Data | As defined in the Privacy Policy | While the supplier is listed in the directory | — | Removal of the supplier; successful objection |
| 3.6.2 | Public Data | Well Library entries and reference data from public sources | While included in the Service | — | Removal from the Service; successful objection |
4.1 Cookies and entries in browser storage are retained in the User's browser for the durations stated in the Cookie Policy and may be deleted by the User at any time.
5.1 Copies of the Production Database taken on the production server are retained for 14 days and then deleted.
5.2 Off-Server Copies are encrypted before they leave the production server, are held on equipment used exclusively by authorised personnel of the Company, located in the country the operator works from, and are deleted not later than 30 days after they were taken.
5.3 No unencrypted copy of the Production Database is held outside the production server, save a copy decrypted to verify or carry out a restoration, which is deleted within 24 hours.
5.4 Copies of the Production Database are used only to verify and carry out restorations. Where the Service is restored from a copy, all Records that were deleted after the copy was taken, including deleted Accounts and deleted Customer Content, are deleted again before the Service is resumed.
5.5 Records are not deleted from copies of the Production Database on request. They expire with the copy in accordance with this Section 5.
6.1 Records subject to a Legal Hold are retained until the Legal Hold is released, and are then deleted in accordance with this Schedule, or immediately where their period has already ended.
6.2 Records may be retained beyond the periods stated where required by law, for the duration of that requirement.
6.3 Records may be retained beyond the periods stated where necessary for the establishment, exercise or defence of legal claims, for the duration of the claim and of any applicable limitation period.
7.1 Electronic Records are deleted from the systems in which they are held. Paper Records are destroyed by shredding.
7.2 Deletion of an Account removes all Records listed in Section 3.1 that relate to the Account, other than Consent Records, which retain no identifier of the Account, in a single operation.
8.1 The Company reviews this Schedule at least once a year and on any change to the categories of Records processed.
9.1 Pallarium, hello@pallarium.com; before its incorporation, the founder of Pallarium. Contact Email: [CONTACT EMAIL = hello@pallarium.com].