Data Retention & Disposal Policy

1. Purpose

To define how long Backpack Works retains data and how it is securely disposed of or returned.

2. Principles

• We retain data only as long as needed for the purpose it was collected or as required by contract or law.
• Customer account data and website-visitor data are retained for the life of the account and deleted or returned on request after termination, subject to legal retention requirements.

3. Retention

• Customer & account data (Backpack OS): retained for the life of the account; deleted or returned on request after termination.
• Client project data: retained for the duration of the engagement plus an agreed wind-down period, then deleted or returned.
• Business records: retained per legal and tax requirements.
• Logs: retained for a period sufficient for security investigation.

4. Secure disposal

• Electronic data is deleted using methods that prevent recovery.
• Cloud data is removed from active systems and backups age out per backup retention.

5. Requests

Customers can request export or deletion of their data by contacting privacy@backpack.works.

6. Review

This policy is reviewed at least annually.