Data Retention Policy

Effective From: November 15, 2026 (Version 1.0)

1. Introduction 

As part of our commitment to privacy and data minimization principles, we have procedures for how we handle and retain certain Customer Data (defined below) in connection with the Services. 

This "Policy" sets out these procedures and complements our Privacy Policy and Data Processing Addendum, which prevails to the extent of any inconsistency. Nothing in this Policy is intended to limit your rights under applicable law including any privacy law.  This Policy applies to Circularo SaaS and DMS-only subscriptions, as well as Add-Ons, including any API functionality. 

2. Definitions

All capitalized words in this Policy have the same definition as the Terms of Service, except for the following:

2.1 Customer Data refers to Customer Content (as defined in the Terms of Service) and, in relation to a specific item of Customer Content, the associated metadata then-currently supported by the Service. It does not include Transaction Data, Testing Data, Non-Production Data or Support Data. 

2.2 Non-production data means data provided by you into non-production environments, including any staging, sandbox or similar environments. 

2.3 Testing data means any data provided by you for testing or demonstration purposes 

2.4 Transaction Data means data that constitutes a Transaction and forms part of the Transaction’s auditable log. 

2.5 Support Data means data provided or generated by you when making a Support Request or during resolution of a Support Request. 

3. Control of Customer Content 

3.1 As a Customer or User, you control the Customer Data that we store in Circularo SaaS or process using our API. You select the Customer Data that you upload and use in connection with Circularo SaaS and, subject to service availability as set out in our Service Level Agreement, you can view and remove your Customer Data at any time. You can request deletion of your entire User Account (including all associated Customer Data) by making a request as set out below (5. User Requests). However, if you are a User associated with a Corporate Customer, your organization’s administrator can modify and restrict your ability to access and remove Customer Data and you will need their permission to delete your Customer Data.

3.2 If you are a Corporate Customer, you can delete all User Accounts (including all associated Customer Data) associated with your organisation by making a request as set out below (5. User Requests). 

4. Data Retention 

4.1 We will make commercially reasonable efforts to retain your Customer Data for the period of time set out below (“Retention Period”): 

5. User Requests 

5.1 At any time during the subscription period, you can request us to delete your Customer Data. However, you cannot request deletion of Customer Data that does not belong to you or, if you are a User associated with a Corporate Customer, is controlled by your organization. 

5.2 You can make a request by emailing privacy@circularo.com. In your email, you must include the following information:    

• your full legal name (first name and surname/family name);  

• the name of the organization (‘Customer’) with which you are associated (if any); and 

• description of the type of data to be removed. For example, if you are a Corporate Customer, you may request deletion of the full tenant with all its accounts, data, backups and logs.

6. Transaction Data 

Given the nature of certain Services, we (or a third party) may be required to retain a permanent record of Transaction Data and certain Customer Data, as this data forms part of the relevant transaction. 

For example, if you upload a document to Circularo SaaS and apply an electronic signature to this document, certain Transaction Data and Customer Data form part of the upload and the signature. This data becomes part of the electronic signature and is recorded electronically as an auditable log. Log data might include information such as a User’s name, email address, information about the document, device and approximate location associated with the transaction, and we retain only the audit log data necessary to enable confirmation of the document’s signature. We do not retain or cannot reproduce a document’s content after its deletion from our systems, however, do retain a ‘digest’ of the document’s content that enables you to match it with its  audit log. This Transaction Data  will become part of the signature records associated with that qualified electronic signature.  This includes Services provided in connection with non-qualified, advanced or qualified trust services, as defined under eIDAS and ETSI standards. 

7. Exporting Customer Data 

At any time, prior to the end of your subscription period, you can retrieve and export the following customer data:    

• Documents and document content

• Attachments

• Certificate of completion

• Audit trails 

• Metadata

You can export these customary data free of charge in any of the following formats: list supported formats 

• ZIP - binary files, attachments and audit trails 

• PDF - Certificate of Completion) 

• CSV - metadata 

It is your responsibility to export Customer Data before the end of your Subscription Period or the effective date of any termination. We may, but are under no obligation to, remind you to do so.