Data Retention Policy
Agentic Business Intelligence Solutions Limited ("ABIS HK")
Last updated: 21 October 2026
1. Purpose
This Data Retention Policy sets out how long ABIS HK retains different categories of data and the legal basis for retention. It applies to all data collected through our website and Student Services.
2. Principles
- Lawfulness: We retain data only for as long as necessary for the purposes for which it was collected, or as required by law.
- Proportionality: Retention periods are proportionate to the sensitivity and purpose of the data.
- Security: Data retained beyond active use is stored securely with access controls.
- Transparency: Users are informed of retention periods via this Policy and our Privacy Policy.
- Right to request deletion: Users may request that we cease processing and delete their personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations. We will comply with such requests to the extent permitted by applicable law.
3. Categories and Retention Periods
| Category | Description | Retention Period | Legal Basis |
|---|---|---|---|
| Website analytics | Aggregated, anonymised visit data (page views, session duration) | 25 months | Lawful and fair collection for the specified purpose of service improvement |
| Website analytics (IP) | IP addresses logged for abuse prevention | 90 days | Lawful and fair collection for the specified purpose of security and abuse prevention |
| Contact form submissions | Name, email, message content submitted via public website | 24 months | Consent / contractual necessity to respond |
| Account registration data | Parent/Student name, email, age, verification records | Duration of account + 7 years | Contractual performance, tax/accounting compliance |
| Payment records | Transaction history, invoices, receipts | 7 years | Hong Kong Inland Revenue Ordinance (Cap. 112) |
| Payment credentials | Card tokens held by Stripe | Per Stripe's policy | Payment processing necessity |
| Agent configurations | Task templates, schedules, parameters set by Student | Duration of account + 90 days | Contractual performance |
| Task execution logs | Timestamps, success/failure, token consumption | Duration of account + 90 days | Contractual performance, service improvement |
| Non-flagged LLM conversations | Raw LLM interaction logs where no safety alert triggered | Duration of account + 90 days | Contractual performance, support |
| Safety-flagged conversations | LLM interactions that triggered a safety alert | 12 months from alert date | Child safeguarding obligations, legal defence |
| Investigation records | Data flagged for lawful activity review | Until investigation concluded + 3 years | Legal compliance |
| Legal hold data | Data subject to active legal hold | Until legal hold lifted | Legal compliance |
| Support tickets | Email exchanges with support team | 24 months | Contractual performance, service improvement |
4. Post-Termination Retention
When an account is terminated or a subscription expires:
- Active service data (agent configs, task logs, non-flagged conversations) is moved to a restricted-access archive for 90 days, after which it is securely deleted.
- Safety-flagged data (if any) remains in the secure archive for 12 months from the alert date, after which it is securely deleted.
- Account metadata (name, email, transaction history) is retained for 7 years to comply with tax, accounting, and regulatory obligations.
- Investigation records (if any) are retained until the investigation is concluded plus 3 years.
Important: Termination of an account does not trigger immediate deletion of all data. The periods above apply regardless of termination.
When we have no ongoing legitimate need to process your personal information: We will either delete or anonymize it, or, if this is not possible (e.g., legal obligations), we will securely store it and isolate it from any further processing until deletion becomes possible.
5. Legal Hold Exception
Notwithstanding any retention period, ABIS HK may suspend deletion of any data if:
- We become aware of an actual or potential legal claim, dispute, or investigation;
- A law enforcement or regulatory authority requests preservation;
- We reasonably believe the data relates to unlawful activity, fraud, or a breach of our Terms.
Data subject to a legal hold will not be deleted until the hold is formally lifted by ABIS HK's legal team.
6. Deletion Methods
- Electronic data: Securely overwritten using industry-standard methods or deleted from active databases and backups in accordance with backup rotation schedules.
- Backups: Data in automated backups is retained per backup schedules (typically 30 days). Data deleted from active systems will not be restored from backup unless required by legal hold.
- Logs: System logs may retain anonymised or pseudonymised data indefinitely for security and analytics purposes.
7. User Rights
Users (or their Parents, for minors) may request:
- Access: A copy of their personal data held by ABIS HK. Fees: HK$50 per request for data not older than one year; HK$100 per additional year of data requested. We will inform you of the estimated fee before processing your request.
- Correction: Correction of inaccurate or incomplete data.
- Request cessation/deletion: Users may request that we cease processing and delete their personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations. We will comply with such requests to the extent permitted by applicable law. Requests should be sent to privacy@abishk.ai.
We will respond to such requests within 40 days, or as required by applicable law.
8. Policy Review
This Policy is reviewed annually or whenever there is a material change to our data processing activities or applicable law.
9. Contact
For questions about this Data Retention Policy, contact us at privacy@abishk.ai.