1. Overview
This Data Retention Policy describes how eIDAS Pro ("we," "our," or "us") retains, stores, and manages data collected through our identity verification services. This policy is part of our commitment to GDPR compliance and data protection best practices.
We adhere to the data minimization principle—we only collect and retain data that is necessary for providing our services, and we delete data when it is no longer needed.
2. Verification Data
Data Minimization by Design
eIDAS Pro never receives or stores identity documents, biometric data, or passport scans. A date of birth shared from an EU Digital Identity Wallet is compared with the required age in memory and discarded; the technical identifier of a bank login (iDIN) is used only while the response is checked. Neither is stored.
| Data | Kept for | How it is removed |
|---|---|---|
| Verification session (merchant, verification type, method, status, yes/no result, timestamps) | Until it expires, 15 minutes after it starts | Deleted automatically; the clean-up runs every 5 minutes |
| Pending bank-identity response from our broker | Until it expires, 15 minutes after it arrives | Deleted by a daily clean-up |
| Verification audit record (merchant, session reference, method, outcome, refusal reason, duration, error type) | 365 days | Deleted by a daily clean-up |
| Webhook delivery history (Scale plan) | 30 days | Deleted by a daily clean-up |
The verification audit record contains no IP address, no browser or device identifier, no identifier of the person verifying and no date of birth. These periods are the same on every plan.
3. Account, Partner and Technical Data
| Data | Kept for | How it is removed |
|---|---|---|
| Customer account data and billing records | Duration of the contract, then 10 years (accounting obligation, see section 4) | On request, once the accounting period has passed |
| Dashboard sign-in links | Until they expire | Deleted by a daily clean-up |
| Dashboard sessions | Until they expire, time out or are signed out | Deleted by a daily clean-up |
| API keys | While the account exists; a revoked key stops working immediately and is kept, unusable, with the account | Deleted with the account |
| Partner and applicant contact and company details, IBAN and payout records | Duration of the partner relationship, then 10 years (accounting obligation) | On request, once the accounting period has passed |
| Rejected partner applications | 12 months after the decision | Deleted by a daily clean-up |
| Partner applications not yet decided | Until we decide on them | Not deleted automatically |
| Commission records | 10 years (accounting obligation) | On request, once the accounting period has passed |
| Web server logs (IP address, user agent, requested URL) | 14 days | Log rotation |
| Rate-limit counters | One minute | Expire automatically |
| Administrator console sign-in events | 90 days | Deleted by a daily clean-up |
| Administrator console actions | 180 days | Deleted by a daily clean-up |
| Error reports (Sentry) | According to our Sentry plan's retention | Deleted by Sentry |
| Marketing contact data | Until you unsubscribe or ask us to delete it | On unsubscribe or request |
4. Legal Basis for Retention
We retain data based on the following legal grounds under GDPR:
- Contract performance - To provide the services you have subscribed to
- Legal obligations - Accounting records (invoices, payment, commission and payout records) are kept for 10 years from the end of the financial year they relate to, as required by Article 16 of the Luxembourg Commercial Code
- Legitimate interests - Security, fraud prevention, service improvement
- Consent - Marketing communications and the other processing described in our Privacy Policy, until consent is withdrawn
5. Data Storage and Security
5.1 Storage Location
Our servers, database and backups are in the European Union:
- Servers - Hosted by Macronet System Kft. in Hungary
- Primary database - Supabase, stored in Frankfurt, Germany (AWS eu-central-1). Supabase and its US affiliate can access it from Singapore and the United States under the EU Standard Contractual Clauses
- Backups - We take database backups, for example before each release, and store them access-restricted on our server in Hungary. Each backup is kept for at most 30 days. A deleted record can therefore remain in a backup until that backup expires; after that it is gone. We use backups only to recover from failures, never to restore records that were deleted on purpose
Some of our other providers store data outside the EU, for example our e-mail provider in the United States. Our Sub-processors page lists where each provider stores data and the safeguards for any transfer.
5.2 Security Measures
- Encryption in transit (TLS) for all connections
- Database encryption at rest by our database provider
- Administrator console reachable only over a private network
- Two-factor authentication for dashboard accounts, with its secrets encrypted at rest
6. Automated Deletion
The clean-up jobs named in sections 2 and 3 run automatically: the verification session clean-up every 5 minutes, all other clean-ups once a day. Records kept for accounting reasons are not deleted automatically; we delete them on request once the legal retention period has passed.
7. Account Termination
When you ask us to close your eIDAS Pro account:
- Immediately - API access is revoked
- Within 30 days - Your account data is permanently deleted
- Exception - Invoices, payment, commission and payout records are kept for 10 years from the end of the financial year they relate to (Luxembourg accounting obligation), and then deleted
Verification sessions and audit records follow the periods in section 2 whether or not your account is closed. Verification audit records are your proof that you verified, and they contain no identifier of the person verifying, so we keep them until their normal 365-day expiry and then delete them. You may ask us for an export of them or for their earlier deletion.
You may request a copy of your data before closing your account. See our Deletion Procedures page for details.
8. Your Rights
Under GDPR, you have the following rights regarding your data:
- Right to access - Request a copy of your data
- Right to rectification - Correct inaccurate data
- Right to erasure - Request deletion of your data
- Right to restriction - Limit how we process your data
- Right to portability - Receive your data in a portable format
- Right to object - Object to certain processing activities
- Right to withdraw consent - At any time, without affecting processing that took place before
To exercise these rights, contact us at support [at] eidas-pro.com or visit our Deletion Procedures page.
9. Customer Responsibilities
Important: Your Data Retention Obligations
If you store verification results in your own systems, you are a data controller and must implement your own retention policies.
Ensure your retention periods are proportionate to your use case and comply with applicable regulations (GDPR, AML/KYC, industry-specific requirements).
10. Policy Updates
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:
- Email notification to account administrators
- Notice on our website
- 30 days advance notice for significant changes
11. Contact Us
For questions about this Data Retention Policy:
Email: support [at] eidas-pro.com Support: eidas-pro.com/support
Last Updated: October 20, 2026 Version: 2.0