Schedule
Data Retention & Deletion Schedule
Last updated: 6 August 2026 · v1.2
How to read this schedule
- Category: the type of data
- Retention period: how long we keep it
- Trigger: the event that starts the retention clock
- Legal basis: the GDPR lawful basis for the retention
- Deletion method: how the data is removed when the period ends
Retention table
This table covers all categories of personal data processed by Bookify Malta. Retention periods for client data (profiles, bookings) are primarily controlled by the salon. The periods below reflect the maximum: data is deleted sooner if the salon chooses to delete it.
| Data category | Retention period | Trigger | Legal basis | Deletion method |
|---|---|---|---|---|
| Business account data (owner name, email, business name, address) | Account lifetime + 30 days | Account deletion | Contract performance (GDPR Art. 6(1)(b)) | Deleted from active database; backup copies expire within 30 days |
| Staff accounts (name, email, role, permissions) | Account lifetime or until staff member removed | Account deletion or staff removal | Contract performance (Art. 6(1)(b)) | Deleted from active database immediately on removal |
| Client profiles (name, phone number, notes) | Controlled by salon, up to account lifetime | Salon deletes client or deletes account | Salon's legitimate interest / contract with client (Art. 6(1)(b) or (f)) | Deleted from active database; backup copies expire within 30 days |
| Booking requests and confirmed bookings | Controlled by salon, up to account lifetime | Salon deletes booking or deletes account | Salon's contract with client / legitimate interest (Art. 6(1)(b) or (f)) | Deleted from active database; backup copies expire within 30 days |
| Cancelled and rescheduled bookings | Controlled by salon, up to account lifetime | Salon deletes record or deletes account | Salon's legitimate interest in maintaining booking history (Art. 6(1)(f)) | Deleted from active database; backup copies expire within 30 days |
| SMS queue records and delivery metadata | Account lifetime | Account deletion | Salon's legitimate interest (Art. 6(1)(f)) | Deleted from active database; backup copies expire within 30 days. Epic does not retain message content; it may retain limited delivery and billing metadata per Maltese telecom law. |
| Activity / audit logs (dashboard actions) | 45 days | Rolling (automated daily cleanup) | Legitimate interest in security and accountability (Art. 6(1)(f)) | Automatically purged on a rolling 45-day basis by a scheduled job; backup copies expire within 30 days |
| Authentication and rate-limit logs | 7 days | Rolling | Legitimate interest in security (Art. 6(1)(f)) | Automatically purged on a rolling 7-day basis |
| Invoices, payment and subscription records | 7 years from creation | Invoice date | Legal obligation — Maltese Income Tax Management Act and VAT Act (Art. 6(1)(c)) | Retained in a pseudonymised or aggregated form after account deletion where possible; securely deleted after 7 years |
| Support conversations and correspondence | Account lifetime + 12 months | Account deletion | Legitimate interest in handling disputes and improving service (Art. 6(1)(f)) | Deleted 12 months after account deletion |
| Contact-form and onboarding submissions (not pursued) | Up to 24 months from last contact | Last contact date | Consent (Art. 6(1)(a)) | Deleted from server; form emails purged from inbox |
| Cookie consent records | 12 months from consent | Consent date | Legal obligation — ePrivacy / GDPR accountability (Art. 6(1)(c)) | Automatically expired |
| Security incident records | Duration of legal exposure + 3 years | Incident resolution | Legitimate interest in security and legal defence (Art. 6(1)(f)) | Securely archived; deleted after retention period |
| Backup copies (all data types) | 30 days rolling | Continuous | Legitimate interest in disaster recovery (Art. 6(1)(f)) | Automatically overwritten after 30 days; individual records cannot be purged from backups before natural expiry |
| Legal dispute records | Duration of dispute + 7 years | Dispute resolution or final judgment | Legal obligation / legitimate interest in legal defence (Art. 6(1)(c) / (f)) | Securely archived; deleted after retention period |
| Directory listing information (public profile data) | While the listing is published | Removal, suppression or the business's request | Legitimate interests — operating the directory (Art. 6(1)(f)); agreement with listed businesses (Art. 6(1)(b)) | Removed from the active database, sitemaps and internal search on removal; reduced to a minimal suppression record |
| Directory source and provenance records (per-field) | Up to 3 years from last review, then anonymised | Last field review | Legitimate interests — accuracy and accountability (Art. 6(1)(f)) | Anonymised or deleted after the period ends |
| Article 14 notice and objection records | Up to 3 years from the last related event | Notice sent or objection received | Legal obligation / legitimate interests — transparency (Art. 6(1)(c) / (f)) | Deleted after the period ends |
| Listing suppression records | Reviewed periodically; kept while needed to prevent accidental re-publication | Listing removal | Legitimate interests — preventing unlawful re-publication (Art. 6(1)(f)) | Minimal record only (normalised name, location identifier, previous ID, request date, reason category); never republished automatically |
| Claim and verification records | Claim decision + 12 months; identity documents deleted promptly after verification | Claim decision | Legitimate interests — ownership verification and fraud prevention (Art. 6(1)(f)) | Verification outcome retained in audit logs; identity documents never published and deleted promptly |
| Directory correction and removal request records (name, relationship, reason, contact email, evidence) | While the listing is published; up to 3 years from the last related event for dispute and objection records | Request resolution | Legitimate interests / legal obligation — handling requests and disputes (Art. 6(1)(f) / (c)) | Deleted after the period ends; reduced to a minimal suppression record after removal |
Important notes
- Salon-controlled data: Client profiles, bookings, and related records are under the salon’s control. The salon decides when to delete them. Bookify deletes them when instructed by the salon or when the salon’s account is deleted.
- Backup limitation: Individual records cannot be removed from backup copies before the backup naturally expires (30-day rolling window). After account deletion, your data will disappear from backups within 30 days.
- Tax records: Invoices and payment records are retained for 7 years as required by Maltese tax law. After account deletion, these records are pseudonymised where technically feasible.
- Legal holds: If we receive a legal hold or preservation order, the affected data will be retained beyond the normal period until the hold is lifted. We will notify you unless prohibited by law.
- Anonymised data: Aggregate, anonymised statistics (e.g. total bookings processed, average no-show rates) do not constitute personal data and are not subject to these retention periods.
Related documents
- Account Deletion & Data Export Guide — how to delete your account and export your data
- Data Processing Agreement — Annex E covers return, export and deletion procedures
- Website Privacy Policy — retention periods for website form submissions