Operational policy
Data Retention & Deletion Rights Policy
Effective date: 2 October 2026
SNOVA is a brand of Paahun Global Ltd, registered in England & Wales, company number 16884211, with registered office at Office 385, Unit 5, 399-405 Oxford Street, Mayfair, London, United Kingdom, W1C 2BU. Privacy enquiries: privacy@snova.uk. Support: hello@snova.uk.
1. Purpose
This policy sets the retention and deletion rules SNOVA applies. Periods are aligned with the technical architecture, paid plans, backups and legal obligations.
2. Retention schedule
| Data | Retention period | Notes |
|---|---|---|
| Free event content | 30 days after event/plan expiry | Warning provided before deletion |
| Paid one-off event content | 3 months (Celebration), 6 months (Signature), 12 months (Pro Event) from the event date | Extendable by a year at a time for £11.99; download/export offered before deletion |
| Business event content | For active subscription plus configured retention | Admin retention controls where available |
| Deleted Event Content | Removed from live systems promptly; backups expire on cycle | Backups purge within 35 days |
| Account data | Life of account + limited post-closure period | Retained only where necessary |
| Billing/tax records | 6 years | Required for UK tax and accounting record keeping |
| Security logs | 12 months | Minimised and access restricted |
| Support records | 2 years unless needed longer for dispute/legal reasons | Reviewed periodically |
| Social posts (drafts, approved and published) | Kept while the account is open, and deleted with the event or on request | Deleting here does not remove a post already live on Facebook or Instagram |
| Connected social account tokens | Deleted immediately on disconnection or revocation | Encrypted at rest and never displayed |
| Social performance figures | Collected for up to 30 days after a post is published, then kept in summary form | Used for the organiser's reports and suggestions |
| Social brand and learning profile | Life of the organiser account | Reset or deleted on request |
| Consent/authorisation records | As long as needed to demonstrate consent/authority and resolve claims | Protect and minimise |
3. Data-subject requests
SNOVA should maintain a documented process for access, rectification, erasure, restriction, objection and portability requests. Verify identity proportionately, log deadlines, search relevant systems, and respond normally within one month under UK GDPR, unless a lawful extension applies.
4. Processor requests
Where the relevant Event Content is controlled by an organiser, SNOVA should route the request to the organiser or assist them under the DPA. Urgent safeguarding or unlawful-content concerns may require separate action.
6. Holds and exceptions
Deletion may be delayed where data must be preserved for legal obligations, fraud/security investigation, disputes or legal claims. Any hold should be documented, access-restricted and removed when no longer necessary.