MemberTrac Data Retention and Deletion Policy

Owner: Simple-Soft Solutions (data protection contact: support@simple-softsolutions.com)
Approval status: Reviewed and approved under Ghanaian law

Purpose

This policy defines the default periods for MemberTrac personal data. It implements the Act 843 principle that data must not be retained longer than necessary and must be deleted, destroyed or de-identified when its approved period expires.

Each participating organization must identify its controller role, document any different lawful period, and review that schedule annually. A longer period requires a recorded legal, contractual or consent basis; convenience alone is not enough.

Retention schedule

Record	Default period	End-of-period action
Unconsumed OTP challenges	30 days after expiry	Permanently delete
Consumed OTP challenges	30 days after consumption	Permanently delete
Expired, rejected or consumed provisional registrations and organization-signup requests	90 days after final status or expiry	Delete personal fields or delete the row where dependencies permit
Revoked or absolutely expired member authentication tokens	30 days	Permanently delete
Revoked member-device records	30 days	Permanently delete
Expired or revoked organization invitations	90 days	Permanently delete
Directly identifying attendance and precise check-in coordinates	24 months from attendance time	Delete the attendance row or de-identify it and remove coordinates according to the organization's approved reporting need
De-identified aggregate attendance	36 months, then review	Delete unless a documented statistical/historical purpose remains; do not restore identity
Pending account requests	Until resolved, with a 30-day action target	Complete or reject with documented justification
Resolved account requests	24 months after resolution	Delete or retain a minimal de-identified compliance record
Security and administrative audit logs	24 months	Permanently delete or de-identify actor/entity identifiers
API application logs	30 days	Automatic rolling deletion
Attendance export batches/states	24 months after acknowledgement/final failure	Delete after reconciliation need ends
On-device cached data	Until user logout, organization switch, uninstall or account deletion	Clear from app storage; warn before discarding unsynchronized attendance
On-box full database backups	14 days	Automatic verified-backup cleanup
On-box transaction-log backups	7 days	Automatic verified-backup cleanup
Off-box backups	Not yet configured (recommended 30–90 days once implemented)	Secure deletion under provider policy; currently not configured

Account deletion workflow

The member submits a request in Settings or uses the published external request channel.
MemberTrac creates at most one pending deletion request per member.
The organization acknowledges the request within seven calendar days and verifies identity proportionately.
An authorized organization admin determines whether identifying data must be retained under a documented law, contract, legal hold or other Act 843 justification.
Completed immediately removes direct identifiers from the MemberTrac profile, attendance and export state; removes precise coordinates, device and OTP records, authentication tokens and group memberships; and prevents further sign-in. A pseudonymous internal key remains for relational and audit integrity.
Rejected retains the account. The organization must communicate the lawful reason and complaint route outside the app until rejection-reason messaging is implemented.
The target for completion is 30 calendar days. Delays must be documented and communicated.
Deletion from live data propagates to backups through normal backup expiry. A deleted identity must not be intentionally restored into production; a disaster restore must reapply deletion requests completed after the restored backup was created.

Legal holds and exceptions

The data protection supervisor may suspend deletion for a specific record where preservation is required for actual or reasonably anticipated legal proceedings, fraud/security investigation, statutory duty or enforceable contract. The hold must record scope, reason, approver, start date and review date. Unrelated data remains subject to normal deletion.

Enforcement status

Implemented now:

30-day API log rotation;
14-day full and seven-day transaction-log on-box backup cleanup;
user-initiated local-data cleanup on logout;
immediate de-identification of direct account and attendance fields when a deletion request is completed; and
audit logging of deletion-request decisions.

Still required before this schedule is fully operational:

automated database cleanup jobs for OTP, registration, token, invitation, attendance, account-request, export and audit tables;
an approved off-box backup destination and deletion period;
legal-hold tracking and deletion replay after disaster recovery;
organization-level retention configuration where a customer needs a different approved period; and
monitoring and evidence reports showing each cleanup job succeeded.

Review

Review this policy at least annually and whenever data categories, service providers, law, store disclosures or product purposes change. Record every approved exception.