NBCSS Data Retention Schedule
The schedule is the appendix to the Privacy Notice and the rule set the automated deletion jobs will follow once approved. Periods run from the event in the "Clock starts" column. "Delete" means erase or irreversibly anonymize; aggregate statistics with no personal data may be kept.
| Record | Clock starts | Keep for | Then | Why this long |
|---|---|---|---|---|
| Account data (name, email, timezone, login events) | Account closure or membership end, whichever is later | 24 months | Delete | Reactivation, disputes, security review |
| Membership application: work history, questionnaire, statements, decisions, appeals | Final decision (approved, declined, withdrawn, closed) | 24 months | Delete | Appeal window, consistency of admissions, complaints (owner proposal 2026-09-23) |
| Applicant sample reports (uploaded files) | Final decision | 12 months (owner decision 2026-09-23), or 30 days after a declined applicant's appeal window closes without appeal, whichever is shorter | Delete file; keep hash and screening result | Files are client work product; kept only as long as an appeal could need them |
| Quarantined (failed-screening) uploads | Screening result | 30 days | Delete file; keep the incident record | Security investigation only |
| Payment consents (version, hash, timestamps), invoices, charges, refunds, ledger | Tax year end | 7 years | Delete | Tax and accounting law; chargeback defense |
| Saved payment method token | Membership end or replacement | Removed at the processor immediately; NBCSS holds only the token reference | Delete | Never needed after the last authorized charge |
| Learning records: enrollments, progress, quiz attempts, completions, completion certificates | Membership end | Life of the account + 24 months; completion certificates kept 10 years | Delete (certificates: anonymize) | Members expect their record back on reinstatement; completion certificates are verifiable documents |
| Assessment records: attempts, answers, timing, integrity signals, practical submissions, workbooks, reviewer scores, appeals, advisory suggestions | Final release of the attempt result (or appeal decision) | 5 years for non-awarded attempts; life of the credential + 5 years for awarded ones | Delete; keep the anonymized item statistics | Credential integrity, appeals, scheme validation, complaints |
| Assessment item bank, forms, answer keys | Retirement of the item | Indefinitely (restricted) | Keep restricted | Exam security; item reuse analysis (no personal data) |
| Credential records: award decision, credential number, status history, verification page | Revocation, expiry or death | Life of the credential + 10 years | Keep the number and status history (anonymized name on request after the period) | Third parties rely on verification; disputes |
| Directory profile (opt-in) | Opt-out, lapse or account closure | Unpublished immediately; deleted after 30 days | Delete | Member controls the listing |
| Community posts and moderation records | Post creation | Posts: life of the community; moderation records: 5 years | Anonymize posts on account deletion where the thread remains useful; delete moderation records | Continuity of Q&A; moderation consistency |
| Jobs board postings and relayed applications | Posting expiry | 12 months | Delete | Employer disputes |
| Transactional email records (send, delivery status) | Send | 24 months | Delete body; keep aggregate counts | Deliverability and complaint handling |
| Marketing preferences, unsubscribes and suppression list | Event | Indefinitely (suppression), 24 months (preferences after closure) | Keep suppression | Legal duty not to re-contact |
| Support tickets | Closure | 36 months | Delete | Complaint history |
| Privacy requests and identity verification records | Fulfilment | 36 months | Delete | Proof of compliance |
| Audit log of privileged actions | Event | 7 years | Delete | Accountability, security, disputes |
| Security and request logs (redacted) | Event | 90 days | Delete | Incident response |
| Backups | Backup time | 35 days (point-in-time recovery window) | Overwritten | Recovery; deleted data leaves backups within this window |
| Affiliate records: attribution, commissions, payouts, tax forms | Tax year end | 7 years | Delete | Tax and payout disputes |
| Print order and shipping records | Delivery | 24 months | Delete address; keep order record 7 years with the ledger | Replacement claims; accounting |
Legal hold. Any record subject to a dispute, investigation or legal hold is kept until the hold is lifted, and the hold is recorded on the privacy request that would otherwise have deleted it.
Deletion requests. A verified deletion request removes everything not in a "keep" row above and explains each exception on the request record.
Version 1.0, approved 2026-09-24. Text identifier sha256 5410d013dc01832a…. See also: Terms · Privacy · Refunds · Retention · Affiliate terms.