CIQRA OÜ · Version 2.8 · Last updated: 10 November 2026

Effective date for existing customers: the changes in this version take effect, for a customer who accepted an earlier version, on the date stated in CIQRA's notice of this version, at least 30 days after the notice (Terms of Service, Section 14.2); until then the earlier version applies to that customer. A customer that objects may terminate without charge before that date (Terms of Service, Section 14.3).

This Policy describes how long CIQRA keeps personal data and how CIQRA responds to personal-data breaches. It supplements the Privacy Policy and the Data Processing Agreement.

Responsible entity: CIQRA OÜ, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia · info@ciqra.com

---

Part A — Data retention

A.1 Principles

A.1.1 CIQRA keeps personal data only for as long as it is needed for the purpose for which it was collected or as required by law. It then deletes the data or irreversibly anonymises it.

A.1.2 Where CIQRA processes personal data as a processor for a Merchant, the Merchant's lawful instructions and the Data Processing Agreement determine how long the data is kept. The periods below apply where the Merchant has given no different lawful instruction.

A.1.3 The periods in the schedule below are applied by automated deletion schedules or, where a period is a minimum set by law rather than a deletion deadline, by retention rules that prevent earlier deletion.

A.2 Retention schedule

Data	Retention period	Reason
Order, invoice, payment, tax and accounting records	For as long as the store is active, and for 10 years after the store is closed; never deleted earlier	Legal obligation (Estonian Accounting Act, § 12: 7 years) and the longest commercial record-keeping period CIQRA has identified among the laws of its Merchants' markets (for example Turkish Commercial Code art. 82: 10 years), so that a Merchant can meet its own duty from the platform
Merchant account, staff, settings and store content	For as long as the store is active; deleted 2 years after the store is closed, except the financial records above	Contract; winding down the account; handling disputes
Identity verification for CIQRA Pay	CIQRA does not hold identity documents; verification is carried out and the documents are held by Stripe under its own terms. CIQRA keeps the account reference and verification status with the Merchant's account data.	Contract; legal obligation
Customer accounts and other shopper data processed for a Merchant, including support tickets, live-chat transcripts and other correspondence with shoppers	For as long as the store is active, unless the Merchant instructs otherwise; erased or anonymised when a data-subject request is accepted; deleted 2 years after the store is closed	Data Processing Agreement; Merchant's instructions
Contact and enquiry form submissions	For as long as the store is active, unless the Merchant chooses a shorter period of 6, 12, 24 or 36 months in its store settings	Merchant's instructions; legitimate interests
Logs migrated from a Merchant's previous system	For as long as the store is active, unless the Merchant chooses a shorter period of 24 or 36 months in its store settings; kept for at least 2 years unless the Merchant instructs a shorter period, because these logs contain IP addresses that a Merchant may have to keep under the law of its own country (for example Turkish Law No. 5651)	Merchant's instructions; legitimate interests
Abandoned carts and checkouts, and the reminder messages sent about them	1 year	Data minimisation; legitimate interests
Marketing consent records	For as long as the consent is in effect. A record that a person unsubscribed is kept, so that the withdrawal continues to be respected and can be demonstrated, unless the Merchant chooses in its store settings to delete such records, or to reduce them to a one-way hash of the address, 3 years after the withdrawal	Consent; accountability (GDPR Art. 7(1))
Newsletter sign-ups that were never confirmed	30 days after the latest sign-up, when the confirmation link sent to the address was never opened	Data minimisation: an unconfirmed sign-up is not a consent
Storefront analytics events with pseudonymous identifiers	400 days; aggregated statistics derived from them are kept for 1,100 days	Legitimate interests; analytics
Security and audit records, sign-in, session and device records, and payment replay-protection records	2 years	Security; legitimate interests
Application logs and email, SMS and webhook delivery logs	12 months	Security; operation of the Services
Reports of illegal content, infringement and abusive stores made through the report form (the reporter's name, e-mail address and signature, the description, and the evidence copies of the reported pages)	12 months after the case is closed; then those personal data and evidence copies are removed. The record of the decision and its statement of reasons is kept without the reporter's identity, because the Digital Services Act requires CIQRA to be able to answer for it	Legal obligation (Digital Services Act, Arts. 16, 17 and 24); legal claims
Identity numbers and similar identifiers in form submissions (such as national identity, driving licence, passport, tax or IBAN numbers)	Kept as submitted, unless the Merchant chooses in its store settings to have them masked 7, 30, 90, 180 or 365 days after the submission	Merchant's instructions; data minimisation
Records of deletions and anonymisations made under this schedule	At least 3 years; never deleted automatically	CIQRA's accountability record (Article 5(2) GDPR); it also gives a Merchant what it needs for its own destruction records under the law that applies to it
Cookies and similar identifiers	As stated in the Cookie Policy	Consent or strict necessity
Backups made by CIQRA: database backups with point-in-time recovery	Up to 35 days on a rolling basis, then overwritten	Legitimate interests (GDPR Art. 6(1)(f)) in the security of processing (Art. 32(1)(c)): restoring the Services after an incident; for data CIQRA processes for a Merchant, the Data Processing Agreement
Backups made by CIQRA: recoverable copies of deleted or overwritten files	30 days, then deleted	Legitimate interests in the security of processing; for Merchant data, the Data Processing Agreement
Backups made by CIQRA: protected long-term copies of the database and of stored files	Where kept: copies taken weekly or more often up to 8 weeks; one copy a month up to 6 months. Each copy is deleted when its period ends	Legitimate interests in the security of processing: recovery from ransomware and from data corruption discovered late; for Merchant data, the Data Processing Agreement. See Section A.6.3
Backup archives of a store that the Merchant creates or schedules in its dashboard	The period the Merchant chooses (30 days unless the Merchant chooses a period between 1 and 365 days)	Merchant's instructions
Records subject to a legal hold	Only for as long as the specific legal obligation or claim requires	Legal obligation; legal claims

A.2.1 New and shortened deletion schedules are introduced gradually: each one first runs in a reporting mode that records what it would delete, and is switched on after that report has been reviewed. Until then the data it covers is kept.

A.2.2 The choices a Merchant can make in its store settings are all switched off until the Merchant switches them on. Until then, the default periods in the schedule apply and nothing further is deleted or masked.

A.3 Enterprise plans

For Merchants on the Enterprise CMS plan (CIQRA Sites) or the Commerce Enterprise plan (CIQRA Commerce), retention of the Merchant's own records is governed by the Merchant's contract. While the contract is in force, CIQRA does not apply automated retention schedules to them: correspondence with shoppers, contact and enquiry form submissions and their attachments, logs migrated from a previous system, abandoned carts, marketing consent records and content revision history are kept for the life of the account, whatever the billing status of the subscription, and closing the store does not start the 2-year deletion. They are deleted only by a decision — the Merchant's own deletion, an erasure request under data-protection law, or as the contract provides. The platform's own records (security and audit records, session and device records, delivery logs, payment replay-protection records and backups) keep the periods in the schedule on every plan. Where CIQRA cannot establish the plan of a store, it keeps that store's records rather than deleting them.

A.4 Marketplace orders

Where a Merchant connects a sales channel operated by a marketplace whose terms require the seller to delete buyers' personal data after the order (currently Temu and Amazon) and receives buyers' delivery details for orders placed on that marketplace, those details are used only to fulfil the order. The buyer's name, street address, city, postal code and telephone number are erased from the order 30 days after completion of the service — that is, after the marketplace confirms shipment or cancellation of the whole order — and in any event 60 days after the order was imported. The state or region and the country of delivery are kept with the order record. Because the period is set by the marketplace's terms, this erasure applies on every plan, including the Enterprise plans in Section A.3; it is the only exception to the rule in Section A.3 that automated schedules do not delete an Enterprise Merchant's own records. Orders from other connected marketplaces are kept under the general schedule.

A.5 AI features

The AI provider retains inputs and outputs only as permitted by its business terms described in the AI Features Terms. CIQRA keeps records of AI usage (feature, model, volume, credits and cost) as billing records, keeps copilot conversations with the store's data until the Merchant deletes them, and caches AI responses in memory for no longer than one minute.

A.6 Deletion and anonymisation

A.6.1 Account closure. When a Merchant account is closed, the Merchant may export its data during the 30-day transition period and the 30-day retrieval period in Section 13.3 of the Terms of Service. CIQRA keeps the account and store data for 2 years after closure, so that the store can be restored on request, and then deletes or anonymises it. Financial records that must be kept by law are kept separately and with restricted access for 10 years after closure.

A.6.2 Erasure requests. When CIQRA accepts a request to erase personal data, it tells the person making the request the date on which the erasure will take effect and which records, if any, must be kept and why. Erasure takes effect after a waiting period of 10 days, so that a mistaken or unauthorised request can be identified and stopped before an irreversible deletion. CIQRA's erasure process reports any category of data that it could not classify, so that incomplete erasures are detected rather than reported as complete. A business that deletes its own listing on a directory site through the self-service deletion page confirms the request through a link sent to its own address; that deletion takes effect at once, and CIQRA keeps a record of it (a one-way hash and a masked form of the address, the listing's address and the dates, never a deleted value) to prevent re-processing.

A.6.2A Coupon use after erasure. To stop a "once per customer" coupon being used again by erasing and returning, an erasure leaves, for each such coupon the person used, a keyed one-way code of their e-mail address (not the address itself) with the coupon and a count of uses, and nothing else; it is deleted automatically 30 days after the coupon ends (a year and 30 days after the erasure where the coupon has no end date). This is kept for the legitimate interest of the Merchant and CIQRA in preventing abuse (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

A.6.3 Backups. Individual records are not removed from CIQRA's backup copies, and protected long-term copies, where kept, are held in a separate store designed to prevent them being altered or deleted before their period ends, so that they remain usable after an attack such as ransomware. Deleted or erased data therefore remains in CIQRA's backups until the copies that hold it expire: at the latest 35 days after the deletion for database point-in-time recovery, 30 days for recoverable copies of files and, where long-term copies are kept, 6 months. While data is held only in a backup:

• it is not used for any purpose other than restoring the Services or data lost in an incident, and not to make any decision about anyone;
• it is not disclosed to anyone other than Microsoft, the sub-processor that hosts the backups (see the Subprocessor List);
• access to the backups is limited to a small number of authorised CIQRA administrators under role-based access control, and to the automated service identities that operate the platform and the backup service; administrative actions on the backups are logged;
• the backups are encrypted and stored on Microsoft Azure in Germany (Germany West Central), with a geo-redundant copy in Germany North.

If a backup is restored, CIQRA, before the restored data is used, deletes again the data whose deletion or erasure was recorded after the backup was taken, including data erased on a data-subject request. For this purpose CIQRA keeps backup copies for longer than 35 days only while it keeps a record of deletions and erasures outside the backed-up database.

A.6.4 Merchants subject to other retention laws. A Merchant that must carry out periodic deletion, destruction or anonymisation under the law of its own country (for example Türkiye's KVKK and its regulation on erasure, destruction and anonymisation) can rely on this schedule as the description of what the platform does: deletions run on the periods above, backups expire at the latest 6 months after a deletion, and the records of deletions in Section A.2 document each run. Whether the schedule satisfies the Merchant's own obligations is for the Merchant to assess; CIQRA publishes one schedule for every country and makes no statement that a particular country's law applies to it.

---

Part B — Personal-data breach notification

B.1 Definition and scope

A personal-data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This procedure covers breaches affecting personal data for which CIQRA is the controller, where CIQRA notifies the supervisory authority and, where required, the individuals concerned, and breaches affecting personal data for which CIQRA is a processor, where CIQRA notifies the Merchant (Section B.5).

B.2 Notification to the supervisory authority

Where CIQRA, as controller, becomes aware of a breach that is likely to result in a risk to the rights and freedoms of individuals, it notifies the competent supervisory authority — the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) as lead authority — without undue delay and, where feasible, within 72 hours of becoming aware of it. If notification is made later, CIQRA gives the reasons for the delay. Where a breach is unlikely to result in a risk, CIQRA records it without notifying the authority.

B.3 Response steps

1. Report. Anyone who becomes aware of a suspected breach reports it immediately to CIQRA's incident channel.
2. Contain. The incident lead assesses the scope of the breach, contains it and preserves evidence. The 72-hour period runs from the moment CIQRA becomes aware of the breach.
3. Assess. CIQRA assesses the categories and volume of data and the number of individuals concerned, the likely consequences, and whether the data was encrypted or pseudonymised.
4. Notify the authority where required (Section B.2), with the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, the measures taken or proposed, and the contact point. Information may be provided in phases.
5. Notify individuals without undue delay, in clear and plain language and with advice on protecting themselves, where the breach is likely to result in a high risk to them, unless an exemption under Article 34(3) GDPR applies.
6. Notify Merchants and partners as described in Section B.5, and notify Stripe, insurers and other authorities where required.
7. Record every breach in CIQRA's internal breach register, whether or not it is notifiable (Article 33(5) GDPR).
8. Remediate and review by addressing the root cause, putting preventive measures in place and conducting a post-incident review.

B.4 Roles and contact point

The privacy contact, info@ciqra.com, coordinates breach handling and is the contact point for supervisory authorities and individuals. The incident response team comprises an incident lead, engineering and forensics, legal and regulatory liaison, and communications.

B.5 CIQRA as processor

Where a breach affects personal data that CIQRA processes for a Merchant, CIQRA notifies the Merchant without undue delay, where possible within 24 hours and at the latest within 72 hours, after becoming aware of it, provides the information the Merchant needs to meet its own obligations under Articles 33 and 34 GDPR, and assists with the Merchant's response. The Merchant decides whether to notify the supervisory authority and the individuals concerned, unless agreed otherwise.

B.6 Other regimes

• Other countries. For personal data of which CIQRA is the controller, CIQRA notifies the authorities and individuals that the law applicable to CIQRA requires (Section B.2), including, for individuals in the United Kingdom, Switzerland, Canada, Brazil or a US state, the authority and within the period named in the regional supplements of the Privacy Policy (Section 12). Where a breach affects personal data that CIQRA processes for a Merchant, the Merchant decides on and makes the notifications that the law of its own country requires (for example to Türkiye's Personal Data Protection Board, Canada's Privacy Commissioner or a provincial commissioner, or Brazil's ANPD); CIQRA gives the Merchant the information in Section B.5 within the same 72-hour period, in English, so that the Merchant can meet its own deadline, and does not itself notify a foreign authority on the Merchant's behalf unless the law requires CIQRA to do so or the Merchant asks and CIQRA agrees in writing.
• Payment data. CIQRA does not receive full card numbers (Section 10 of the Privacy Policy). Any suspected incident involving payment data is escalated to Stripe and handled in accordance with card-scheme and PCI DSS rules.

B.7 Review and testing

CIQRA reviews and tests this procedure at least once a year and keeps its contact lists and breach register up to date.