AfterToMe Rights, Retention and Incident Procedure

1. Intake and identity

1. Requests to exercise data-protection rights are received at /legal/privacy-rights, at legal@aftertome.com and by post at Carrer Agricultura, 16, 1º, 9ª, 08320 El Masnou (Barcelona), Spain. Support and consumer complaints are received at support@aftertome.com. Each request receives a case reference within 2 business days.

2. Identity is verified proportionately: by signed-in session for an account holder; by the identity step of the claim flow for a recipient; by a copy of an identity document only where the request concerns vault content, a release or an account the requester cannot sign in to. Documents used for verification are deleted within 30 days of the decision.

3. A request made by a representative is handled only on proof of the mandate.

2. Decision and deadlines

1. The Operator answers within one month of receipt. For complex or numerous requests the period is extended by up to two further months and the requester is told the reason within the first month.

2. A refusal or limitation states the ground, the scope and the right to complain to the AEPD and to the courts.

3. Erasure of vault content is executed at the owner's request while the owner has capacity. Where a legal hold or court order applies, deletion is suspended for its duration and the requester is informed.

4. Erasure never alters acceptance, consent or release records; those records are kept as evidence under C16.1 and contain no vault content.

3. Retention schedule

1. Account data is kept for the life of the account and deleted or anonymised within 90 days after closure, except where a longer period is required by law (tax and accounting records: 6 years; acceptance and consent records: 5 years after the end of the relationship, as evidence of compliance; records subject to a legal hold: until the hold ends).

2. Conversation logs, recordings and uploads not linked to an active contract are deleted no later than 12 months after the last interaction, and earlier on your request, unless a legal hold applies.

3. Backups are rotated on a cycle not exceeding 35 days; data deleted from production is removed from backups at the end of the cycle.

4. Where a provider is an independent controller, its own retention rules apply to its records.

5. Platform schedule. The retention periods per data class are those stated in PUB-02 §3. A retention job runs on the existing scheduler at or before each ceiling and writes a deletion event; the job log is the evidence of execution.

6. Legal holds. A hold records its owner, ground, scope, review date and end; holds are reviewed every 90 days and lifted when the ground ends.

4. Security measures

The Operator maintains: tenant isolation enforced at the database level; encryption in transit (TLS) and at rest; least-privilege, multi-factor access for staff and contractors under INT-01; audited and time-limited privileged access and impersonation; secrets management with no credentials in code or logs; vulnerability and patch management; backups tested for restore at least quarterly; integrity digests of vault items re-verified at least every 12 months (SEC-01 §3.3); and the incident procedure in §5.

5. Personal-data breach procedure

1. Staff report a suspected incident immediately to the incident lead through the internal channel. The incident lead contains the incident, preserves evidence, and assesses within 24 hours the data, persons and tenants affected and the likely risk.

2. Where the breach is likely to result in a risk to the rights and freedoms of natural persons, the Operator notifies the AEPD within 72 hours of becoming aware, in stages where the facts are not yet complete, and records the reasons for any delay.

3. Where the breach is likely to result in a high risk, the Operator informs the affected persons without undue delay in plain language, stating the nature of the breach, the likely consequences, the measures taken and the contact point, unless an exception under Article 34(3) GDPR applies and is recorded.

4. Where the Operator acts as processor for a customer (future DAT-01), it notifies that customer without undue delay after becoming aware.

5. A post-incident review records cause, impact and corrective actions within 30 days.

6. Review

A decision under this procedure may be reviewed on request by a person other than the one who took it. The requester may at any time complain to the AEPD (www.aepd.es) or bring a claim before the courts of their domicile (C14 [B2C-ES]).