Data Retention Policy
How long we keep your data and why
Last Updated: July 18, 2026
Overview
CRCO (PTY) LTD ("CRCO") retains personal information only for as long as necessary to fulfill the purposes for which it was collected, in accordance with section 14 of the Protection of Personal Information Act, 2013 (POPIA). Under POPIA, records of personal information may be kept beyond that point only where retention is required or authorised by law, needed for a lawful purpose related to our functions, agreed to by you, or required by a contract. Each retention period below is grounded in one of these bases. This policy supplements our Privacy Policy.
Your Rights
You can request data deletion, export, or correction at any time by contacting hello@oncrco.com. We respond within 30 days.
Retention Periods by Category
User Account Data
| Data | Retention | Purpose |
|---|---|---|
| Profile information | Active account + 90 days after deletion | Account management, personalization |
| Login history | 12 months | Security, fraud prevention |
| Session data | 30 days | Authentication |
Event & Ticket Data
| Data | Retention | Purpose |
|---|---|---|
| Event details | 3 years after event date | Historical records, analytics |
| Ticket purchases | 7 years | Financial records, tax compliance |
| RSVP data | 2 years after event | Analytics, reporting |
| Check-in records | 1 year after event | Event management |
Opportunity Applications
| Data | Retention | Purpose |
|---|---|---|
| Application submissions | 3 years after deadline | Program records, reporting |
| Uploaded documents | 2 years after deadline | Application review |
| Rejection/acceptance records | 5 years | Historical records, compliance |
Community Data
| Data | Retention | Purpose |
|---|---|---|
| Posts and content | Active community + 1 year | Community engagement |
| Membership records | 2 years after membership ends | Analytics, reporting |
| Messages | 2 years | Communication history |
Vendor & Booking Data
| Data | Retention | Purpose |
|---|---|---|
| Bookings and quotes | 3 years after completion | Service records, dispute resolution |
| Vendor invoices | 7 years | Tax compliance, accounting |
| Client contact records | 2 years after last booking | Booking management |
Payment, Wallet & Payout Data
| Data | Retention | Purpose |
|---|---|---|
| Transaction records | 7 years | Financial compliance, tax law |
| Payment methods (tokenized) | Active use + 90 days | Payment processing |
| Wallet and payout records | 7 years | Financial compliance, audit |
| Bank account details for payouts | Active account + 90 days | Withdrawal processing |
| Invoices | 7 years | Tax compliance, accounting |
| Refund records | 7 years | Financial records |
Analytics & Logs
| Data | Retention | Purpose |
|---|---|---|
| Usage analytics | 24 months | Product improvement |
| Error logs | 90 days | Technical support, debugging |
| Crash reports | 12 months | Quality assurance |
| Audit logs | 3 years | Security, compliance |
Marketing & Communications
| Data | Retention | Purpose |
|---|---|---|
| Email subscriptions | Until unsubscribe + 30 days (suppression list retained to honour the opt-out) | Marketing communications |
| Newsletter history | 2 years | Campaign analytics |
| Cookie consent records | 12 months | POPIA/GDPR compliance |
Support & Moderation
| Data | Retention | Purpose |
|---|---|---|
| Support requests | 2 years after resolution | Service quality, dispute resolution |
| Moderation and takedown records | 3 years | Repeat infringer policy, legal compliance |
Data Deletion Process
Account Deletion Request
Delete your account from profile settings or by emailing hello@oncrco.com.
Deactivation
Your account and profile are immediately deactivated and hidden from other users.
90-Day Grace Period
Account data is retained in deactivated form for 90 days so you can recover an accidental deletion by contacting us.
Permanent Deletion or De-identification
After 90 days, personal information is permanently deleted or de-identified (as defined in POPIA, so that it can no longer be linked to you), except where a retention exception below applies.
Retention Exceptions
We may retain certain data beyond standard periods for:
Legal Requirements
Financial and transaction records are retained for 7 years in line with the Companies Act, 2008 (accounting records) and the Tax Administration Act, 2011 (records supporting tax returns, minimum 5 years); we apply the longer 7-year period across financial records.
Ongoing Disputes
Data retained until resolution of legal matters.
Security Investigations
Logs retained for fraud prevention and security.
Backup Systems
Deleted data may take up to 90 days to clear from all backups; backups are not used to restore deleted accounts.
Archived Data
Some data may be archived in de-identified or aggregated form for statistical analysis, platform improvement, and historical insights, as permitted by POPIA section 14(4) for historical, statistical, and research purposes. Archived data is de-identified so that it can no longer reasonably be linked to individual users.
Questions
Contact hello@oncrco.com for data export, deletion, or any retention questions.
©️ CRCO (PTY) LTD 2026