1. Retention principles
- Keep only data reasonably necessary for a defined purpose.
- Use the shortest period consistent with business, security, legal, contractual and professional obligations.
- Restrict access and periodically review stored data.
- Delete, securely destroy or anonymise data when the purpose and retention requirements end.
- Preserve data subject to a legal hold, dispute, investigation or regulatory request.
2. Indicative schedule
| Record category | Indicative period | Notes |
|---|---|---|
| Website security and access logs | At least 12 months, or longer if required for investigation or law. | Used for security monitoring, diagnosis and incident response. |
| Cookie consent records | Duration of the consent plus up to 3 years. | Supports proof of consent and preference management. |
| General enquiries and correspondence | Up to 24 months after the last meaningful interaction. | May be retained longer where an opportunity remains active or a dispute exists. |
| Proposal and business-development records | Up to 5 years after closure of the opportunity. | Longer if incorporated into a contract, tender record or legal file. |
| Client, contract, invoice and project records | For the engagement period and thereafter for the period required by law, contract, professional practice or limitation rules. | Access is restricted based on role and need. |
| Marketing preferences | Until withdrawal or unsubscribe, plus a minimal suppression record. | The suppression record prevents accidental re-subscription. |
| Recruitment records for unsuccessful applicants | Normally up to 12 months after completion of the process. | Longer retention requires consent or a legal basis. |
| Employee and contractor records | For the relationship and thereafter as required by employment, tax, social-security and other laws. | Governed by internal HR policies. |
| Privacy requests and grievances | Up to 5 years after closure. | Supports accountability and defence of claims. |
| Backups | Rotating cycles, normally up to 12 months. | Deleted data may remain in protected backups until overwritten; it is not restored except for continuity or recovery. |
3. Deletion methods
Deletion may include secure electronic deletion, cryptographic erasure, overwriting, destruction of physical media or irreversible anonymisation. Service providers are required to delete or return data in accordance with contract and applicable law.
4. Early deletion requests
A deletion request may be submitted to business@lilyinasia.com. We will assess whether the data remains necessary for the specified purpose, legal compliance, security, record keeping or the establishment, exercise or defence of rights.