Following termination of the service, the Customer shall choose whether personal data processed on its behalf should be returned or deleted, unless retention is required by applicable EU or Member State law. ZELLERT shall delete existing copies in accordance with lawful Customer instructions, subject to mandatory retention and a documented backup cycle.
In line with Zitado's current terms, the Customer normally has 60 calendar days following termination to retrieve its exportable data. In an agreed provider-switching scenario, the retrieval period runs from the end of the agreed transition. Unless the Customer has provided another lawful instruction, the relevant Customer data shall then be erased or anonymised, subject to documented exceptions for legal retention obligations, legal claims/disputes, an expressly agreed longer period and temporary residual backup copies deleted or overwritten under an approved cycle.
The following periods apply to information processed on the Customer's behalf, subject to earlier lawful deletion instructions and any stricter separate customer agreement:
| Processing | Deadline |
|---|
| Active-system deletion after the export period | As soon as possible and within 7 days after the 60-calendar-day period ends. |
| Expired trial without conversion | Reactivation for 60 calendar days from trial expiry, followed by active-system deletion within 7 days. An ordinary login does not restart the period. |
| Backups | A rolling cycle of at most 30 days. Residual copies are deleted or overwritten within 30 days after active-system deletion. Previously deleted data is removed again on restoration before ordinary use. |
| Support correspondence / support attachments | 12 months / at most 90 days after case closure, respectively, or earlier where the relevant customer data must be deleted under the Customer's instructions or agreement. |
| System emails | Message contents for at most 30 days after sending and necessary delivery metadata for at most 90 days. |
| Operational and error logs / security and access logs | At most 30 days / 90 days from the event, respectively. Evidence of a specific incident may be retained separately with documented necessity and review. |
The normal process can therefore take at most 97 days from the start of the 60-day export period until the last residual backup copy expires, where the full export, deletion and backup periods are used. The start date for an agreed provider switch is described above. This is not a minimum period and does not extend stricter deadlines already agreed. A lawful retention exception covers only necessary, specifically limited information. A user's continued membership of another organisation must be handled separately.
A separately agreed overall deletion deadline covers all relevant recoverable copies of the Customer’s information. ZELLERT must plan return, active deletion and expiry or removal of backup and provider copies within that deadline. The Customer’s agreed export access must not be shortened unilaterally to make the deletion schedule fit. A shorter export period or other change to the exit arrangements requires the Customer’s agreement. Support, emails and logs containing information processed on the Customer’s behalf must be included in the plan; a generally longer retention period must not override a stricter customer agreement. Only specifically identified information with an independent lawful retention basis may be excepted. On completion, ZELLERT must be able to explain the deletion performed and any remaining information, its basis and its deadline.
Return and deletion are handled through a documented procedure covering each relevant data category. For each case, ZELLERT records the Customer’s instructions, export access, affected systems and copies, and applicable deadlines. An export may be provided manually to a verified, authorised recipient; a payment restriction must not itself prevent the Customer’s agreed export access. Deletion of active information and recoverable residual copies is documented separately. A shorter customer-specific deadline takes precedence over general retention periods.
Where the Customer’s agreement permits both data return and reactivation during a winding-down period, both options must remain available throughout the agreed period. ZELLERT may use a separately protected termination copy when its completeness, usable export format and ability to restore the data have been checked before active information is removed. The copy and its key copies must not extend the Customer’s overall deletion deadline. Other affected copies must be retired in time, and the termination copy and relevant key copies must be removed by the deadline. This storage arrangement does not amend the Customer’s agreed rights.
On request, ZELLERT shall provide deletion evidence or explain any remaining data and the lawful reasons for retaining them. Removal of an organisation account must not be treated as evidence that all copies at subprocessors have been deleted; applicable downstream deletion obligations must be completed.
ZELLERT has established daily backups of the database and uploaded files through a dedicated server hosted by Hetzner in Germany. Each copy is encrypted before storage in a Cloudflare R2 bucket with EU jurisdiction. This separate arrangement is configured for no more than seven days of history followed by physical repository cleanup. Backup, health checks, cleanup and alerts are enabled, and a full restoration of an actual copy has been tested in an isolated environment. A separate deletion journal must be applied during restoration before data returns to ordinary use; the journal does not itself erase recoverable copies. Other providers’ copies remain subject to their documented cycles and the applicable contractual deadlines. A stricter overall customer deadline takes precedence and must not be extended by the standard backup cycle.