AppCrates
Guide chapters
§ - Important Disclaimer Regarding the Nature of the Material00 - How to use the guide01 - First choose the business and responsibility model, then build the marketplace02 - Construction plan: what must exist and when03 - Responsibility Matrix: Operator, Seller, and Suppliers04 - Seller Onboarding: Whom to Allow to Sell05 - Product card: information without which an offer cannot be published06 - GPSR: Product Safety in Practice07 - Product Category Gates08 - Packaging and EPR: who is actually responsible09 - Consumer Law: Sale, Withdrawal, and Complaint10 - Prices, Promotions, Ranking, Advertising, and Reviews11 - Payments, Payouts, VAT, and Sales Documents12 - GDPR without myths: what to record, where, and on what basis13 - DSA: reporting, moderation, and seller traceability14 - P2B: fair rules for business users15 - DAC7: seller data and annual reporting16 - E-commerce accessibility from June 28, 202517 - Cybersecurity and NIS218 - Retention: How long to store data and evidence19 - Post-launch operations: calendar and owners20 - Four business models - specific decisions21 - Document and Procedure Package to Prepare22 - GO / NO-GO Checklist Before Launch23 - Most Common Misconceptions24 - Sources and Update Principle
Chapter 18EU

Retention: How long to store data and evidence

There is no single term 'GDPR = 5 years'. Each data group has its own purpose and basis. The platform implements a retention engine or a regular process that selects the longest applicable term for a specific record, blocks deletion during disputes/incidents, and deletes or anonymizes after the term expires. In MVP, this can be an approved table of terms, periodic export/list of records for deletion, and execution control; an automatic engine is not required.

Data/EvidenceHard Rule or Default PolicyWhat happens after the term expires
Seller identifiability data from Art. 30 DSAcontractual relationship + 6 monthsdeletion of data collected solely on this basis; separate DAC7/tax copies remain according to their own basis
DAC7 data and evidence5 years from the end of the year in which the reporting deadline passedsecure deletion, unless there is an audit/dispute
Interface VAT records for relevant e-commerce transactions10 years from the end of the transaction yearremoval after confirmation of no proceedings and other grounds
Operator's accounting and tax documentsaccording to the specific tax/accounting obligation; calendar approved by accountingremoval after the end of the longest deadline and audits
Order snapshot, terms and conditions, complaint, and proof of executionby default until the end of the period of possible claims and the longer tax obligation; policy approved by legal counselanonymization/removal of unnecessary elements; statistics can remain anonymous
Marketing consent and its withdrawalfor the duration of use and the period required to defend against claims; recommended starting point: 3 years after withdrawal/last useremoval of evidence data if there is no dispute
Rejected seller verificationshort period justified by defense against abuse; recommended starting point: 12 months, longer only in case of an incidentremoval of documents, retention of a minimal lock entry only with proper grounds
Security logsrisk-based period; recommended starting point: 12 months for significant eventsrotation; incident subject to legal hold
Backupstechnical rotation, e.g., 30–90 days, described and testeddata from a deleted record disappears upon rotation and does not return to production after restoration

If a complaint, dispute, audit, investigation, product recall, chargeback, breach, or authority proceeding is ongoing, the planned deletion of the data covering it is suspended. In MVP, a permanent flag/note in the existing case and exclusion from the deletion list is sufficient. The lock has an owner, reason, scope, and review date; it cannot become a perpetual 'just in case' storage.

Need to implement these processes in a real marketplace?

I design multi-vendor platforms with onboarding, payments, moderation, and operational workflows.

Explore marketplace development