Data retention matrix (Annex IV to the DPA)
Version 1.0 — last updated: 2026-10-10
This matrix forms part of the Data Processing Agreement (DPA) concluded between each business and GD Projects, Lda.. For each class of data it sets the purpose, role, start of the period, maximum period and end action. The version in force on the date of acceptance is kept with the acceptance evidence.
1. General rules
Version 1.0, 8 October 2026, approved by GD Projects on 10 October 2026. Annex IV to the English DPA. The R01–R53 identifiers match the Portuguese matrix. The Portuguese technical implementation fields and JSON do not establish additional retention rights. The periods below are maximums while the purpose remains necessary; valid erasure requests are assessed without waiting for normal expiry.
“Business” means the controller of its customers/professionals, with GD Projects as processor, unless another role is stated. Article 6 references are to the GDPR. A legal obligation must be identified, not presumed from a database category. Years/months use calendar anniversaries, adjusting to the last day where necessary; elapsed days use 24-hour periods unless a statutory calculation applies. Tax retention uses following calendar years. System updates, migrations, owner logins and unilateral marketing do not restart retention.
Operational exit is 90 elapsed days from the effective base end, measured in UTC with an exclusive end. Non-payment restriction alone does not start it. Switching customers retain at least 30 calendar days for retrieval after transition; if that exceeds operational exit, provide the necessary data through a restricted secure route. Individual export files expire 1 hour after readiness. A hold preserves only necessary data under a recorded purpose, owner and review; it does not reopen normal access.
The law requires necessity, minimisation and justified storage. Except where identified as statutory or a provider's published condition, numerical periods are this review's proportional design decisions, not legal minimums. Sources consulted 8 October 2026: GDPR, Portuguese Law 58/2019, Article 21, Law 41/2004, VAT Code Article 52, Data Act 23–31, Firebase privacy.
Approval of this matrix as a contractual retention decision does not certify implementation. The current engine groups heterogeneous data and cannot express all these anchors, civil-calendar periods, short credential lifetimes, granular exceptions and external deletion. The proposed JSON remains non-executable and contains no invented approval identity or timestamp. Release requires the changes and evidence specified in the implementation instructions. Sendit-specific periods remain negotiation terms until expressly agreed.
2. Matrix R01–R53
| ID, class and context | Purpose, role and basis | Trigger and maximum period | End action, justification, exceptions and copies |
|---|---|---|---|
| R01 Account/profile — account | Authenticate/manage agreement. GD controller 6.1.b for individual party,6.1.f for representative,6.1.c for specific duties | End of every relationship and verified instruction: erase without delay after checks; operational target 30 days, without exceeding statutory response duties | Revoke sessions and erase unnecessary Auth/profile. Keep contract proof separately R03. Do not erase a shared account with memberships, billing access, privileges, subscriptions or acquisition pending; reconcile first. Auth residues R49. Test exact UID and guards |
| R02 Professionals/memberships — contractual | Scheduling, attribution and access. Business 6.1.b/f or specific Article 6.1.c duty; GD processor | End of role/need: revoke access immediately; retain necessary active data only. Minimum history up to 3 years from event, capped by 90-day exit | Remove user associations, contacts and unnecessary schedules; anonymise aggregates. Employer's separate labour records are not automatically this platform's archive. Specific dispute R43; preserve other tenants. Firestore/Auth/exports |
| R03 Non-tax contract proof — contractual | Evidence of order, versions, authority and cancellation. GD 6.1.f or specific Article 6.1.c duty | Final termination/case closure: 3 years, with annual necessity review | Delete identifiable evidence; retain non-personal text versions. This is a proportionate risk decision, not a general limitation period. Keep minimum acceptance/version/hash/action, not the whole calendar. Firestore/durable contract archive; disputes R43 |
| R04 Customer by business — subject/contractual | Deliver services and maintain active relationship. Business 6.1.b/f; GD processor | Last meaningful customer interaction: 3 years without interaction; operational record capped by 90 days from effective exit | Erase profile, unnecessary contact snapshots and links. Future booking/refund/reward preserves only necessary core R09/R15. Owner login, imports, jobs, migration or unsolicited marketing do not restart. Firestore/indexes, tenant isolation |
| R05 Administrative notes — subject/contractual | Necessary service administration. Business 6.1.f; GD processor | Creation or justified substantial correction: 12 months, earlier if purpose ends; exit maximum 90 days | Erase text/copies, not merely hide UI. Shorter period reflects free-text risk; no general recordkeeping duty. No clinical data. Indispensable dispute evidence R43 only; include snapshots, exports and support |
| R06 Bookings/contact snapshot — subject/contractual | Fulfil booking, resolve issues and minimum history. Business 6.1.b/f; GD processor | Later of service end or final cancellation: 3 years; operational record capped by 90-day exit | Erase personal fields or create a genuinely anonymous positive projection. Includes frozen customerContact. Future bookings/disputes R09/R43; tax duty R34 does not preserve entire booking. Check precise times and IDs for reidentification |
| R07 No-shows and reasons — subject/contractual | Resolve cancellation/no-show/correction. Business 6.1.b/f; GD processor | Event closure: free-text reasons 12 months; minimum state follows R06 | Erase reason, anonymise aggregates and assess subject access to reasons. Third-party rights need case assessment, not automatic exclusion. Firestore, notes and messages; test reward correction |
| R08 Meet/private booking links — subject/contractual | Access authorised booking/meeting. Business 6.1.b; GD processor | Revoke when no longer needed; erase usable URL within 24 h after service/meeting end unless a corrected future service requires it | Remove usable URL/tokens/log copies; keep only necessary non-usable reference. Security minimisation decision. Google-account event and already-delivered email are not automatically retractable. Verify logs |
| R09 Outstanding obligations — subject/contractual | Fulfil future booking, refund, dispute or return. Business 6.1.b/c/f for actual duty; GD processor | Identified obligation until resolution; review every 90 days; then specific evidence period | Isolate minimum set and continue resolution; release hold and apply original retention clock. GDPR 17.3.b/e does not permit abandoned state indefinitely. Record owner, reference, data and review; escalate after 90 days. Stripe/Firestore |
| R10 Optional preferences — subject/contractual | Respect choices by purpose/channel. Business 6.1.a/f and Article 6.1.c for objections; GD processor | Active choice while valid/needed; minimum proof 3 years after last use/withdrawal | Stop immediately on withdrawal; remove unnecessary profile and retain minimum proof separately. GDPR 7/21 accountability; no eternal consent. Record wording/version/channel/date/verified origin. Reviews, Loyalty email, birthday SMS and measurement are separate |
| R11 Suppression list — subject/contractual | Prevent recontact/reimport contrary to objection. Business 6.1.c, GDPR 21.2/3 and Law 41; GD processor | While genuine risk of renewed sending/import remains for that purpose; annual review | Store segregated keyed HMAC, tenant/purpose/date; erase when risk ends. HMAC remains personal, not analytics. Rotation must preserve suppression. On full closure, deliver needed proof and erase once risk ends |
| R12 Review requests/click events — subject/contractual | Send chosen request, control frequency and show coverage. Business 6.1.a; GD processor; measurement separate | Event: 12 months; stop new events on withdrawal; exit maximum 90 days | Erase identifiable events, retain anonymous aggregates. Maximum 365-day frequency supports chosen period. Last-send/first-ever marker R13; provider R47. Click is not a review or human reading |
| R13 Review frequency/first marker — subject/contractual | Prevent unwanted repeats. Business 6.1.f/c for limits/objection; GD processor | Last send up to 365 days; minimum first-ever indicator while relationship active, capped by R04 except suppression R11 | Erase identifier when relationship/duties end. Email change/reactivation must not reset limits. Marker is not permission to send or a reason for a complete history. Stable ID limited to the tenant |
| R14 Loyalty progress/cycles/transactions — subject/contractual | Award/prove benefits. Business 6.1.f for proportionate enrolment and 6.1.b for requested benefit use; GD processor | Owed progress while programme active; detailed transactions 3 years from transaction; exit 90 days with minimum obligation R15 | Consolidate balance/right evidence, erase expired detail and anonymise aggregates. No commercial progress expiry does not mean unlimited detailed history. Marketing objection stops related promotional profiling; preserve accrued rights, non-negative balance and versions |
| R15 Pending/non-expiring reward — subject/contractual | Fulfil accrued reward. Business 6.1.b/f; GD processor | While owed, annually reviewed; minimum evidence 3 years after closure, restricted after exit | Keep minimum balance, version, identity and claim method; fulfil/export duty and erase other data. No invented expiry solely to delete. Base/module termination does not extinguish reward; after 90 days only obligation route, no dashboard |
| R16 Birthday day/month — subject/contractual | Voluntary birthday benefit. Business 6.1.a; GD processor | Until withdrawal/end of relationship; review after 3 years without interaction; only necessary proof after exit, capped by 90 days operationally | Erase day/month on withdrawal; preserve minimum owed benefit/proof R10/R15. No birth year. Verified phone and SMS consent are separate; refusing SMS does not remove owed benefit |
| R17 Birthday attempts/deduplication — subject/contractual | Prevent duplicates and prove award. Business 6.1.a/f; GD processor | Annual event: 12 months; then only owed reward R15/choice proof R10 | Erase identifiable events, retain suppression if needed. Annual-cycle minimisation; no birth-year inference. No greeting catch-up; 29 February becomes 28 February in non-leap years. Test 20: 00 exclusive end and owner cannot consent for recipient |
| R18 Identifiable Insights/derived reports — subject/contractual | Proportionate contracted business analysis. Business 6.1.f with DPIA/LIA; GD processor | Source event: never exceed source, maximum 3 years per event and 90-day exit; snapshot R40 | Recompute/dissociate after source correction/erasure; retain only genuinely anonymous aggregates. Derived data remain personal. Backfill must not reconstruct deleted data; professional-level records may identify people. Show coverage/unknowns |
| R19 Irreversibly anonymous aggregates — contractual | Statistics without identifiable people; outside GDPR only once demonstrated | Once validated anonymous: while useful to contracted service; erase tenant data on exit absent a separate contractual right | Suppress small groups and revealing dimensions, remove stable IDs/links. Recital 26 test. Pseudonyms and a single professional's metrics are not automatically anonymous. Google Limited Use still constrains derivative use |
| R20 Booking/privacy OTP — subject | Proportionate verification. GD 6.1.f for own security; Business 6.1.b/f operation | Issue: 10-minute validity,5 attempts; erase verification material within 1 h after expiry | Invalidate at use/revocation, erase hash/nonce; minimum security logs R42. Booking cooldown 60 seconds and 5/hour. Anti-enumeration tests. Delivery expires with OTP; no plaintext code logging or late queue delivery |
| R21 Privacy session — subject | Handle verified request. Business 6.1.c; GD processor | Creation/authorisation: 30 minutes; erase material within 1 h after end | Revoke and erase session; preserve request proof R41. No automatic extension by visit. One-hour download availability does not extend session/authorisation |
| R22 tm_otp/tm_vc — subject | Verification and chosen contact-memory option. GD 6.1.f for necessary use; 6.1.a and Law 41 Article 5 for optional persistence | Issue/authorised renewal: tm_otp 15 minutes; tm_vc 60 days only by choice; server residue maximum 7 days after expiry | Expire cookie/link; clear on applicable logout/revocation. Contact memory is not required to book. Secure/HttpOnly/SameSite as applicable; no contact value in cookie |
| R23 Dashboard/customer sessions — account/subject | Requested authenticated access. GD 6.1.f; specific optional choice where required | Browser session by default; expressly remembered dashboard up to 7 days, private customer access 30 days; erase material 1 h after expiry | Revoke server/browser and reauthenticate sensitive acts. These are new minimisation commitments to implement, not certified current behaviour. Private 30-day session differs from 30-minute initial link; test realmaxAge/logout; Auth R49 |
| R24 Private customer link/guest token — subject | Secure relationship/booking access. Business 6.1.b/f; GD processor | Issue and booking need: private link 30 minutes; guest token maximum 365 days from issue, earlier revocation when unnecessary; unusable residues maximum 30 days | Invalidate capability/hash when purpose/rights end and erase residues. Technical maximum does not authorise access after exit or unlimited renewal. No tracking/rewrite/scanners consuming tokens; do not export reusable URL |
| R25 OAuth state/attempt — account | Bind authorisation/prevent abuse. GD 6.1.f; Business 6.1.b/f integration | Creation: state validity maximum 10 minutes; purge within 24 h after expiry/closure | One-use invalidation, erase state/verifier, retain minimum security metadata R42. Chosen security limit. No token in application logs; independent rehearsal maximum 2 h |
| R26 Google grants/revocation — contractual/account | Instructed synchronisation and revocation. Business 6.1.b/f; GD processor | Active only while needed; revoke without delay on disconnection; erase secret within 24 h after confirmation; no blind TTL while revocation pending | Keep indispensable failed-revocation secret encrypted and isolated; alert within 24 h, review within 7 days and escalate to resolution. Offer Google-account revocation. Prove runtime KMS and no secret logs. Necessity/Google policy/GDPR 32 |
| R27 Google watches/notification callback capabilities — contractual | Authenticated events/replay protection. GD 6.1.f; Business 6.1.b/f operation | Watch until expiry/stop, purge 24 h after confirmation; callback maximum 30 days from issue and bound to delivery | Invalidate capability/stop channel; minimum deduplication R38. Credential validity does not permit payload retention for 30 days. Bearer capability is not a Sendit payload signature. Protect paths in both providers' logs; test replay/rotation |
| R28 External calendar blocks/cache — contractual | Avoid future conflicts. Business 6.1.b/f; GD processor | Future blocks while integration/need; past blocks until 24 h after journal consumption; old generation until confirmed reconciliation | Erase unnecessary fields and superseded generations after consumption. Universal 24 h TTL would break future events/sync Token. Disconnection cleanup respects barriers. Incremental 15-minute/daily full sync does not justify storing all fields or resetting lifetime |
| R29 Calendar event bindings — contractual | Correctly update/cancel own event. Business 6.1.b; GD processor | Booking end/final reconciliation: up to 30 days after closure without error; unresolved error R09 | Erase binding after needed reconciliation. Google-account events remain under account control. No automatic event deletion on disconnect; Meet URLR08; prevent recreation after erasure. Period is operational choice |
| R30 Capacity history/journal — contractual | Consistent availability/indicators. Business 6.1.f; GD processor | Capacity day/generation close: identifiable maximum 3 years and 90-day exit; technical journal 7 days after confirmed consumption | Consume projection before erasure; close with privacyCapacityClosed; anonymise only if proven. Professional granularity remains personal. Grants/channels must be closed and journal consumed; producer/consumer generation fences tested |
| R31 Configuration/services/modules/versions — contractual | Execute configuration and prove applicable conditions. Business 6.1.b/f; GD processor | Active while service needed; necessary versions up to 3 years after last use; exit 90 days except R15 benefit | Erase unnecessary configuration; isolate minimum version proving owed right. Non-personal configuration may be outside GDPR but still subject to contractual exit. No contacts/free text retained forever as configuration |
| R32 Non-tax booking payments — subject/contractual | Collect/reconcile/refund/prove operation. Business 6.1.b/c/f; GD processor for management | Final settlement: 3 years operation metadata; open duty/dispute until resolution; restricted minimum after exit | Minimise references/amount/state, erase contacts/full payload. Fiscal documents R34/R52 are separate. Preserve shared Connect while needed. Stripe's own statutory controller retention is not erasure GD can promise |
| R33 Subscription/SMS/add-on billing detail — contractual | Invoice GD service/prove usage. GD 6.1.b/f,6.1.c only fiscal evidence | Period closure/settlement: non-tax detail 3 years; necessary invoice elements R34; delivery R46 | Keep needed count/segments/price/catalogue, erase recipients/content. 10 years does not apply to all jobs. Birthday platform-funded usage separated; validate v1/v2/v3 price without recipient on invoice |
| R34 GD tax/accounting documents — contractual | Own legal fiscal duties. GD 6.1.c, VAT Code 52 and applicable tax law | Relevant year: 10 following calendar years; 2026 document retained through 31 December 2036, normally erased from 1 January 2037 | Restricted tax archive, erase when due unless identified inspection/litigation duty. Statutory period, not 3650 days. Kapta/Moloni/accountant/relevant copies included; entire calendar excluded; evidence of contracts/credit notes |
| R35 Shared financial bindings — contractual/account | Maintain shared links/settle obligations. GD 6.1.b/c/f; Business for payments | Until every related relationship/duty ends; then minimum evidence R03/R32/R34; quarterly review | Dissociate tenant, no automatic Connect deauthorisation; erase dispensable IDs after reconciliation. Do not force pending counters to zero. External acquisition/cancellation proof and unblock owner required |
| R36 Pending jobs — subject/contractual | Execute lawful idempotent task. Same basis/role as task | Until task's specific deadline; then 7 days minimum metadata; payload expires as soon as unnecessary | Cancel on withdrawal/exit/obsolete generation, erase payload, retain minimum dedupe. Retry does not extend permission. Reviews 168 h, birthday same day, OTP 10 min; missing anchor alerts/blocks rather than silently preserving |
| R37 Failed/dead-letter jobs — subject/contractual | Diagnose/resolve failure. GD 6.1.f; Business underlying task basis | Final failure: 30 days redacted metadata, review within 7 days; specific case R43 | Immediately erase unnecessary personal/secret payload; delete redacted error on expiry. Uncertain delivery does not permit resend; minimum reference remains only until resolved. No full body archive |
| R38 Webhook/idempotency audit — subject/contractual | Prevent duplicate effects. GD 6.1.f; Business operation basis | Confirmed event/end of replay window: 90 days minimal ID/hash/result | Erase extracted payload promptly; erase IDs after period absent open case. If PS Pproves longer legitimate replay, retain only necessary tombstone for evidenced period and update matrix. Fiscal proof separately retained, not whole payload |
| R39 Exports/reports/subject copies — subject/contractual | Deliver requested copy. Business 6.1.b/c; GD processor, or GD 6.1.c for own rights | readyAt, notcreatedAt: 1 hour availability; erase bytes within 1 hour after expiry; content-free quota metadata up to 7 days | Revoke earlier if permission ends; erase object/URL/residue. Recovery omits prefixes. Recheck authorisation on download and exit deadline. Upload intent provides durable cleanup even on failure. Not retention of source |
| R40 Report snapshots — contractual | Prepare requested download. Business 6.1.b/f; GD processor | 1 hour after ready; failed generation cleanup within 24 h; quota data 7 days | Erase snapshot/object; regenerate only while authorised. Do not restore. New report does not extend source retention. Unknown coverage is not zero |
| R41 Rights requests/instructions — all contexts | Respond/prove compliance. Competent controller 6.1.c/f; GD processor where instructed | Case closure: 3 years minimum proof; supplementary identity documents erased at closure unless specifically needed | Keep request summary, decision, dates, grounds and delivery proof, not full exported content. Response normally one calendar month; lawful extension up to two additional months with notice in first month. Disputes R43 |
| R42 Security/access/support logs — all contexts | Security, diagnosis, privileged-act proof, support. GD 6.1.f/specific Article 6.1.c duty; Business according to operation | Event/ticket closure: technical/IP logs 30 days; minimum audit and tickets 2 years; unnecessary sensitive content earlier | Redact URLs/cookies/codes/contacts/bodies, erase by cycle; incidents R43. Vercel/Sentry/Cloudflare/Workspace/Firestore copies. Verify actual logs; optional device measurement needs choice. These periods are risk decisions |
| R43 Holds/incidents/disputes — all contexts | Specific legal duty/claims. Controller 6.1.c/f and 17.3.b/e; GD processor in chain | Until closure and concretely applicable legal period; review every 90 days; normal minimum proof 3 years after closure absent another period | Restrict minimum data and erase once grounds cease; review never resets original clock. Record statute/article or claim type/period, owner and review. No generic indefinite hold or blanket 20-year archive |
| R44 Deletion/account/correction ledgers — all contexts | Prevent resurrection after recovery. GD 6.1.c/f and processor as applicable | Until last restorable pre-action point expires plus 30 days; separate minimum compliance proof R41 for 3 years | No previous values/contacts; minimum tombstones only. Current ledger outside checkpoint; pending corrections need real delta. Unknown independent-backup horizon blocks ledger purge/recovery, with 30-day review, not permanent legal permission |
| R45 Own recovery copies — contractual/account | Incident recovery. GD 6.1.f/controller or processor according to data | Documented active PITR/daily backups/Storage soft delete: 7 days from point/copy/deletion | Automatic expiry, recovery-only access, replay erasure before traffic. Configuration is not tested restoration. Independent backup not yet configured; proposed maximum 7 days requires proof. Storage 0 B does not prove complete coverage |
| R46 Application notification metadata — subject/contractual | Evidence of submission/delivery and troubleshooting. Business message basis; GD 6.1.f security/costs | Closed send/attempt: 90 days metadata, no full-content archive; consent R10 | Erase identifiable destinations/events, retain anonymous aggregates, isolate financial proof. Chosen Reviews clicks 12 months with separate choice; callbacks do not extend retention. Earlier rejection evidence minimised |
| R47 Sendit email/content/URLs — subject/contractual | Deliver authorised message. Business controller→GD processor→Sendit subprocessor; GD controller for own messages | Negotiation proposal only: content/attachments up to 30 days after completion; OTP delivery≤10 min/no OTP logs; metadata 90 days; backups≤30 additional days | Necessary emails without optional tracking; protect URLs and erase online/copies with proof. Current email blocked. 400-day scope/fields, subprocessors/countries/scanners and deletion remain unconfirmed. No false privacy-verified gate |
| R48 Sendit SMS — subject/contractual | Deliver SMS/reconcile segments. Business message basis or GD own purpose; Sendit in respective chain | Negotiation proposal only: content≤30 days; metadata 90 days; backups≤30 additional days; minimum fiscal proof statutory period | Erase unnecessary body/recipient/logs; keep only required units/invoice. These numbers are proposed, not signed or fixed by law. Email tracking does not automatically block isolated SMS; DPA/security/sender/callback/cost proofs still required. Platform paying birthdays does not change purpose controller |
| R49 Firebase Auth residues — account | Authentication/deletion. GD 6.1.b/f; provider per actual contract | Provider publicly states account-data deletion including backups up to 180 days after instruction; IP logs a few weeks; bind this to actual service/account | Delete account/revoke access immediately in application, record instruction/confirmation and residual cycle. Provider condition, not universal platform backup period. Auth US location distinct from Firestore region; contract proof required |
| R50 Website/Form/leads/contact — separate from tenant engine | Respond to campaign/request. GD 6.1.a for authorised contact, b for individual's requested pre-contract steps, f for representative | Until completion/withdrawal, maximum 180 days from request without contracting; minimal proof R10/R11/R43 if needed | Erase Form, linked Sheet if any, mail, exports and phone working copies; move only necessary data into new contract. New policy, not existing website TTL. Daniel monthly routine; requested manual WhatsApp only, include device/linked accounts/backups; actual Forms account unproved |
| R51 Website language/diagnostics — separate from tenant engine | Requested language/security. GD 6.1.f and Law 41 Article 5 necessary exemption per operation | Language browser-session by default; logs 30 days; optional measurement only after choice | Remove unnecessary terminal storage/redact logs; no replay. No blanket Sentry exemption. Inspect network/storage before/after choice; external Google Form link does not itself embed Form cookies |
| R52 Business tax archive — subject/contractual | Provide evidence to service seller's fiscal controller. Business 6.1.c; GD processor only for contracted storage | Applicable Business fiscal period, normally 10 following calendar years where VAT Code 52 applies; export before exit | Deliver files/proof; after exit retain only specific contracted/legal obligation, not a normal dashboard. The platform does not offer an unlimited fiscal archive. The Business accountant identifies required records; GD invoice is not the invoice for the booked service; never the entire profile 10 years |
| R53 Data in user's Google account — outside unilateral GD deletion | User-selected calendar. User/Business controller and Google according to account terms | User/account instructions and configuration; disconnecting Tá Marcado does not erase existing events | GD cleans its own cache/credentials under R26–R30; the authorised user controls the external account. No promise of unrequested/unexecuted external purge; attendees may hold copies; no unrelated use |