Data Retention Policy
Last updated: June 25, 2026
1. Introduction
This Data Retention Policy describes how ZeroCarbon manages, stores, and disposes of information collected, processed, and generated through our carbon accounting and compliance platform. We ensure that data is retained only as long as necessary to fulfill the purposes of collection, or as required by applicable laws and industry reporting standards.
2. Objectives
The primary objectives of this policy are to:
- Ensure compliance with India's Digital Personal Data Protection (DPDP) Act, 2023.
- Provide clear retention periods for different categories of personal and business data.
- Outline secure disposal protocols for data that is no longer required.
- Optimize system performance and storage security.
3. Data Retention Schedule
We retain different classes of data for varying durations based on legal requirements and business purposes:
| Data Category | Retention Period | Purpose / Legal Basis |
|---|---|---|
| User Profiles & Admin Credentials | Active account duration + 30 days | Identity verification and platform access support. |
| Invoices & Financial Bills | 7 Years | Compliance with Indian Income Tax Act, 1961 guidelines. |
| Carbon Emissions records | 8 Years | Audit checks for corporate reporting compliance (BRSR, GHG, ISO14064). |
| Activity & Server Logs | 1 Year | Security audits, monitoring, and debugging. |
| Database Backup Files | 90 Days (rolling deletion) | Disaster recovery and business continuity. |
4. Right to Erasure & Consent Withdrawal
Under Section 12 of the DPDP Act, 2023, you have the right to request deletion of your personal data at any time. When a request is made:
- All personal details and invoices uploaded will be purged from active systems within 30 days.
- Aggregated, fully anonymized metrics may be kept for broad statistical reporting, but they will contain no identifying markers.
- Data that we are required to retain under statutory legal obligations (such as tax compliance invoices) will be archived and isolated, and then permanently deleted upon expiry of the statutory period.
5. Secure Data Disposal
When the retention period for a data category expires or when a valid erasure request is processed, ZeroCarbon will permanently delete database records, purge associated logs, and securely delete files stored in cloud object storage (e.g. invoices, CSVs) so they cannot be reconstructed or recovered.
6. Contact & Redressal
To request a list of your data, update correct details, or request deletion, please contact our Data Protection Officer at:
support@zerocarbon.org.in
ZeroCarbon Tech