Effective date: 16 October 2026
Review date: no later than 16 October 2027
Policy owner: Privacy Officer
1. Purpose
This Policy sets the maximum routine periods for which CLAI keeps the principal categories of personal data processed through its website, membership, communications and public programmes. It supports the storage-limitation and accountability requirements of the Nigeria Data Protection Act 2023 and the GAID 2025.
It must be read with the Privacy Policy. A shorter period applies where the purpose finishes sooner and there is no legal, due-diligence or legal-claim reason to retain the information.
2. Principles
CLAI will:
- identify a purpose and lawful basis before retaining personal data;
- keep only data that is adequate, relevant and necessary for that purpose;
- use the shortest workable retention period;
- where no period is set by law, ensure routine storage ends no later than six calendar months after the original purpose is accomplished, in line with GAID Article 49(3);
- keep limited information longer only where necessary for a legal obligation, documented due diligence, or the establishment, exercise or defence of a legal claim, with appropriate safeguards;
- restrict access while a record is retained only for accountability or legal reasons;
- apply the same schedule to duplicates and email notifications rather than keeping uncontrolled shadow copies;
- securely delete, destroy or irreversibly anonymise data at the end of the applicable period; and
- review the schedule at least annually and whenever a system, legal duty or processing purpose changes.
3. Retention schedule
| Record category | Routine retention period | End-of-period action and notes |
|---|---|---|
| IONOS Web Hosting visitor logs, if the public product notice applies to CLAI's account | 8 weeks according to IONOS's public Web Hosting notice; account applicability remains under verification | The public notice states that the visitor IP is anonymised and that the covered visitor data is not transferred outside the European Union. CLAI must record whether the notice applies to its account |
| WordPress error/security logs and a CLAI-created incident extract | Up to 90 days from creation | Delete or aggregate. Retain a relevant extract longer only for a documented unresolved security incident, legal duty or legal claim |
| WordPress/member authentication and session cookies | Session duration or the configured login period, normally no more than 14 days where "remember me" is selected | Expire automatically; security records are handled under the log category |
| Form spam and abuse indicators | 90 days | Delete or irreversibly anonymise unless linked to a continuing security investigation |
| General, voters' rights support and partnership enquiries | While actively handled; then up to 6 months after closure, and normally no more than 12 months after the last substantive contact | Delete message and attachments. Move an agreed partnership record to the contract category if an arrangement is formed |
| Website-form notification emails and working copies | Same period as the underlying enquiry or application | Delete with the authoritative record; do not keep an indefinite mailbox copy |
| Incomplete stored membership application | 30 days after the last applicant activity | Delete automatically where technically possible |
| Withdrawn, declined or abandoned membership application | 6 months after withdrawal, final decision or last requested clarification | Delete or anonymise. Keep only limited appeal or legal-claim evidence where justified below |
| Membership appeal concerning an application | 6 months after the final appeal outcome | Delete routine file; transfer only necessary evidence to the complaints/legal-claim category if a dispute continues |
| Active member operational profile and member account | Duration of membership, then up to 6 months after resignation or termination | Close access promptly; delete or anonymise operational data after the close-out period |
| Essential membership register, accepted Rules, consent evidence and material eligibility/disciplinary decision evidence | Membership duration and up to 6 years after it ends, but only where necessary for accountability, due diligence or a legal claim | Restrict access; retain the minimum evidence rather than the full operational profile; review annually after the first 6 months |
| Member authentication and security history | 90 days, unless connected to an unresolved security incident | Delete or aggregate; relevant incident evidence follows the incident category |
| Volunteer or programme application not accepted | 6 months after final decision | Delete or anonymise |
| Event, programme or volunteer participation record | During the activity and up to 6 months after it ends | Delete or anonymise, except an agreed ongoing membership record, transaction record, safeguarding case or legal hold |
| Optional accessibility arrangement information | Until the arrangement or activity ends, then no more than 30 days unless an unresolved incident or legal duty requires it | Securely delete; do not place detailed health information in general notes |
| Optional news, campaign and event-marketing contact | Until opt-out or 24 months after the last meaningful engagement, whichever occurs first | Stop marketing immediately on opt-out; delete contact data unless a minimal suppression entry is needed |
| Marketing consent and opt-out evidence | Up to 6 years after consent is withdrawn or the contact is removed, only as necessary to demonstrate compliance or prevent renewed unwanted contact | Restrict to compliance personnel; keep only channel, choice and timestamp where possible |
| Current leadership portrait, name, role and approved profile | While the person holds the published role, then up to 6 months after the role ends; verify accuracy at least annually | Remove or archive the public profile after the close-out period unless a documented historical-record purpose applies |
| Event image, audio, video and approved caption used publicly | Up to 3 years after the event or creation; review at least annually | At 3 years, remove the item or document a renewed consent or specific historical/archive purpose and continue annual review. Consider a valid withdrawal, accuracy or safety request promptly. Archive media that pre-dates this Policy must be reviewed by 31 December 2026 |
| Media notice, release or other rights evidence | Up to 6 years after the last authorised publication or final complaint, where needed for accountability or a legal claim | Restrict access and retain only the minimum evidence of the permission, notice, objection and outcome |
| Privacy-right request and response | Up to 6 years after closure where necessary to demonstrate compliance or defend a claim | Restrict access and keep only proportionate verification and outcome evidence |
| Complaint, safeguarding, disciplinary or serious integrity case | Up to 6 years after closure, or longer only where a specific legal duty, active proceeding or documented risk requires | Restrict access to authorised personnel; review annually; separate allegations from findings |
| Security incident and personal-data breach record | Up to 6 years after closure where necessary for statutory breach records, accountability or legal claims | Restrict access; retain facts, effects, notifications and remedial action, not unrelated data |
| Contract, payment, tax or accounting record created by a later approved activity | For the period required by applicable corporate, tax or accounting law, or up to 6 years after the transaction where needed for a contractual/legal claim | Restrict access; the website must not collect a payment until the activity and notice are approved |
| CLAI-controlled manual or rolling system backup | No more than 30 days | Overwrite or delete on schedule. A copy isolated for incident recovery or legal hold must be documented and deleted when the purpose ends |
| IONOS infrastructure recovery copy, if applicable to CLAI's account | Pending account-specific verification and entry in CLAI's processor register | CLAI must verify and record the cycle before public forms or membership applications are activated; those features remain inactive until then |
| Processor and compliance records, DPIAs, legitimate-interest assessments, contracts and audit evidence | Current life of the processing or provider, then up to 6 years where necessary for accountability, due diligence or legal claims | Restrict access; keep the final approved record and remove unnecessary working copies |
4. Start of the retention period
The period starts from the event stated in the schedule, such as closure of an enquiry, final decision on an application, end of an activity, end of membership, withdrawal of consent or closure of an incident. If more than one category applies, the record follows the longest applicable justified period, but unrelated data must be removed or separated.
5. Legal holds and exceptions
A routine deletion may be paused only where an authorised CLAI officer documents a specific legal obligation, regulatory request, investigation, unresolved complaint, due-diligence need or reasonably anticipated legal claim. The hold record must identify:
- the affected information and system;
- the reason and authorising person;
- the date imposed;
- access restrictions;
- a review date; and
- the event that will end the hold.
A hold does not permit unrelated use. It must be reviewed at least every six months and lifted promptly when the reason ends.
6. Deletion, destruction and anonymisation
Electronic records will be securely deleted from active systems and allowed to age out of the rolling backup cycle. Paper records, if any, will be cross-cut shredded or handled by an approved confidential-destruction provider. Where CLAI keeps statistics, data will be irreversibly anonymised so that a person is no longer identifiable by reasonably available means.
Deletion from a live system may not immediately remove the record from a disaster-recovery backup. Any backup covered by this Policy must remain protected, must not be used for ordinary operations and must be overwritten or deleted on the applicable recorded cycle. If a backup is restored, applicable deletions must be re-applied.
7. Roles and responsibilities
- Privacy Officer: owns this Policy, advises on exceptions, reviews holds and monitors compliance.
- System and website administrators: configure deletion, access, backup and logging controls and document completed deletion.
- Membership and programme leads: close records promptly, avoid duplicate files and identify records whose purpose has ended.
- All authorised users: keep data only in approved systems, follow the schedule and report a suspected loss, excessive retention or unauthorised copy immediately.
- Processors: must follow documented deletion/return instructions and confirm deletion where required by contract.
8. Requests and complaints
A person may request access, correction, deletion, restriction or objection as described in the Privacy Policy. A retention period does not override a valid earlier deletion request, and a deletion request does not override a lawful requirement to preserve limited information. CLAI will explain the applicable decision.
Contact:
Samuel Oreduni Esq., Privacy Officer
14b Adeniyi Jones, Ikeja, Lagos, Nigeria
admin@citizensliberation.com
Subject: Privacy Request
9. Review and change control
The Privacy Officer will review this Policy at least annually and before CLAI activates a materially new form, processor, analytics tool, identity check, payment flow or sensitive-data activity. The review will check actual system settings against the published periods. A new or high-risk processing activity must not go live until its retention, deletion, access and incident controls are documented and, where required, a Data Privacy Impact Assessment has been completed.