Data Retention Policy
Last updated: 11 July 2026
1. Purpose and scope
1.1 This policy explains how long Career Calling International Pty Ltd (ABN 53 162 651 238, ACN/ARBN 162 651 238), trading as CAQA ISO ("we", "us", "our"), retains personal information and business records, and how we dispose of them securely.
1.2 It applies to records in any format — electronic and hard copy — collected through this website (https://caqa-iso-preview.netlify.app) or otherwise in the course of our business, and should be read with our Privacy Policy.
2. Retention principles
- (a) Purpose limitation — we keep personal information only as long as needed for the purposes for which it was collected, or a directly related purpose you would reasonably expect;
- (b) Legal minimums — some records must be kept for statutory periods (for example, financial records for 7 years under Australian tax and corporations law); legal minimums override earlier deletion;
- (c) Legal holds — where litigation, an investigation or a regulatory inquiry is reasonably anticipated, relevant records are preserved until the hold is lifted, regardless of the schedule below;
- (d) Destruction or de-identification — under APP 11.2, when personal information is no longer needed for any permitted purpose and no legal minimum or hold applies, we take reasonable steps to destroy it or ensure it is de-identified;
- (e) Data minimisation — we do not collect or keep "just in case" data.
3. Retention schedule
| Record type | Typical contents | Retention period | Basis |
|---|---|---|---|
| Website enquiries and contact-form submissions | Name, contact details, message | 2 years from last contact, then deleted unless converted to a client relationship | Business need; APP 11.2 |
| Newsletter subscriptions | Email address, preferences | Until you unsubscribe, plus a minimal suppression record to honour the opt-out | Spam Act 2003; APP 7 |
| Website analytics data | Aggregated/pseudonymised usage data | Up to 26 months, in aggregate form where possible | Business need |
| Client and service records | Engagement details, correspondence, deliverables | Duration of relationship + 7 years | Contract limitation periods; business need |
| Financial and transaction records | Invoices, receipts, payment records | 7 years from the transaction/financial year end | Tax administration law (ATO); Corporations Act 2001 (Cth) |
| Complaints records | Complaint, investigation, outcome | 7 years from resolution | Limitation periods; continuous improvement |
| Data breach register | Incident, assessment, notifications | 7 years from closure | Privacy Act accountability |
| Employment and recruitment records | Applications, employee records, payroll | Unsuccessful applications: 6–12 months; employee records: employment + 7 years (payroll/time records per Fair Work Act 2009) | Fair Work Act 2009; tax law |
| Legal and corporate records | Contracts, licences, corporate registers | Life of the document + 7 years (longer where a deed or statute requires) | Corporations Act 2001; limitation periods |
| Backups | System backups containing the above | Rolling cycles; expired backups overwritten or destroyed; deleted data ages out of backups in the normal cycle | Business continuity |
Periods are maximums for routine retention, subject to legal minimums and legal holds. Where categories overlap, the longer period applies.
4. Secure destruction
4.1 When a retention period ends, records are destroyed securely: electronic records are deleted so they cannot practicably be reconstructed (including deletion from live systems and, in due course, from backup cycles); hard-copy records are cross-cut shredded or destroyed by a secure destruction service; and hardware is securely wiped or physically destroyed before disposal.
4.2 Where destruction is not practicable, personal information is de-identified so no individual is reasonably identifiable.
4.3 Service providers holding data on our behalf are required to apply equivalent destruction standards and to certify destruction where we request it.
5. Your deletion rights
5.1 You may ask us to delete personal information we hold about you at any time by contacting our Privacy Officer at complaints@careercalling.com.au or by mail to 2/10 Lawn Court, Craigieburn VIC 3064, Australia.
5.2 We honour deletion requests in accordance with:
- (a) Australia (APP 11–13) — we will destroy or de-identify information no longer needed, and correct or update information under APP 13;
- (b) EU/UK (GDPR Article 17) — right to erasure, honoured within one month unless an exception applies (for example, a legal retention obligation or the establishment or defence of legal claims);
- (c) US (CCPA/CPRA) — right to delete, honoured within 45 days subject to statutory exceptions.
5.3 Where a statutory minimum prevents immediate deletion (for example, invoices within the 7-year financial retention period), we will tell you, restrict the record to compliance-only use, and delete it when the period expires.
6. Responsibilities and review
6.1 Our Privacy Officer oversees this policy, the retention schedule, and legal holds.
6.2 This policy is reviewed at least annually and whenever applicable law or our systems materially change.
7. Questions
Questions about this policy: info@caqa.com.au, or the Privacy Officer at complaints@careercalling.com.au · 1800 266 160.