Data Retention and Requests Policy

1. Retention principles

Keep personal information only for the purpose and period justified by service delivery, security, accounting, legal obligations, or a documented dispute. Do not adopt one universal period for every country and data type.

Active account and operational records remain for the service relationship where needed. Booking, payment, tax, dispute, and policy-acceptance evidence may require continued restricted retention. Identity documents and live location records should be removed when their verification or operational purpose ends, unless a documented requirement applies.

2. Requests and closure

Submit access, correction, export, deletion, restriction, objection, or account-closure requests at https://yamiraos.com/legal/requests or by email. We verify identity, identify the responsible operator/controller, and respond within applicable deadlines. The internal queue targets review within 30 days; a shorter statutory deadline takes precedence.

Requests are recorded with their type, status, submission time, and due date. Authorized compliance administrators review them, record decisions, coordinate operator requests, and explain refusals or partial fulfillment. Submission is not a representation that deletion has already occurred.

For active bookings or financial liabilities, explain what must remain and why. Complete account closure only after reviewing outstanding obligations and lawful preservation needs.

3. Backups and legal holds

Restrict access to retained records and backups and remove data through the applicable backup lifecycle where operational deletion is not immediately propagated. Do not restore deleted information into active use without applying the deletion again.

A legal hold must identify the reason, scope, responsible person, and review point. Preserve required evidence while restricting unrelated use. Release the hold when no longer justified and then complete permitted deletion.

4. Operating schedule

Compliance maintains a retention register identifying each data category, controller, purpose, jurisdiction, trigger, period, hold exceptions, and deletion method. Review the register at least annually and when a provider or legal requirement changes.

The register and incident procedures are operational controls, not a claim that every retention action is automated. Contact ramjohncapital@gmail.com for the handling of a specific record.