How do I delete data and how long is it kept?

Deleting the business, step by step

Deleting the tenant is the only route by which data leaves the system entirely. It does not happen immediately but over a deadline, and that deadline is the real protection: it gives time to revoke the order and to export beforehand.

1. 1Export first. After the date there is nothing left to fetch, so the full data export belongs at the beginning and not at the end.
2. 2Order the deletion. Only management may do this. From that moment the application is locked and the date is set.
3. 3Wait out the deadline or revoke the order. Revoking reactivates the business and unlocks the application again.
4. 4Three days before the date a warning goes out. It is recorded on the business and therefore sent exactly once.
5. 5On the date, database contents and stored files are removed, and a confirmation closes the process.

• Two places are cleared: the database and the file store. A deletion that only touched the database would leave the documents behind.
• Until the date the order can be revoked; after it, not.
• There is no restoration after the date, and individual data cannot be exempted from the deletion.

The state in between

Between the order and the date the business is not deleted but not in operation either. The application is locked, and anyone signing in lands on a page of its own showing the status and the way back.

That is deliberate: a state in which people carry on clocking and planning while a deletion is running would create data that disappears three days later.

Individual people: inactive rather than deleted

Anyone leaving the business is set to inactive. That is not an interim step before deletion but the intended final state, and the reason is evidence: the times a person recorded are records of working time, and they do not disappear because the person leaves.

The application does not offer a genuine deletion of individual people as a feature. Personal data leaves the system through the full data export and through deleting the business, not through a button on the personnel file.

Anyone handling an access or erasure request from an individual therefore works with those two routes. This page makes no promise about it; it states the position.

What is logged

Administrative operations are recorded with the type of object, the identifier, the action and the acting person. The design is deliberately general, so that further operations can land there without a separate table for each.

Two things about it are worth mentioning. First, the log runs on every plan: a security record the smaller plan did not get would be no record at all. Second, it is not the same as the change history of the time entries. The two run alongside each other, and merging them is a project of its own and has not yet happened.

How long audit entries stay

Audit entries are not kept indefinitely in the live table. Once the retention period has expired they are archived as CSV and removed from the live table. The period depends on the plan.

The data processing agreement as evidence

Acceptance of the data processing agreement is recorded with the time and the accepting person. That is the point at which consent becomes evidence that the business's data protection documentation can carry.

It is accepted in the company data, and by management. How the business settings are otherwise structured is described in the guide to business settings.

Two routes for getting data out of the system

There are two separate routes, and they are easily confused. One is the full data export: an order from management, an archive of the entire holdings, intended for a system change or a request for everything. How it works is described in the guide to the export for the tax adviser.

The other is the object export: individual lists as a file, per object type and with a role gate of its own. Since 9 September 2026 the two are separate roots in the product, and what applies to one does not automatically apply to the other.