How long is data retained?

The Customer, as Controller, defines retention periods.

Under the OPTOVERA Data Processing Agreement, personal data is retained according to the Customer’s documented instructions, configured retention periods, Service functionality, applicable data-protection law, and established backup cycles. The Customer may request deletion at any time through a documented instruction, subject to technical feasibility and mandatory retention.

Upon the Customer’s documented request, expiration of the retention period, or termination of the Service, SOBEREYE deletes User-linked Eye Video, Iris Identification Data, Platform IDs and identity mappings it holds, individual baselines, measurement records, and linkable metadata from active systems. Residual copies may remain temporarily in protected backups until overwritten or deleted through established cycles; they are not available for ordinary use and remain subject to the Data Processing Agreement.

Before deleting User-linked records, SOBEREYE may retain numerical measurement data only where it has been irreversibly anonymized so that no individual can reasonably be identified. If that standard is not met, the information remains personal data.

There is no single standard retention period for all customers. Specific retention periods are confirmed in the Customer agreement, the Data Processing Agreement, or the Customer-specific configuration.