Data retention and legal holds
Это содержимое пока не доступно на вашем языке.
KVKK asks that personal data is kept only as long as it is needed and that you can show it was removed afterwards. Every night Focus removes the activity data that is past its retention period and writes down every run, so you have the proof ready when an employee, an auditor or the Authority asks. The records that the law may require you to keep, such as time entries, leave and invoices, are not removed by age; they go when a KVKK erasure covers them or when the organization is closed.
Owners and admins open Settings → Privacy (KVKK) → Retention and Settings → Privacy (KVKK) → Legal holds.
How long data is kept
Section titled “How long data is kept”Removed on a schedule
Section titled “Removed on a schedule”| Data | Kept for |
|---|---|
| Activity (apps, active and idle time) | 395 days, or the shorter period set for your organization (the Retention tab shows it) |
| Window titles and website addresses | 90 days by default; your organization chooses between 1 and 395 days (privacy settings). After that the title and address are cleared; the activity itself stays for its own period |
| Screenshots (off by default, taken only with each person’s consent) | 30 days by default; your organization chooses between 1 and 365 days (screenshots). The images and the records of deleted screenshots go with them |
| Daily totals (a person’s day summary) | 3 years |
| AI summaries and workload alerts (off by default) | 180 days after the end of the day or week they describe (what AI summaries see) |
| The totals sent to the AI for a summary | 30 days; after that only the figures shown with the summary stay |
| The AI cost record (the model, size and cost of each AI request, without the data that was sent) | 400 days |
AI summaries are currently enabled only for pilot organizations. | Report exports and KVKK data exports | 7 days | | Notifications | 90 days | | Failed jobs | 30 days | | Database backups | 35 days |
The Retention tab lists the runs for activity, window titles, screenshots, daily totals, online status, KVKK data exports, AI summaries, the totals sent to the AI, workload alerts and the AI cost record, and the KVKK erasures. The removal of report exports, notifications and failed jobs is not listed there.
Kept until an erasure or the closure
Section titled “Kept until an erasure or the closure”| Data | Why it is kept | When it goes |
|---|---|---|
| Time entries, leave and shifts | Working time records that employment law may require you to keep | A KVKK erasure with Keep payroll records off removes them; with it on they stay without the person’s name. Closing the organization removes them |
| Invoices, the subscription and the billing details | Turkish Commercial Code and Tax Procedure Law (10 years) | They stay after a KVKK erasure and after the closure, because they belong to the organization; Focus does not remove them by age |
| Audit log and access log | Proof of who did what and who viewed whose data | A KVKK erasure clears the person’s details from the entries; closing the organization removes them, except the billing entries |
Focus does not delete these records when a period ends. If your policy sets a shorter period for any of them, tell your employees in your privacy notice how you handle it (privacy notices).
The retention report
Section titled “The retention report”The Retention tab shows, for the dates you choose:
- the retention periods in effect for your organization,
- for each kind of data, how many times retention ran, how many records were removed, whether a run failed, and the last cut-off date,
- KVKK erasures, with the number of records erased,
- how many legal holds are active.
Below the summary is the list of every run with its time, the kind of data, the cut-off date and the number of records. Download it as a CSV file to keep with your records. A failed run is repeated the next day; if runs keep failing, see failed jobs.
Backups: the 35-day rule
Section titled “Backups: the 35-day rule”Focus keeps encrypted backups of the database for 35 days. Data removed from the live database, by retention or by a KVKK erasure, can stay in these backups until they rotate out, for at most 35 days. Backups are used only to restore the service after a failure; if one is ever restored, the erasures made since are applied again before the data is used. State this period in your privacy notice (privacy notices).
Legal holds
Section titled “Legal holds”A legal hold stops Focus from erasing data that you may need as evidence, for example during a court case or an inspection. Open Legal holds, add a hold for one person or for the whole organization, and write down the reason. While the hold is active:
- a KVKK erasure request for that person (or anyone, for an organization-wide hold) goes on hold instead of running (KVKK requests);
- the organization cannot be closed (
tenant_has_legal_hold, close the organization); - the nightly retention keeps the activity, the screenshots, the daily totals and the online status of the people the
hold covers, and their screenshots cannot be deleted by hand either (
screenshot_legal_hold); their window titles and website addresses are still cleared on schedule, and report and KVKK exports still expire after 7 days.
Release the hold as soon as it is no longer needed: retention continues, and requests on hold can be resumed. Creating and releasing holds is recorded in the audit log.