Data Retention & Destruction

POPIA section 14 (retention and restriction) & section 19 (security safeguards) · Last updated 19 August 2026

Avolvia (Pty) Ltd t/a GoStartr keeps personal information only for as long as necessary for the purpose it was collected, to meet legal obligations, and to resolve disputes, as required by POPIA section 14. When information is no longer required, we destroy or de-identify it in a way that prevents reconstruction. This page summarises our retention periods and how we destroy data, for contacts in the United States, Canada, and South Africa alike.

Where retention rules pull in different directions, we keep records for the longest period a law requires and delete on the shortest period a law permits once that requirement lapses. Three examples: the US TCPA requires an internal do-not-call request to stay on our suppression list indefinitely and, as a matter of prudent record-keeping practice, we keep proof it was honoured for at least 5 years; Canada's CASL puts the burden of proving consent on us, so we keep consent records for as long as we are messaging that contact plus a further period after they unsubscribe or consent lapses; POPIA requires us to stop keeping a record once its purpose is complete unless a specific exception in section 14 applies (such as a legal requirement to retain it, or the record being needed for lawful purposes related to our functions). Where a US or Canadian legal retention duty and POPIA's purpose-based deletion duty would otherwise conflict for the same record, we treat the specific legal retention requirement (TCPA, CASL, tax, or similar) as the "requirement of law" exception POPIA itself permits, and keep the record for that period; we do not keep it for longer than that.

1. Retention schedule

Record	Retention period	Reason
Lead enquiries (no conversion)	Up to 24 months from last activity	Follow-up & re-engagement, then deleted once the purpose lapses (POPIA s14)
Customer & CRM records	Life of relationship + 5 years	Contract, tax, and dispute resolution
Call recordings & transcripts	12 months (unless needed for a dispute)	Quality, training, and evidence
Consent & opt-in records	Duration of contact + 3 years after withdrawal or last contact	Proof of lawful basis under POPIA s69, CASL, and TCPA prior-express-consent rules
Do-not-contact / opt-out suppression list	Kept indefinitely; underlying contact record deleted or reduced to a hashed suppression entry	Honour opt-outs permanently and satisfy TCPA internal do-not-call record-keeping expectations (kept at least 5 years, retained indefinitely in practice as a suppression control)
Marketing/campaign data	Until consent withdrawn; suppression entry kept indefinitely	Honour opt-outs
Invoices & financial records	5 years	South African tax and companies legislation, and equivalent US/Canadian recordkeeping norms for cross-border invoices
Account & technical logs	12 months	Security and troubleshooting (POPIA s19)
Data after account termination	Deleted/de-identified within 90 days (export window)	Customer offboarding

2. How we destroy data

Live databases (Firestore): records are permanently deleted; deletions propagate to replicas.
File storage (call recordings/transcripts): objects deleted from cloud storage; lifecycle rules auto-expire aged files.
Backups: deleted data ages out of rolling backups within the backup retention window, after which it is unrecoverable.
De-identification: where we retain analytics, we strip identifiers so data can no longer be linked to a person.
Suppression: for opt-outs we keep the minimum needed (e.g. a hashed email or phone number) solely to prevent re-contact.

3. Your deletion rights

You may request deletion of your personal information at any time, subject to records we must keep by law (including the TCPA, CASL, tax, and contract-related exceptions described above). Contact our Information Officer, Bruce Steyn, at bruce@gostartr.com or +27 82 233 3529. We action verified requests promptly, and in any event within the timeframe required by the law that applies to your request, and confirm when complete.

See also our Privacy Policy and Terms & Conditions.