Data Retention Policy – Yoboo
Version
1.0
Date
09/06/2026
Responsible
Data Protection Officer Intake BV
Status
Approved and active
Application
Yoboo application and internal operations of Intake BV
Intake BV (hereinafter referred to as "Yoboo") processes personal data in accordance with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
As a Data Controller, Yoboo will ensure that personal data is not retained in a form that permits identification of data subjects for longer than is necessary for the purposes for which the personal data is processed (the storage limitation principle, Art. 5 (1) (e) GDPR). This data retention policy outlines the guidelines for retaining, archiving, and securely deleting data within Yoboo. Retention periods may vary depending on the purpose and may also be determined by legal obligations that specify particular retention periods or restrictions.
This policy applies to all data collected, processed, and stored by Yoboo, including:
- Data of customers and suppliers
- Data of users of the Yoboo application and their activities
- Data generated or managed by internal departments and Yoboo
- Data in both digital and physical form
- Data stored in the cloud or on local systems
Yoboo applies the following retention periods per data category:
Type of personal data
Purpose of processing
Retention period
Deletion method
Customer data (contact details)
Customer management, invoicing
7 years after the last transaction (in accordance with tax requirements)
Automated deletion
Supplier data (contact details)
Supplier management, invoicing
7 years after the last transaction (in accordance with tax requirements)
Automated deletion
Employee data
HR administration, payroll administration
5 years after termination of the employment contract
Automated deletion
CVs and application data
Recruitment and selection
Pre-rejected applicants: 1 year after application For applicants in the recruitment pool: as long as consent is not withdrawn and a maximum of 3 years after application
Automated deletion
Marketing data (newsletter, promotions)
Marketing communication
For consent-based communication: until consent is withdrawn
OR
For legitimate interest-based communication: until the user deletes their account
Automated deletion
Contact details
Internal communication
Duration of the employment contract
Automated deletion
Log data and usage logs (session time, click behavior)
Security, analysis, and improvement
Up to 6 months
Automated deletion
Photos/videos of employees
Publication on social media or in official documents of the organization.
The photos/videos are kept as long as consent is valid
Automated deletion
All categories
Backup copies
A backup is made monthly in MongoDB Atlas (Cloud). After 90 days, the previous version is deleted.
Backups are made on an hourly, weekly, and monthly basis. The backup made every 6 hours is only retained for 7 days due to the large amount of data.
The weekly backup is only retained for 4 weeks. The monthly backup is retained for 1 year.
Automated deletion
Identification details(name and email address)
Management of Yoboo user accounts
As long as the account is active. After account termination, personal data will be deleted within 30 days.
Automated deletion
Health data
For example:
• Sleep data: sleep duration, sleep quality, sleep patterns
• Nutrition data: calorie intake, eating habits, dietary restrictions
• Activity data: activity type, duration, frequency, step count
• Physical measurements: height, weight, BMI, heart rate, blood pressure
• Mental well-being: stress level, mood, energy level
• Goals and progress: personal lifestyle goals, progress measurements
Providing personalized lifestyle advice
As long as the account is active. After account termination, personal data will be deleted within 30 days.
Lifestyle advice is recorded anonymously.
Identification details(name and email address)
Planning, organizing, and following up on coaching sessions via the application
Up to 1 year after the contact request has been handled
Automated deletion
Identification Data Health Data Chat
Chatting with Yobi chatbot
As long as the account is active and for 30 days thereafter
Automated deletion
Identification Data Financial Data
Processing of webshop purchases and delivery
For the duration of the order fulfillment. Data that Yoboo is legally obliged to retain for accounting purposes is stored for 7 years.
Automated deletion
Health Data
Receiving, storing, and making available within the application test results from Yoboo-facilitated tests.
Data uploaded to the application with the user's consent: as long as the account is active and for up to 30 days thereafter.
Data from the Multiscan is deleted after the company report is delivered to the client.
If a user performs the Multiscan but does not install the Yoboo app, the collected data is temporarily stored in the cloud and deleted after 60 days.
Automated deletion
Data in Documents
Uploading, storing, and sharing files within the application
As long as the account is active and for up to 30 days thereafter, or until the user deletes the document themselves (whichever comes first)
Automated deletion
Identification and Professional Data
Registration and organization of training courses for pharmacists
For the duration of the collaboration between the pharmacy concerned and Yoboo
Automated Deletion
Facescan via website for energy level analysis
After sending the email with the derived analysis result, the data is no longer stored
Automated Deletion
Identification Data
Online appointment scheduling via the website
Up to 1 year after handling the contact request
Automated Deletion
Retention periods may be extended if (a) there is a legal retention obligation, (b) ongoing legal proceedings require it, or (c) the supervisory authority (Data Protection Authority) requests it. The retention periods are also recorded in the processing register.
Once the retention period has expired, the personal data concerned are:
- Permanently deleted using secure methods (e.g., data destruction, shredding), or
- If applicable, anonymized to retain analytical value without personal identification.
Yoboo employs automated retention management systems that:
- daily review retention periods per data category;
- automatically delete data that exceeds the established retention period;
- logging deletion in an audit trail for accountability (Art. 5 para 2 GDPR).
When a user deletes their account, the following process is followed:
- Immediately: application access is revoked; account is deactivated;
- Within 30 days: active health measurements and data, and profile data are deleted;
- Within 7 days, 4 weeks, or 1 year: backup copies are overwritten in accordance with the backup rotation procedure;
- After 7 years: financial and tax data is deleted.
Ownership and responsibility are essential to ensure effective data management. The following roles have defined responsibilities:
- Department Heads: ensure that personal data within their department is managed correctly and deleted in a timely manner.
- IT Department: ensures the implementation of appropriate technical measures for retention, (automated) deletion, or anonymization procedures.
- Legal/Compliance Department: ensures alignment with applicable legislation, oversees compliance with and updates this policy.
- Employees: adhere to the principle of data minimization and report violations.
This data retention policy is reviewed at least annually, or sooner if:
- changes in applicable laws and regulations;
- significant changes in the categories of data processed or processing purposes;
- recommendations from the Data Protection Authority;
- findings from internal or external audits.
All versions of this policy are archived and made available to the supervisory authority upon request.