Data Retention and Deletion
How we handle and retain your data in compliance with Australian regulations
1. Retention Overview
We retain your data only for as long as is necessary to provide our services, comply with Australian legal obligations, resolve disputes, and enforce our agreements. Because CGT BRAIN handles tax-related information, our retention periods are primarily driven by the requirements of the Australian Taxation Office (ATO).
2. Statutory Retention Periods
In accordance with Australian tax and corporate law, the following retention schedules apply:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Active Asset Records | Duration of ownership + 5 years | Income Tax Assessment Act 1997 |
| Disposed Asset Records | 5 years from date of tax lodgement | ATO Record Keeping Rules |
| Capital Loss Records | 5 years after the loss is fully applied | ATO Review Period Rules |
| Identification (KYC) Data | 7 years after account closure | Anti-Money Laundering (AML/CTF) Act |
| Technical/Analytics Logs | 12 to 24 months | Internal Security & Fraud Prevention |
3. Account Closure and "Soft Deletion"
When you choose to close your account:
- •Immediate Access Cessation: Your ability to log in and view data will be revoked immediately.
- •De-identification: We will remove your personal identifiers (e.g., name, phone number) from our active marketing and customer service databases within 30 days.
- •Secure Archival: Your financial transaction data will be moved to an encrypted "Cold Storage" archive. This data is not used for any commercial purpose and is held solely to fulfill statutory tax record-keeping requirements or to assist you in the event of an ATO audit.
4. Right to Erasure (Deletion Requests)
You may request the deletion of your data at any time. However, please note:
- •Legal Overrides: Under Australian Privacy Principle 11.2, we are not required to destroy or de-identify information if we are "required by or under an Australian law" to retain it.
- •Refusal of Deletion: If you request deletion of records related to an asset sold within the last 5 years, we may refuse the request to ensure you remain compliant with the ATO. In such cases, we will provide you with a written explanation for the refusal.
5. Secure Disposal Methods
Once the statutory retention period has expired:
- •Digital Deletion: Data is purged using secure software deletion methods that ensure the information cannot be reconstructed.
- •Third-Party Providers: We ensure our cloud service providers (e.g., AWS/Azure Australia) adhere to the same permanent disposal standards.
Important Note for Users
Deleting your data from CGT BRAIN does not absolve you of your personal legal obligation to maintain tax records. We strongly recommend downloading all CGT Summary Reports and Transaction Histories before requesting account deletion.