We retain data only for as long as required by law (typically up to seven years for financial and tax records) or for the purpose it was collected. When personal data is transferred internationally (for example, to service providers in the United States), we ensure appropriate safeguards are in place such as encryption, access controls, and legally recognized transfer mechanisms.