How Long Does Zinc Retain Candidate Data?

Once a background check is finished, we don't hold on to a candidate's sensitive data indefinitely. Here's how long we keep it, and what counts as sensitive. ## How Long We Keep Sensitive Data We delete sensitive data on one of two timers, depending on how the check request ends up: - **120 days from when the check was requested**, if the overall request reaches a **complete** status — **All Clear**, **Ready for Review**, **Reviewed**, or **Cancelled**. - **180 days from when the request was sent out**, if the request never reaches one of those complete statuses. ### When a Shorter (or Different) Period Applies These timers **don't** apply in two cases: - The candidate agrees to reusing their checks. - The client company's own data deletion policy requires a shorter period. In that case, we follow the company's policy instead of the standard timer. Separately, we retain the data needed to keep a candidate's account open for as long as our agreement with their employer or recruiter runs. ## What Counts as Sensitive Data - Date of birth - Address history - Employment reference data collected via **Mistho** (our partner for Instant Employment Verification checks) - CVs uploaded as part of a CV check - ID documents - Qualification certificates - DBS certificates (via the Update Service) - Self-certification submitted by the candidate