The policy states that legal or regulatory retention obligations may require Brex to retain personal information after an account closes and may prevent Brex from fulfilling a deletion request submitted by an individual.
This analysis describes what Brex's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Brex may decline deletion requests by citing retention obligations, which is a recognized exception under CPRA and GDPR but requires that the specific legal basis for retention be documented and communicated. The operational implication is that individuals submitting deletion requests may receive partial or full denials, and the policy does not specify which statutory obligations trigger this exception.
Interpretive note: The policy does not identify the specific statutory obligations that trigger the retention override or the data categories to which it applies, creating uncertainty about the scope and consistency of deletion request denials.
Under this clause, submitting a deletion request to Brex does not guarantee deletion of personal information, as the terms state that legal retention obligations may prohibit deletion in certain cases. Individuals affected should submit requests through the Brex Privacy Center to receive a documented response stating the basis for any denial.
Cross-platform context
See how other platforms handle Retention Obligations Overriding Deletion Requests and similar clauses.
Compare across platforms →"Please note that our retention obligations may require us to retain your Personal Information after you are no longer an Authorized User or your Company's Brex Account has closed. These retention obligations may also prohibit us in some cases from deleting Personal Information after you have asked us to delete your Personal Information.Excerpt from Brex's Privacy Policy
(1) REGULATORY LANDSCAPE: CPRA grants California residents a right to deletion subject to enumerated exceptions, including legal obligations, fraud prevention, and completing transactions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Brex may decline deletion requests by citing retention obligations, which is a recognized exception under CPRA and GDPR but requires that the specific legal basis for retention be documented and communicated. The operational implication is that individuals submitting deletion requests may receive partial or full denials, and the policy does not specify which statutory obligations trigger …
Under this clause, submitting a deletion request to Brex does not guarantee deletion of personal information, as the terms state that legal retention obligations may prohibit deletion in certain cases. Individuals affected should submit requests through the Brex Privacy Center to receive a documented response stating the basis for any denial.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Brex.