Greenhouse retains Personal Information as long as a legitimate business need exists, after which it will delete or anonymize the data; if deletion is not immediately possible due to backup storage, the data will be isolated from further processing until deletion is feasible.
This analysis describes what Greenhouse's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an indefinite retention period tied to the existence of a legitimate business need, without specifying fixed retention durations for particular data categories, which may require evaluation under GDPR storage limitation principles.
Interpretive note: The policy does not specify category-specific retention periods, and the practical duration of retention under the legitimate business need standard depends on operational circumstances not described in the document.
Under this clause, Greenhouse retains Personal Information for an unspecified duration tied to legitimate business need, with backup archive copies potentially remaining in isolated storage after active processing ends. Users may submit deletion requests via the Data Subject Request Portal.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →"We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.Excerpt from Greenhouse's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes an indefinite retention period tied to the existence of a legitimate business need, without specifying fixed retention durations for particular data categories, which may require evaluation under GDPR storage limitation principles.
Under this clause, Greenhouse retains Personal Information for an unspecified duration tied to legitimate business need, with backup archive copies potentially remaining in isolated storage after active processing ends. Users may submit deletion requests via the Data Subject Request Portal.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Greenhouse.