Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that personal data is retained for variable periods determined by service necessity, legal and regulatory obligations, dispute resolution, and contractual requirements, with retention schedules specified in an internal records retention policy. At the end of the applicable retention period, data will be deleted or de-identified.
This analysis describes what Marqeta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy does not publish specific retention periods for individual data categories in this notice, instead referencing an internal records retention policy and schedule that is not reproduced here. This means data subjects cannot determine the applicable retention period for their data from this document alone.
Interpretive note: Specific retention periods for individual data categories are not published in this notice and are governed by an internal records retention policy not reproduced here, making it impossible to assess the adequacy or proportionality of retention periods from this document alone.
Under this provision, the specific period for which Marqeta retains any given category of personal data depends on internal retention schedules and criteria that are not published in this notice; individuals who want information about specific retention periods for their data can contact privacy@marqeta.com to request that information.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →Monitoring
Marqeta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain personal data for as long as necessary to provide the Services and fulfill the transactions you have requested, comply with our legal and regulatory obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different types of information and the different Services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the information, the availability of automated controls that enable users to delete information, and our legal or contractual obligations. [...] Following the expiration of the retention periods or when the personal data is no longer needed, we will take steps to either delete or de-identify the personal data.Excerpt from Marqeta's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR's storage limitation principle, which requires that personal data not be retained longer than necessary for the specified processing purposes. CCPA and applicable U.S. state privacy laws also impose requirements on the accuracy and accessibility of retention disclosures. Canadian privacy law, including PIPEDA and Quebec Law 25, includes analogous retention limitation requirements. 2. GOVERNANCE EXPOSURE: Low. The retention framework described is standard in structure, though the absence of published specific retention periods for individual data categories means that the adequacy of retention periods cannot be assessed from this document alone. GDPR records of processing activities should document specific retention periods for each data category and processing purpose. 3. JURISDICTION FLAGS: GDPR's storage limitation principle requires documented justification for retention periods for each processing purpose. Quebec Law 25 requires that a retention schedule be established and that personal information be destroyed or anonymized when the purpose for which it was collected is fulfilled. Compliance teams in EU, UK, and Quebec contexts should confirm that internal retention schedules are documented and defensible. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party service providers processing data on Marqeta's behalf should be subject to data processing agreements that align their retention practices with Marqeta's internal retention schedule. Vendor contracts should address deletion or de-identification of personal data at the end of applicable retention periods. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the internal records retention policy and schedule referenced in this notice is current, documented, and defensible against applicable legal standards in each relevant jurisdiction. The policy's statement that retention periods may be extended in the context of legal claims or proceedings should be reflected in litigation hold procedures. Individuals' rights to request deletion should be assessed against the stated retention criteria, particularly where retention is claimed under the legitimate business purposes category.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy does not publish specific retention periods for individual data categories in this notice, instead referencing an internal records retention policy and schedule that is not reproduced here. This means data subjects cannot determine the applicable retention period for their data from this document alone.
Under this provision, the specific period for which Marqeta retains any given category of personal data depends on internal retention schedules and criteria that are not published in this notice; individuals who want information about specific retention periods for their data can contact privacy@marqeta.com to request that information.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Marqeta.