This analysis describes what Visa's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause defines the operational scope and duration of data retention practices, establishing that retention periods are determined by functional necessity rather than fixed time limits, and explicitly authorizing retention to support regulatory compliance and dispute resolution activities.
Severity downgraded from medium to low, removal of detailed factors considered in determining retention periods (sensitivity, risk of harm analysis), and language simplified to focus on basic legal and contractual requirements.
View full change record →Users' personal information will be retained according to the purposes stated in the privacy notice and for as long as legally required, meaning data retention duration is tied to operational necessity and legal obligations rather than user preference or notice period.
How other platforms handle this
We retain personal data for as long as necessary to provide our services, fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period for each category of personal data depends on the purpose fo...
We retain your personal information for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law. We may also retain and use your information to comply with our legal obligations, resolve disputes, and enforce our ...
Please note there are situations where Spotify is unable to delete your data, for example when: it's still necessary to process the data for the purpose we collected it for; we have an overriding interest in continuing to process the data, for example where we need the data to protect our services f...
Monitoring
Visa has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, and to resolve disputes and enforce our agreements.— Excerpt from Visa's Visa Privacy Notice
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause defines the operational scope and duration of data retention practices, establishing that retention periods are determined by functional necessity rather than fixed time limits, and explicitly authorizing retention to support regulatory compliance and dispute resolution activities.
Users' personal information will be retained according to the purposes stated in the privacy notice and for as long as legally required, meaning data retention duration is tied to operational necessity and legal obligations rather than user preference or notice period.
ConductAtlas has identified this type of provision across 136 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Visa.