The notice states that Zendesk retains personal data for as long as necessary for the stated purposes or as required by law, applying a multi-factor assessment to determine the appropriate retention period including sensitivity, risk, and purpose.
This analysis describes what Zendesk's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Zendesk's stated data retention framework, which engages GDPR Article 5(1)(e) storage limitation requirements and equivalent principles under other regional frameworks, and is relevant for organizations assessing vendor data lifecycle management practices.
Interpretive note: The notice does not publish specific retention timelines for individual data categories, which may create ambiguity regarding compliance with GDPR Article 13 transparency requirements depending on regulatory interpretation.
Under these terms, Zendesk retains personal data without specifying fixed retention periods, applying a purpose-based assessment framework. Specific retention timelines for particular data categories are not enumerated in the notice text provided.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain personal data for as long as necessary to fulfill the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, and whether we can achieve those purposes through other means.Excerpt from Zendesk's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept no longer than necessary for the specified purpose.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes Zendesk's stated data retention framework, which engages GDPR Article 5(1)(e) storage limitation requirements and equivalent principles under other regional frameworks, and is relevant for organizations assessing vendor data lifecycle management practices.
Under these terms, Zendesk retains personal data without specifying fixed retention periods, applying a purpose-based assessment framework. Specific retention timelines for particular data categories are not enumerated in the notice text provided.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zendesk.