HOATT Data Deletion Policy
1. User-Initiated Deletion
Members may request deletion of their account and associated personal data at any time by submitting a request through the HOATT platform or by emailing [email protected]. Upon verified request, personal profile data including name, email address, contact details, and user-generated content will be permanently deleted within 30 days.
2. What Gets Deleted
Upon account deletion, the following are removed: profile information, private messages, submitted tickets and reports linked to the account, notification preferences, and login credentials.
3. What May Be Retained
Certain data may be retained beyond account deletion where required by law or legitimate operational necessity, including: anonymised activity logs for platform analytics, records necessary to resolve outstanding disputes or complaints, financial transaction records required under applicable tax and audit obligations (retained for up to 7 years), and content that has been incorporated into anonymised community reports.
4. Community-Contributed Content
Content contributed to public community threads, issue reports tied to geographic areas, or civic records may be anonymised rather than deleted where that content forms part of a shared civic record. The user’s identifying information will be removed even where the content itself is retained.
5. Minor Accounts
HOATT does not knowingly collect personal data from persons under the age of 18 without verified parental or guardian consent. Where a minor’s account is identified, all associated personal data will be deleted within 14 days of discovery or upon request by a parent or legal guardian, whichever comes first. Parents or guardians may submit a deletion request on behalf of a minor by contacting [email protected] with the subject line “Minor Account Deletion Request” and providing proof of guardianship. No minor’s data will be retained beyond the deletion window except where required by law.
6. Data Retention Schedule
| Data Category | Retention Period | Basis |
|---|---|---|
| Profile and account information | Deleted within 30 days of request | User consent / account closure |
| Private messages | Deleted within 30 days of request | User consent |
| Submitted tickets and civic reports | Anonymised within 30 days; content retained | Legitimate civic interest |
| Financial transaction records | 7 years | Legal and tax obligation |
| System and activity logs | 12 months, then purged | Platform security and analytics |
| Encrypted backup copies | Up to 90 days, then purged | Disaster recovery |
| Minor account data | 14 days from identification | Child protection obligation |
| Dispute and complaint records | Duration of dispute plus 12 months | Legal necessity |
7. Third-Party Data Processors
Where personal data has been shared with third-party service providers (e.g. email delivery, cloud hosting), HOATT will instruct those processors to delete the relevant data in accordance with this policy and applicable data protection law.
8. Backups
Deleted data may persist in encrypted system backups for up to 90 days, after which it is permanently purged from all backup systems.
9. Trinidad and Tobago Data Protection Framework
This policy is designed to align with the Data Protection Act, Chapter 22:04 of the Laws of Trinidad and Tobago and the data protection principles established thereunder. HOATT, as a data controller, recognises the following obligations under that framework:
Lawful Purpose: Personal data is collected only for lawful, specific, and stated purposes directly related to the delivery of HOATT’s civic platform services.
Data Subject Rights: Users who are citizens or residents of Trinidad and Tobago have the right to access personal data held about them, to correct inaccurate data, and to request erasure where no overriding legal obligation requires continued retention. Requests may be directed to [email protected].
Accountability: HOATT maintains internal records of data processing activities and deletion requests in compliance with accountability requirements under the Act.
Cross-Border Transfers: Where personal data is processed or stored by service providers outside of Trinidad and Tobago, HOATT takes reasonable steps to ensure that those providers offer an equivalent standard of data protection.
Complaints: Users who believe their data protection rights have been violated may lodge a complaint with the Information Commissioner’s Office of Trinidad and Tobago in accordance with the Act.
10. How to Submit a Deletion Request
Users may initiate a deletion request via their account settings under “Privacy” or by contacting [email protected] with the subject line “Data Deletion Request.” Identity verification may be required before processing.
Responses