The application-deletion exception is worded ambiguously
Wire says applicant data is not used beyond the described purposes and states deletion no later than six months after recruitment ends, subject to exceptions. It gives defense evidence under the German General Equal Treatment Act as an example of another legitimate interest preventing deletion. But it also writes ‘or you have not given us your consent to longer storage’, while the preceding paragraph makes longer retention consent-based. These passages do not provide a clear six-month deletion guarantee when consent is absent; this card preserves their wording without treating the apparent mismatch as permission to retain data without consent.
Supporting quotations
With your consent, we will also pass on your application data to affiliated companies or store your application data for a longer period if we consider your application suitable but are unable to offer you a position. The legal basis for data processing is Art. 31 sec. 1 FADP or Art. 6 sec. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future.
Your application data will not be processed beyond the use described above. Your personal data will be deleted no later than 6 months after the end of the application process, unless deletion conflicts with other legitimate interests on our part or you have not given us your consent to longer storage. Another legitimate interest in this sense is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).
Not stated here
The intended effect of ‘have not given’ in the deletion exception is unclear and is not silently corrected.
Retention & Deletion · Company practice
Session and persistent cookies have different deletion rules
Session cookies use a session ID to associate browser requests and recognize a returning computer, and are automatically deleted after the session, such as on browser closure. Persistent cookies remain on the device until their particular expiry, from a few hours to two years, or until deletion at the user’s request. The relevant banner and tool sections contain more specific periods.
Supporting quotations
Session Cookies: These Cookies are automatically deleted after a session, e.g. when the browser is closed. They contain a so-called session ID. This allows various requests from a browser to be assigned to the shared session and a computer to be recognized when the user returns to the Wire Website.
Persistent Cookies: These Cookies remain stored on the user’s end device and are automatically deleted after a certain period (depending on the specific Cookie, from a few hours to two years) or at the user’s request.
Further details on the functions and storage periods of the Cookies used by Wire can be found in the relevant cookie banner and in the following sections of this privacy policy (in each case for the relevant Wire Service and tool that uses the Cookies).
Retention & Deletion · Company practice
Website-visit data has a 30-day deletion rule with a security exception
For website-access data, particularly IP addresses, Wire promises deletion within 30 days of collection unless it has recognized an attack or threat by the user. This is the specific website-visit rule; the exception does not state a separate retention deadline.
Supporting quotations
This information is technically necessary for Wire to deliver the Website and to ensure its stability and security. The personal data collected when the website is accessed, in particular the user's IP address, will be deleted no later than thirty (30) days after collection, unless an attack or threat by the user has been recognized.
Not stated here
This paragraph does not state how long website data is kept when an attack or threat is recognized.
Cross-references
qualifies (model-proposed): General logs have a 90-day limit; website visits have a specific rule — qualifies: Website visits have a specific 30-day deletion rule and security exception alongside the general 90-day log limit; the notice does not expressly reconcile the exception with that maximum.
Retention & Deletion · Company practice
Google Analytics data is kept for at most 14 months
The policy states a maximum 14-month retention period for Google Analytics data. Cookie lifetimes are separately referred to the cookie banner and Google’s cookie overview; they should not be assumed to equal 14 months. The stated basis for collection and further processing is consent under ‘Art. 31(1) DSG’ or Article 6(1)(a) GDPR, and consent for device cookies may also be revoked without affecting earlier lawful processing.
Supporting quotations
The data collected by Google Analytics is stored for a maximum of 14 months. The storage period for the cookies used by Google can be found in the cookie banner. An overview of the cookies used by Google can be found at https://policies.google.com/technologies/cookies?hl=de. The legal basis for the collection and further processing of information is your consent in accordance with Art. 31(1) DSG or Art. 6(1)(a) GDPR.
The legal basis for the use of cookies or similar technologies on your device is also your consent. You may revoke your consent at any time without affecting the lawfulness of processing prior to revocation.
Not stated here
The linked cookie overview and banner are not supplied, so individual Google cookie lifetimes cannot be specified from them.
Retention & Deletion · Context
Countly’s device-deletion sentence omits the time unit
The Countly paragraph says stored IDs and information are automatically deleted from the device ‘no later than 365’, without a unit. The general usage-data section separately gives a maximum of 365 days for usage statistics and crash-log data. That general rule supplies a stated usage-data limit, but it does not repair the incomplete device-specific sentence or establish that all Countly server and device records have identical lifetimes.
Supporting quotations
When Countly is activated, certain information about your use of the Messenger, such as whether and when an error occurs or a certain event occurs (e.g., opening or closing of the App, using of a particular feature), and other technical information (e.g., IP address, app version, device type, operating system) is collected using a pseudonymous ID generated by Countly. The information is transmitted to our (self-hosted) EU servers. Any ID and information stored by Countly are automatically deleted from your device no later than 365.
We process individual data about the use of the Wire Services in order to compile anonymous usage statistics and crash logs. Furthermore, we may record pseudonymized Team IDs to monitor customer success and enhance our services. Insofar as personal data is processed for this purpose and your consent is not required for processing, we process your data on the basis of a legitimate interest (Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. f GDPR). Our legitimate interest is the smooth provision of Wire Services. Insofar as personal data is processed for this purpose and your consent is required for processing, we will only process your data after you have given your consent (Art. 31 sec. 1 FADP or Art. 6 Sec. 1 lit a GDPR). You can prevent the processing of your data for these purposes at any time, see FAQ. This data will be deleted after 365 days latest.
Not stated here
The Countly device-deletion sentence does not supply a time unit; this card does not silently insert one.
Where no period is specified, retention follows purpose and legal requirements
If this policy does not expressly state a retention period, Wire processes data only as long as needed for its purpose and deletes it immediately once that purpose ends. Legitimate reasons under applicable rules, including Article 17(3) GDPR and mandatory retention periods, may prevent deletion; data is then deleted immediately after the retention period expires. Consent-based data is deleted immediately on withdrawal unless statutory rules prevent deletion. The general purpose-based rule does not replace explicitly stated periods elsewhere.
Supporting quotations
Where we have not explicitly stated a retention period in this privacy policy, the following applies: We will only process your personal data for as long as is necessary to achieve the purpose of the processing. As soon as the purpose of the processing no longer applies, we will delete your data immediately, unless there are legitimate reasons within the meaning of the applicable legal regulations (e.g. Art. 17 sec. 3 GDPR), such as in particular legally prescribed retention periods, to prevent deletion. In this case, the data will be deleted immediately after the retention period has expired.
Data that we process on the basis of your consent will be deleted immediately after you withdraw your consent, unless statutory regulations prevent deletion.
Cross-references
qualifies (model-proposed): Consent can be withdrawn for the future at any time — qualifies: Consent withdrawal triggers immediate deletion in the retention section unless statutory rules prevent deletion; withdrawal does not retroactively invalidate earlier processing.
Retention & Deletion · User right or choice
You can request erasure on specified grounds
The notice describes an erasure right under Article 32 FADP and Article 17 GDPR where data is no longer needed for its collection purposes, consent is withdrawn and no other legal basis exists, processing was unlawful, or deletion is legally required. Its retention section also recognizes applicable legal reasons, such as mandatory retention, that may prevent deletion; withdrawal is not presented as overriding statutory retention.
Supporting quotations
Right to erasure (right to be forgotten) (Art. 32 FADP / Art. 17 GDPR): You have the right to request the erasure of your personal data if one of the following grounds applies
The data is no longer necessary for the purposes for which it was collected.
You withdraw your consent and there is no other legal basis.
The data has been processed unlawfully.
The deletion is necessary to fulfill a legal obligation.
Where we have not explicitly stated a retention period in this privacy policy, the following applies: We will only process your personal data for as long as is necessary to achieve the purpose of the processing. As soon as the purpose of the processing no longer applies, we will delete your data immediately, unless there are legitimate reasons within the meaning of the applicable legal regulations (e.g. Art. 17 sec. 3 GDPR), such as in particular legally prescribed retention periods, to prevent deletion. In this case, the data will be deleted immediately after the retention period has expired.
Data that we process on the basis of your consent will be deleted immediately after you withdraw your consent, unless statutory regulations prevent deletion.
Retention & Deletion · Company practice
Undelivered encrypted messages remain temporarily on Wire servers
Wire temporarily stores encrypted messages to deliver them when recipients come back online and says it deletes that server data immediately upon delivery. It also uses transport encryption for metadata. The stated basis is contract performance under Article 31(2)(a) FADP or Article 6(1)(b) GDPR. Transport protection for metadata is distinct from the stated end-to-end encryption of conversation content.
Supporting quotations
Wire also uses transport encryption to secure metadata. Encrypted messages are temporarily stored on Wire's servers for delivery when users come back online. However, this data is immediately deleted from Wire’s servers as soon as the relevant message has been delivered to the recipient of the message. The legal basis for this data processing is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (contract performance).
Retention & Deletion · Company practice
General logs have a 90-day limit; website visits have a specific rule
Wire collects technical logs on each service access to provide its services. With a service contract it cites Article 31(2)(a) FADP or Article 6(1)(b) GDPR contract performance; otherwise Article 6(1)(f) GDPR legitimate interests. The general logs section gives a maximum 90-day retention for troubleshooting, improvement and abuse prevention, citing Article 31(2)(a) FADP or Article 6(1)(f) GDPR for storage. The website section separately says visit data, particularly IP addresses, is deleted within 30 days unless an attack or threat by the user is recognized. The notice gives no separate deadline for that exception and does not expressly reconcile it with the general 90-day maximum.
Supporting quotations
Technical data ("log files") is collected and processed each time the Wire Services are accessed. This data processing is necessary to provide the Wire Services. If the user has concluded a contract with Wire on the provision of the relevant Wire Service, the legal basis is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (contract performance). Otherwise, the legal basis is Art. 6 sec. 1 lit. f GDPR (legitimate interest), since Wire has a legitimate interest in the provision of Wire Services like our Website.
Logs are kept for a maximum of 90 days to assist troubleshooting, improve service, and prevent abuse. Wire has a legitimate interest in the securing and improving its services. Therefore, the legal basis for this storage is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. f GDPR (legitimate interest).
This information is technically necessary for Wire to deliver the Website and to ensure its stability and security. The personal data collected when the website is accessed, in particular the user's IP address, will be deleted no later than thirty (30) days after collection, unless an attack or threat by the user has been recognized.
Not stated here
The policy does not explicitly state whether the website security exception remains subject to the general 90-day maximum.