Server Logs - Log Retention Period

mocoders

Salam Aleykoum,

I had a quick question about the /timings/ API.

Do the servers log the full API request, including all parameters (possibly with some masking)?
If so, what is the data retention period for those logs?

I’m just trying to ensure that everything is aligned from a privacy perspective.

Thanks

meezaan

The api does not accept anything that impacts an individual’s privacy, so what is the actual concern?

Query parameters are logged. Retention is driven completely by space. In a busy week only have logs for 3-4 days. In a regular week for up-to 2 weeks.

mocoders

Salam,

Thank you very much.

As there is logs, I was specifically referring to whether coordinates (lat / lng) were removed from the query parameters in the logs or not as in UK it defined as personal information as per GDPR. As the logs last only 2 weeks max this is good by the way.

So in short to be fully compliant in UK timings API need to be used with City / Postcode only.

meezaan

mocoders Co-ordinates on their do not qualify as PII under GDPR. PII is information which allows us to uniquely identify an individual - that's not possible to do with co-ordinates and even IP address, because, for instance, in one apartment, there may be multiple people with the same IP and co-ordinates.

Co-ordinates, IP address and name together would, but the name does exist anywhere in the ecosystem.

I don't think your assumption on GDPR compliance is correct, at least not in the context of Personally Identifiable Information.