Every piece of data you collect carries its retention period.
A compliance label says what a piece of data is, why you keep it, and for how long. Applied to a folder, a form question, or a template, it follows the documents you receive. At the due date, an automation archives, anonymizes, or deletes, after your approval.
- KYC documents · 5 yearsThe period starts when the document is received.
- AlertYour administrators are notified before the due date.
- Due dateAn automation can act.
- Space archived, Anonymization, Deletion, after approval
01A label
Everything you need to know about a piece of data, in one place.
A label brings together what your records and your DPO ask for each type of data.
The periods and legal bases are yours: Nestor applies them, it does not decide them.
- Name
- KYC documents
- Data category
- ID document
- Legal basis (GDPR)
- Legal obligation
- Purpose of processing
- Know your customer
- Sensitivity level
- Sensitive
- Retention period
- 5 years from collection
- Retention justification
- The rule approved by your compliance team
- Visible to the data subject
- Yes
02Where it applies
Labeled once, where the data comes in.
Apply the label to what you use to collect: the documents and answers you receive inherit it, including those that arrive later.
- “Proofs” folderLabeled once. Proofs · 3 years.
- Tax noticeInherits the folder's label.
- Proof of addressInherits the folder's label.
- Document uploaded the following monthLabeled as soon as it arrives.
On a folder
Its files and subfolders inherit the label.
On a question or a template
A form's answers and the requested documents inherit the label of the question or the template.
By hand
A document, a message, or a whole selection of files, at once.
Templates by profession
Import a set of labels ready to adjust: human resources, accounting, law firms, banking, insurance, notaries, real estate.
If two labels apply to the same data, the longer period prevails.
03Automations
At the due date, the rule applies. With your approval.
An automation runs before the due date, at the due date, after it, or at regular intervals for a summary. It notifies your administrators, archives, anonymizes, deletes, or asks the person to renew their consent.
- WhenAt the due dateDocuments labeled “KYC documents” reach their retention period.
- ThenDelete the dataThe action is prepared for each item concerned.
- SafeguardHuman approvalNothing is deleted without an administrator's approval. A hold blocks the action for the duration of a dispute or an audit.
Pending approvals
- KYC documentsSensitive · 5 yearsPending
Delete the data · 12 items would be permanently deleted
RejectApprove
Legal holds
- On hold
Rental dispute, retention requested by counsel.
Placed on October 3, 2026, review on January 3, 2027
Possible actions
- Due date alert
- In the app or by email, to your owners and administrators.
- Secure space archiving
- The space is closed and filed away; the history remains available.
- Data anonymization
- To keep your statistics without keeping people's identity.
- Data deletion
- Permanent, and always subject to approval.
- Consent renewal
- The person receives a request; if they accept, the period is extended.
- Attribute update
- A piece of information is written to the contact's record, for your other rules.
Safeguards
- Human approvalIrreversible actions wait for an administrator's approval. Without a decision, the request expires and comes back at the next run: it is never approved by default.
- HoldsFreeze the deletion of the data concerned for the duration of a dispute, an audit, or an investigation.
- SimulationSee what a rule would affect before you turn it on.
- A single runEach item is processed only once by the same rule.
04Oversight and evidence
What you keep, and proof of what you deleted.
Four views reserved for the owners and administrators of your account.
- Normal62%
- Sensitive30%
- Highly sensitive8%
- This weekResidential lease4 items
- Next weekBank details2 items
- 01
Oversight
Volumes by data category and sensitivity level, labels to complete, due dates over the next 90 days.
- 02
Audit log
Every action of the compliance engine and your teams, filterable, exportable as an evidence file in PDF format.
- 03
Record of processing activities
Keep the record required by Article 30 of the GDPR, publish versions of it, and schedule its review.
- 04
Access map
Who can access which labeled data. Viewing this map is itself logged.
05For the data subject
“What we keep about you.”
You choose which labels are visible. In their space, the person sees what data you keep, why you are allowed to keep it, and until when.
An answer ready before the question is asked: fewer information requests to handle, and a commitment your clients can see.
- What we keep about you
- ID document, proof of address
- Why we can keep it
- Legal obligation: know your customer
- Until when
- 5 years from when you uploaded it
06Frequently asked questions
Frequently asked questions
When will compliance labels be available?
They are being finalized. Tell us about your retention rules: we will let you know as soon as they launch.
Can Nestor delete data without my approval?
No. Deletion and anonymization always wait for an administrator's approval, and a hold blocks them during a dispute or an audit.
What can be labeled?
Messages, documents and files, and answers to forms and requests. Applied to a folder, a question, or a template, the label passes to the data they are used to collect. It will also be possible to apply it to a campaign, a portal, or a secure space.
Can I bring in my existing rules?
Yes. Import a label template for your profession and adjust it, or import your own framework. You can also export it.
Do labels make me GDPR compliant?
They help you apply and document your rules: retention periods, legal bases, record of processing, evidence. Compliance also depends on your choices and your organization, to be confirmed with your DPO.
Retention periods you need to enforce?
Tell us about your documents and your rules: we will show you Nestor today and let you know when labels launch.
- Fully sovereign European hosting
- No account to create for the people you work with