A business can keep customer testimonials only for as long as they serve the stated purpose and the relevant consent remains valid. ReviewMix helps record consent and withdrawals, but the business remains responsible for choosing and documenting its retention period.
How long can a business keep customer testimonials under GDPR?
The GDPR sets no fixed number of months or years for testimonial retention. Article 5(1)(e), the storage limitation principle, requires personal data to be held no longer than necessary for the purpose for which it was collected.
A business should therefore identify why it publishes testimonials, decide how long that purpose reasonably lasts and record the decision in a retention policy. An indefinite period with no review point is difficult to reconcile with storage limitation.
Consent also matters. If a testimonial relies on consent, the business cannot continue the affected use after that consent is withdrawn. A sensible policy sets a review interval, such as checking published testimonials annually, while allowing the submitter to act before that review.
For live testimonial data, the business using ReviewMix is the controller and ReviewMix is the processor. The controller decides the purpose and retention period, while the processor handles the data according to those instructions and the service's defined deletion process.
This article provides general information, not legal advice.
What happens when a customer withdraws consent?
A testimonial must stop appearing wherever the withdrawn permission is required for its display. ReviewMix removes the affected content from public display across every widget within 60 seconds of a withdrawal.
ReviewMix asks for consent separately for showing the customer's name, photo and company, including their role, and for use in paid advertising. Each answer is recorded with its time and the exact wording presented to the customer.
Name permission is the display floor. If the customer withdraws permission to show their name, the entire testimonial disappears from public display. Photo, company and paid advertising permission can each be withdrawn independently without necessarily removing the remaining permitted content.
ReviewMix keeps withdrawn testimonial content unpublished so the customer can return to the private self-service page and manage it. The customer can also erase the testimonial irreversibly from that page at any time, without creating an account or signing in. Further details appear in what happens when someone withdraws a testimonial and the guide to data rights for submitters.
A withdrawal must reach every place where the testimonial is being used, including paid adverts and copied marketing materials. Missing an advert, brochure or manually copied website quote can prolong an unauthorised use and create avoidable legal and replacement costs.
Why is the consent record kept after the testimonial is gone?
The consent record provides evidence that valid permission existed and records when that permission changed. Removing public content does not remove the need to demonstrate how the business handled the original consent and any later withdrawal.
In ReviewMix, consent grants and withdrawals form an append-only record. Each decision is stored separately with its timestamp and the wording shown at the time, so a later withdrawal does not overwrite the earlier grant.
ReviewMix retains consent grant and withdrawal metadata for three years after the account or customer relationship ends, based on the general limitation period for legal claims under Article 2517 of the Romanian Civil Code. That retained metadata is not the testimonial text. The distinction allows evidence of the consent history to remain without preserving the marketing content itself.
For that retained metadata, ReviewMix acts as an independent controller, strictly to be able to prove that consent existed. A business policy should still distinguish between content used for promotion, account data needed to operate the service and limited consent evidence retained for potential legal claims.
What should a testimonial retention policy say?
A testimonial retention policy should tell staff and customers what data is retained, why it is retained and what causes deletion. The policy should be specific enough that someone can follow it without making a fresh decision for each request.
The policy should cover:
- What testimonial content, identity details and consent metadata are kept
- Where the live content and supporting records are stored
- How long each type of data remains and when it is reviewed
- Who can request or carry out erasure
- What happens after consent is withdrawn
- What happens when the business closes its account
- Whether copies exist in adverts, printed material or other systems
As an example, a bakery could write a four-line internal retention note:
- Published testimonials are reviewed every 12 months for continued relevance
- Testimonials remain published only while the relevant permissions remain active
- Customers can withdraw permissions or erase their submission through their private link
- Staff remove separately copied content from adverts and print when the related permission ends
The example is not a universal schedule. Each business should select periods that fit its purpose, legal context and actual marketing workflow.
What happens when a business closes its ReviewMix account?
A closed ReviewMix account enters a 30-day recovery window before its account data is deleted. The recovery window allows an accidental closure to be reversed without turning closure into indefinite storage.
Businesses should plan for material that was copied outside ReviewMix before closing an account. Closing the account can remove data held in the service, but it cannot remove a quote previously pasted into a brochure, advert or separate website system.
The controller should identify those external copies during account closure and decide whether they must be deleted, replaced or retained for another documented legal purpose. Consent evidence subject to the separate three-year retention period remains limited to grant and withdrawal metadata, not the testimonial text.
