They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.</p> <p>If we become aware of any loss, misuse, alteration of personal data we will work closely with our IT team, Data Protection Officer (DPO) and other parties as necessary to investigate the incident at hand. We have put into place the relevant procedure and policies in place to investigate, mitigate and report (when needed to relevant parties) such instances.</p>15. Data Retention<p>We will not keep Personal Data longer than is necessary, for the purpose or purposes for which they were collected. Retention periods will vary according to the types of personal information we hold and for what purposes. Rocksteady will take all reasonable steps to destroy, or erase from its systems, all Personal Data which is no longer required. This does not apply to anonymised data.</p> <p>If you would like more information on our data retention practices, please contact us using the details in the ‘Contact Us’ section.</p>16.