. "Data such as personal details and credit card information in relation to the replacement of credentials is retained until the authorised destruction date." . . . .