How long can retailers retain customer data?