; (B) for the covered entity to provide a transaction or delivering a service requested by such individual, such as inventory management, financial reporting and accounting, planning, product or service improvement or forecasting, and customer support and service; (C) to prevent or detect fraud or to provide for a secure environment; (D) to investigate a possible crime; (E) to comply with a provision of law; (F) for the covered entity to market or advertise to such individual if the covered information used for such marketing or advertising was collected directly by the covered entity; or (G) for internal operations, including— (i) collecting customer satisfaction surveys and conducting customer research to improve customer service; and (ii) collection from an Internet website of information about visits and click-through rates relating to such website to improve— (I) website navigation and performance; and (II) the customer’s experience; (2) retain covered information for only such duration as— (A) with respect to the provision of a transaction or delivery of a service to an individual— (i) is necessary to provide such transaction or deliver such service to such individual; or (ii) if such service is ongoing, is reasonable for the ongoing nature of the service; or (B) is required by a provision of law; (3) retain covered information only for the purpose it was collected, or reasonably related purposes; and (4) exercise reasonable data retention procedures with respect to both the initial collection and subsequent retention. 132. Constraints on distribution of information (a) In general Each covered entity shall— (1) require by contract that any third party to which it transfers covered information use the information only for purposes that are consistent with— (A) the provisions of this title; and (B) as specified in the contract