The privacy policy references the privacy center for the conditions. They don't actually need to change the terms to retain and use data within the 5 year window. They can update the privacy center instead.