Data Deletion & Retention Policy

INTRODUCTION

The Data Retention and Deletion Policy establishes the guiding principles, guidelines, and protocols for managing and safeguarding data within RAFTAARPAY. The purpose is to ensure that data is retained and removed as per applicable laws and regulations while considering the operational needs of the organization.

1. Scope

Applicability This policy pertains to all data, regardless of its format (digital or physical), that is gathered, stored, or processed by RAFTAARPAY, encompassing information associated with customers, employees, suppliers, and other stakeholders.

2. Data Categories

2.1. PERSONAL DATA: Information capable of identifying individuals, including names, addresses, contact details, and sensitive personal information.
2.2. FINANCIAL DATA: Information related to financial transactions, encompassing payment details, invoices, and financial reports.
2.3. OPERATIONAL DATA: Information utilized in the organization's day-to-day operations, such as emails, communication records, and project-related data.
2.4. LEGAL/COMPLIANCE DATA: Information necessary to comply with legal and regulatory obligations, including contracts, tax records, and compliance reports.

3. Data Retention Periods

3.1. PERSONAL DATA: Retained only for the duration necessary to serve the purposes for which it was collected or as stipulated by the law. Following the retention period, personal data is securely deleted.
3.2. FINANCIAL DATA: Kept as required by pertinent financial and tax regulations. After the prescribed retention period, financial data is securely deleted.
3.4. OPERATIONAL DATA: Maintained for a reasonable duration to support business activities. Once obsolete, operational data is securely deleted.
3.5. LEGAL/COMPLIANCE DATA: Retained for the duration specified by applicable laws or regulations. Once the retention period ends, legal/compliance data is securely deleted.

4. Data Deletion Procedures

4.1. Data deletion entails the secure and irreversible elimination of data from all pertinent storage locations. The deletion process involves:
a) Identifying data to be deleted as per retention periods.
b) Confirming the deletion request and acquiring necessary approvals.
c) Employing suitable methods and tools to securely erase data.
d) Documenting the deletion process for auditing and compliance purposes.

5. Responsibilities

5.1. DATA OWNER: Responsible for determining suitable data retention periods and initiating deletion requests when necessary.
5.2. IT DEPARTMENT: Accountable for executing data deletion procedures and ensuring secure and permanent data erasure.

6. Training and Awareness

6.1. RAFTAARPAY will provide training and promote awareness among employees to ensure adherence to this policy, including education on data protection, privacy, and optimal data retention practices.

7. Monitoring and Enforcement

7.1. RAFTAARPAY will supervise policy implementation and ensure compliance. Failure to comply may result in disciplinary measures.

8. Review and Updates

8.1. Regular review of this policy will ensure alignment with evolving laws and regulations.

9. Document Retention

9.1. This policy is to be preserved for reference and audit purposes.