Data Retention Policy

Policy Statement

In the course of business, Digital Space Group Limited collects and stores a broad range of information. This policy explains why we need to retain and delete information and the processes involved. It is followed by an Information Retention and Deletion Schedule, setting out the retention periods for Digital Space information.

 

Purpose

The purpose of this policy is to formulate an internal schedule for the retention and eventual destruction of data records.

We have duties under legislation and/or regulations to retain information for certain periods of time, for example under anti-money laundering regulations or health and safety legislation. We also have other retention obligations to our insurers, regulators, accreditation bodies and customers. Balanced against this, the General Data Protection Regulation (‘GDPR’) only permits us to retain personal data for as long as is necessary for the purpose for which it was collected.

The accidental or intentional destruction of these records during their specified retention periods, or the retention of personal data for longer than those periods, could result in serious consequences for Digital Space and/or its employees, including criminal charges or significant fines (up to the greater of €20m or 4% of annual global turnover in the case of personal data). Failure to follow this policy could lead to disciplinary action.

 

Definitions

• Information: Can include both hard copy documents and electronic information. It may be stored at work premises, on electronic devices or stored online or in the It includes information belonging to or controlled by Digital Space which is stored by third parties such as suppliers, consultants or IT service providers. Some examples of where information may be located are:
  • Electronic files
  • Emails
  • Voicemails
  • Letters and other correspondence
  • Handwritten notes
  • Appointment books and calendars
  • Audio and video recordings
  • Contracts
  • Invoices
  • Memory in mobile phones and other devices
  • Websites such as Facebook, Twitter, Instagram
  • Instant messenger conversations such as Skype, WhatsApp
  • Performance reviews
  • Computer programs

• Confidential Information: Could be business sensitive information relating to company finances, commercial agreements or product specifications, or it could be data about We may also hold third party information which is confidential.
• Personal data: Some information which we store will be personal data. Storage of personal data is regulated by the GDPR. It includes any information which identifies an individual or relates to an identifiable It can include identifying someone by reference to an identifier such as a name, address, email address, ID number, location or an online identifier such as an IP address. Information relating to an identifiable individual’s physical, psychological, economic, cultural or social identity is also personal data. All personal data shall be treated as also being confidential information.
• Special Category Personal Data: Some types of personal data are especially sensitive. These special categories of personal data include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning health, sexual orientation or sex Genetic or biometric data (such as fingerprint or retinal scan data) is also special category personal data. Criminal convictions and offences data is not special category data but its processing is restricted and it is similarly sensitive in nature. Due to the potential sensitivity of this data there are increased risks involved should it be lost or retained for longer than required.

 

Scope

This policy defines Digital Space’s established protocol regarding the retention and subsequent deletion of data.

 

Responsibilities

Managers within the relevant departments that are responsible for data must ensure compliance with the Data Retention Schedule. They must ensure that retained data is appropriately protected from unauthorised access, as detailed in the Access Control Policy available on the Intranet or on Sharepoint.

Individuals responsible for the retention of data are additionally responsible for its destruction following the retention period.

The Chief Operating Officer (‘COO’) is responsible for ensuring compliance with Data Protection Legislation and with this policy. Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the COO at [email protected].

The COO is the owner of this document and is responsible for ensuring that it is reviewed. An annual review will be performed to determine whether retention of data is adequate and appropriate. Subsequent disposal will not take place until a review has taken place. The relevant managers must ensure disposal is appropriate to the media involved.

 

Information Retention

Legal, regulatory requirements or agreed industry practices are captured in the Data Retention Schedule, which provides a more granular view of the policy.

Information must only be retained for the amount of time indicated in the Data Retention Schedule. A record must not be retained beyond the period indicated in the Data Retention Schedule, unless a valid business reason (or ongoing/anticipated litigation or other special situation) calls for its continued retention. If you are unsure whether to retain a certain record or if you believe information should be retained for longer than the period stated in the Schedule, contact the COO.

Retention of data will be in accordance with the Information Security Policy.

 

Information Deletion

Deleting information which is no longer required is of benefit to Digital Space and is also required by legislation. One of the principles of the GDPR is data minimisation– only collecting and processing the personal data necessary for the purpose for that collection and processing. Personal data should only be kept for as long as is necessary for the purpose for which it was collected. Minimising the amount of information we retain reduces the amount of information which can be lost in a cyberattack. Individuals also have the right to access the personal data we hold about them. The more personal data we store unnecessarily, the more burdensome it is to respond to these requests.

Deletion of data will comply with the following relevant documents:

• Data Protection and Privacy Policy
• Acceptable Use Policy
• Secure Disposal or Re-Use of Equipment Policy

 

Information Destruction

The destruction of hard copy personal data and confidential, financial, and personnel-related records must be conducted by shredding.

Non-confidential records may be destroyed by recycling.

The destruction of electronic records must be coordinated with the Technical Director. Destruction of data will comply with the following relevant documents:

• Data Protection and Privacy Policy
• Acceptable Use Policy
• Secure Disposal or Re-Use of Equipment

 

Third Party Data

Information we hold which is controlled by third parties will be deleted in accordance with the agreement in place with that third party.

Information under our control which is held by third parties on our behalf must be destroyed in line with this policy unless the agreement in place with that third-party states they have the right to retain data. The contracts in place with third parties will include provisions requiring the deletion and destruction of information.

Deletion and destruction of data will comply with the following relevant documents:

• Data Protection and Privacy Policy
• Acceptable Use Policy
• Secure Disposal or Re-Use of Equipment

 

Reporting Policy Infringement

Digital Space is committed to enforcing this policy. The effectiveness of Digital Space’s efforts, however, depends largely on employees. If you feel that you do not understand this policy or you or someone else may have infringed this policy, you should report the incident immediately to your supervisor. If you are not comfortable bringing the matter up with your immediate supervisor, or do not believe the supervisor has dealt with the matter properly, you should raise the matter with the COO. If employees do not report inappropriate conduct, Digital Space may not become aware of a possible infringement of this policy and may not be able to take appropriate remedial action.

Internal Data