Data Retention and Deletion Policy

1. Purpose

The purpose of this Data Retention and Destruction Policy is to ensure that DataBiz Solutions maintains its official records in accordance with the requirements of all applicable laws such as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and that official records no longer required by DataBiz Solutions are disposed of in a timely manner. This policy provides guidelines for the retention of official documents in ordinary commercial circumstances. It is also for the purpose of aiding employees of DataBiz Solutions in understanding their obligations in retaining digital documents, including, but not limited to, emails, Web files, text files, sound and video files, PDF documents, database records and all Office Suite or other formatted files.

2. Policy

This policy represents DataBiz Solutions's policy regarding the retention and disposal of records and the retention and disposal of digital documents. The intent of this policy is that records should be retained only as long as necessary to meet legislative, fiscal, contractual, administrative, and operational requirements. Staff, and service providers must ensure that documents for which they are responsible are accurate, complete, and are retained for the periods of time indicated in the policy, and then disposed of in accordance with the policy.

Documents must be managed and deleted / disposed of in a manner appropriate to the sensitivity of the information they contain. Therefore, it is the responsibility of staff and service providers to ensure that DataBiz Solutions's information classification standard is met when maintaining and deleting / disposing of records. When a document is destroyed (as defined in the policy below), care must be taken to ensure that all personal and confidential information contained therein is permanently and securely destroyed.

3. Policy as a Data Processor

As DataBiz Solutions is primarily a data processor for our client's data, it is the responsibility of the client to retain and destroy data as per their own Data Destruction and Retention Policy.

We will provide our clients with a facility where they can bulk delete data they deem ready for deletion. We provide numerous options under which they can delete such data, for example, based on:

• the age of the record
• the type of record
  • financial
  • personal
  • educational
  • psychological
  • medical
  • student data
  • staff data
  • other

This facility will provide safeguards to prevent the accidental deletion of data by not allowing the destruction/deletion of data, accidental or otherwise, to ensure that the data is kept in accordance with all applicable laws such as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and Department of Education guidelines.

DataBiz Solutions will not delete or edit any data belonging to a client on behalf of that client without its express consent whilst also ensuring it is in compliance with all applicable laws such as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and Department of Education guidelines.

4. Covered Records

This policy applies to all official records generated in the courses of the DataBiz Solutions operations, including but not limited to:

• Typed or printed hardcopy (papers) documents;
• Digital records and documents (email, Web file, text files, PDF files);
• Video or digital images;
• Digitally stored information contained on network servers, databases and/or document management system;

5. Applicability

This Policy applies to all physical records generated in the course of DataBiz Solutions's operation, including both original documents and reproductions. It also applies to the digital documents described above.

This Policy was most recently approved by the Board of Directors of DataBiz Solutions on 28-11-2024.

6. Record Storage Procedures

Records containing confidential information should be labeled and/or stored in a manner to limit access to those employees or other individuals with authorisation to view such records.

7. Responsibility for Retention

Responsibility for retention lies with the Data Protection Officer of DataBiz Solutions.

8. Destruction of Records

Files that have been retained for the period specified in the record retention schedule below should be destroyed promptly at the end of that period. Before an official document is destroyed, written approval must be given by the Data Protection Officer.

• Paper documents must be destroyed with the shredder.
• Digital documents must be placed in the desktop trash and the trash must be emptied.
• Data erasure software is run periodically to ensure the complete deletion of digital files so that they can't be recovered with data recovery tools.

Data deletion - can mean different things in relation to digital data, and we recognise it is not always possible to delete or erase all traces of the data. The key issue is to ensure data is put beyond use. If it is appropriate to delete personal data from a live system, consideration should also be given to the deletion of it from any back-up of the information on that system.

9. Record Retention Schedule

The table below provides an indication for the retention period by document type.

10. Confidentiality and Ownership

All records are the property of DataBiz Solutions and employees are expected to hold all business records in confidence and to treat them as DataBiz Solutions assets. Records must be safeguarded and may be disclosed to parties outside of the DataBiz Solutions only upon proper authorisation. Any court order or other request for documents received by employees, or questions regarding the release of the DataBiz Solutions's records, must be directed to the Data Protection Officer prior to the release of such records. This policy is not intended to and does not constitute or create contractual terms of employment, assure specific treatment under specific conditions, and/or does not alter the at-will nature of any employment relationship with DataBiz Solutions.