- Purpose
This policy outlines the procedures for archiving and removing data at Slackify. It ensures that data is retained as required for legal, financial, and operational purposes, while also ensuring that data is securely removed when no longer needed, in compliance with data protection regulations including HIPAA. - Scope
This policy applies to all data collected, processed, and stored by Slackify, including user data, financial records, and operational logs. - Data Archival
3.1 Criteria for Archival
Data will be archived if it meets the following criteria:
Financial records required for tax purposes
Data subject to legal hold
Operational data required for long-term analysis and reporting
3.2 Archival Process
Identification: Data for archival is identified based on retention requirements.
Extraction: Relevant data is extracted from active systems.
Format Conversion: Data is converted to a stable, long-term format if necessary.
Metadata Tagging: Archived data is tagged with metadata including date of archival, retention period, and reason for archival.
Secure Storage: Archived data is stored in a secure, encrypted archive system separate from active data.
3.3 Access to Archived Data
Access to archived data is strictly limited and logged.
Requests for access must be approved by the Data Protection Officer.
- Data Removal
4.1 Criteria for Removal
Data will be removed when:
The retention period specified in the Data Retention Policy has expired
A valid user request for data deletion is received
The data is no longer needed for the purpose it was collected
4.2 Removal Process
Identification: Data for removal is identified through automated flagging and regular audits.
Verification: The Data Protection Officer verifies that the data is eligible for removal.
Backup Check: Ensure the data is not part of any active backup sets.
Secure Deletion: Data is securely deleted using industry-standard methods to ensure it cannot be recovered.
Logging: All data removal actions are logged for audit purposes.
4.3 Methods of Secure Deletion
For digital data: Use of secure deletion software that overwrites data multiple times.
For cloud-stored data: Ensure deletion from all redundant storage locations.
For physical media: Physical destruction of media when decommissioned.
- Special Considerations
5.1 User Data
Premium user data and reports are automatically deleted after 30 days as per the Data Retention Policy.
User account information is removed 30 days after account closure.
5.2 Financial Records
Financial records are archived for 7 years after the end of the relevant financial year.
After 7 years, these records are securely deleted unless subject to an ongoing legal hold.
5.3 Operational Logs
Non-essential operational logs are deleted after 90 days.
Essential logs may be archived for up to 2 years before secure deletion. - Compliance and Auditing
Regular audits will be conducted to ensure compliance with this policy.
Any discrepancies or policy violations will be reported to the Data Protection Officer for immediate action. - Employee Training
All employees handling data will receive annual training on this policy and related data handling procedures. - Policy Review
This policy will be reviewed annually and updated as necessary to reflect changes in legal requirements, technology, and best practices in data management.
Last Updated: October 06, 2024
