Policy

Data Backup Policy

 

DattaX IT Private Limited (“DattaX” or the “Company”) maintains backups of critical data to support the recovery of such data in the event of accidental deletion, corruption, system failure, or other circumstances resulting in data loss.

 

All original and critical data in the possession of, or operated on by, DattaX that is identified as requiring backup shall be backed up in accordance with this policy. Backups shall be maintained in a manner appropriate to the nature and importance of the data and the operational requirements of the relevant system.

 

Frequency 

 

DattaX shall periodically perform backups of critical data. The frequency of backup shall be determined based on the criticality of the data, the frequency with which the data changes, and the operational requirements of the relevant system. Critical production and business data should ordinarily be backed up at least daily, unless a different frequency has been approved by the relevant system or data owner.

 

Where technically feasible, automated backup mechanisms should be used for systems containing critical data. The backup configuration and schedule for critical systems shall be periodically reviewed to ensure that backups continue to operate as intended.

 

Backup Storage

 

Backups shall be stored separately from the primary production environment to reduce the risk that an incident affecting the primary data will simultaneously affect its backups. Where practicable, DattaX should maintain multiple backup copies of critical data and maintain at least one copy in a physically separated location.

 

Backups containing confidential, restricted, personal, customer or otherwise sensitive information shall be protected through appropriate access controls and security measures. Where backup services or infrastructure are provided by a third-party vendor, the relevant contractual and vendor-management requirements shall apply to the availability and protection of such data.

 

Access to and deletion of backups

 

Access to backups shall be restricted to authorised personnel who require such access for legitimate business or technical purposes. Only authorised system or infrastructure administrators, or other personnel specifically designated by the Company, may modify or delete backups.

 

Backups shall not be intentionally deleted, disabled, altered, or otherwise interfered with without appropriate authorisation. Where the underlying data or database is intentionally deleted in accordance with an authorised business or operational requirement, the associated backups may also be deleted, subject to applicable retention requirements and authorisation. Backup deletion shall be carried out in a manner that prevents unauthorised recovery of the data where secure deletion is required.

 

Non-Compliance 

 

Personnel who violate this policy may face appropriate disciplinary or contractual action proportionate to the nature and impact of the violation. Depending on the circumstances, such action may include a warning, suspension, termination of employment or engagement, or other action permitted under applicable Company policies, contractual arrangements, and law.

 

Questions

Questions regarding this policy or the Company’s data backup requirements should be directed to the policy owner.

 

Data Breach Notification Policy

1. OBJECTIVE

 

DattaX IT Private Limited (“DattaX” or the “Company”) is committed to protecting personal data and responding promptly and appropriately to actual or suspected data breaches.

The objective of this policy is to establish a clear and consistent framework for:

• identifying and reporting suspected data breaches;
• assessing and investigating data breaches;
• containing and mitigating their impact;
• determining applicable notification and reporting requirements;
• notifying affected individuals, customers, regulators, and other relevant parties where required; and
• documenting and reviewing data breaches to prevent recurrence.

This policy is intended to ensure that data breaches are managed in accordance with applicable legal, regulatory, contractual, and business requirements.

 

2. SCOPE

 

This policy applies to all actual or suspected data breaches involving data processed, stored, or otherwise controlled by DattaX.

It applies to:

• employees;
• contractors and consultants;
• temporary personnel;
• third-party service providers and Data Processors; and
• other persons who have access to DattaX systems or data.

 

This policy applies to breaches involving electronic or physical information, including personal data, customer data, confidential information, credentials, business records, and other information requiring protection.

 

Where a third-party service provider identifies a breach affecting data processed on behalf of DattaX, the service provider shall notify DattaX in accordance with the applicable contractual requirements and applicable law.

 

3. POLICY STATEMENT

 

A Data Breach means an actual or reasonably suspected incident involving unauthorised or accidental access to, acquisition, disclosure, use, alteration, loss, destruction, or compromise of personal data or other protected information.

 

Not every cybersecurity or operational incident will necessarily constitute a Data Breach. However, any incident that may involve unauthorised access to or compromise of personal data shall be treated as a potential Data Breach until appropriately assessed.

 

Personnel shall not delay reporting a suspected breach because they are uncertain whether the incident legally constitutes a Data Breach. The determination shall be made through the Company’s breach assessment process.

 

4. REPORTING OF SUSPECTED BREACH

 

Any employee, contractor, consultant, Data Processor, or other person who becomes aware of or reasonably suspects a Data Breach shall report it immediately through the Company’s designated incident-reporting channel.

 

A person reporting a suspected breach should not attempt to independently investigate, delete evidence, contact affected individuals, or communicate with external parties unless specifically authorised.

 

Where immediate containment is necessary to prevent further harm, reasonable protective action may be taken while preserving relevant evidence.

 

5. INITIAL ASSESSMENT

 

Upon receiving a report of a suspected Data Breach, the Information Security Officer, or designated incident-response personnel, shall conduct an initial assessment.

The assessment should determine, to the extent reasonably possible:

• whether a Data Breach has occurred;
• whether personal data or other protected information is involved;
• the systems, records, and data affected;
• the categories and approximate volume of data affected;
• the categories and approximate number of individuals affected;
• whether the data was accessed, acquired, disclosed, altered, lost, or destroyed;
• whether the data was encrypted, anonymised, masked, or otherwise protected;
• the likely consequences of the incident;
• the likelihood and severity of harm to affected individuals or the Company;
• whether the incident remains ongoing;
• whether a Data Processor or third party is involved; and
• whether notification or reporting obligations are triggered.

 

Where the information available at the time is incomplete, the assessment shall be updated as additional information becomes available.

 

6. CONTAINMENT AND MITIGATION

 

DattaX shall take reasonable and proportionate measures to contain and mitigate a Data Breach.

Depending on the circumstances, such measures may include:

• restricting or disabling compromised accounts;
• isolating affected systems;
• revoking or resetting credentials;
• blocking unauthorised access;
• applying security patches or configuration changes;
• recovering or securing affected devices;
• preserving relevant logs and evidence;
• restoring affected systems from verified backups;
• preventing further disclosure or dissemination of affected data; and
• engaging specialist technical, forensic, legal, or other professional assistance where required.

Containment and mitigation activities shall be undertaken without unnecessarily compromising evidence required for investigation or legal proceedings.

 

7. INVESTIGATION OF DATA BREACH

 

The Information Security Officer, with appropriate support from IT, Legal/Compliance, Privacy, management, or external specialists, shall coordinate the investigation.

The investigation shall seek to establish:

1. the cause of the breach;
2. when the incident occurred and when it was discovered;
3. how the incident occurred;
4. what systems and data were affected;
5. who or what may have accessed or received the information;
6. the number and categories of affected individuals;
7. the actual and potential consequences;
8. whether the incident remains ongoing;
9. whether the incident arose from a control failure, human error, malicious activity, or third-party action; and
10. what remedial measures are required.

 

Where appropriate, DattaX shall preserve forensic evidence, logs, records, communications, and other material relevant to the investigation.

 

The investigation and related records shall be handled confidentially and shared only with persons who require access for legitimate purposes.

 

8. REGULATORY AND STATUTORY NOTIFICATION

 

DattaX shall determine whether the Data Breach is required to be reported to a regulatory authority, law-enforcement authority, or other competent body.

Where the incident falls within the scope of the CERT-In Cyber Security Directions, the Company shall comply with the applicable reporting requirements.

 

CERT-In’s directions require covered cyber incidents, including data breaches and data leaks, to be reported within 6 hours of noticing such incidents or being brought to notice. Where complete information is not available within that period, available information shall be provided and additional information may be submitted subsequently within a reasonable time.

 

Where notification is required under applicable data-protection legislation, including the Digital 

Personal Data Protection Act, 2023 and applicable Rules, DattaX shall make the required notification to the competent authority within the applicable statutory period and in the prescribed manner. Where another jurisdiction’s law applies because of the location of the affected individual, customer, processing activity, or contractual arrangement, the relevant notification requirements shall also be assessed.

 

9. CUSTOMER AND CONTRACTUAL NOTIFICATION

 

Where DattaX processes personal data or other protected information on behalf of a customer, the relevant customer agreement shall be reviewed to determine applicable notification requirements.

Where contractual notification is required, DattaX shall notify the customer within the applicable contractual period and provide information reasonably necessary for the customer to meet its own 

legal or regulatory obligations.

 

Where DattaX acts as a Data Processor, it shall cooperate with the relevant Data Fiduciary in investigating, containing, and responding to the breach.

 

Unless otherwise authorised or legally required, DattaX shall not independently notify affected individuals or regulators where the customer, as the relevant Data Fiduciary or controller, is contractually responsible for such notification.

 

10. RESPONSIBILITIES

 

Information Security Officer

The Information Security Officer shall:

• oversee implementation of this policy;
• receive and coordinate reports of suspected Data Breaches;
• coordinate initial assessment and investigation;
• coordinate containment and mitigation;
• maintain breach records; and
• coordinate with relevant internal and external stakeholders.

 

IT / Infrastructure Team

The IT / Infrastructure Team shall:

• assist in identifying and containing technical incidents;
• preserve relevant logs and technical evidence;
• implement technical remediation;
• support forensic investigation and recovery; and
• assist with regulatory and customer reporting where required.

 

Legal / Compliance / Privacy Function

Where applicable, the Legal, Compliance, or Privacy function shall:

• assess applicable legal and contractual notification obligations;
• advise on regulatory and Data Principal notifications;
• assist with customer and contractual communications;
• advise on preservation and disclosure of evidence; and
• coordinate with external counsel or regulators where necessary.

 

Business and Data Owners

 

Business and Data Owners shall cooperate with the investigation, identify affected data and processes, and assist with containment, notification, and remediation.

 

Employees and Other Users

 

Employees, contractors, consultants, and other users shall immediately report suspected breaches, cooperate with investigations, preserve relevant evidence, and comply with authorised instructions.

 

11. NON-COMPLIANCE

 

Compliance with this policy shall be monitored through appropriate mechanisms, including audits, incident reviews, reporting, testing, and feedback to the policy Owner.

Any employee, contractor, consultant, or other person who violates this policy may be subject to appropriate disciplinary or contractual action.

The action taken shall depend upon the nature, intent, extent, and consequences of the violation and may include a warning, suspension, termination of employment or engagement, or other action permitted under applicable Company policies, contractual arrangements, and law.

 

12. DOCUMENT SECURITY CLASSIFICATION

 

This policy is classified as Company Internal and shall be handled in accordance with the Company’s Data Classification Policy.

 

13. SCHEDULE

This policy shall be reviewed at least annually and whenever significant changes occur in:

• applicable data protection or cybersecurity laws;
• regulatory reporting requirements;
• the Company’s systems or technology;
• the nature or volume of personal data processed;
• material customer or Data Processor arrangements; or
• the Company’s incident-response procedures.

The policy shall also be reviewed following a material Data Breach where the incident identifies a material deficiency in the policy or related procedures.

 

Data Classification Policy

 

1. Objective

The Data Classification Policy provides a framework for classifying data  processed by DattaX IT Private Limited staff, software, and systems. The purpose of this policy is to establish a framework for classifying data based on its sensitivity, value, and criticality to the organization. By understanding the types of  data, their classification, and access level,  the company can determine the appropriate access or level of protection needed. This  framework ensures that critical company data can be secured.

2. Scope

This policy applies to all data handled, managed, stored, or transmitted by DattaX IT Private Limited and its staff. Managers and information owners shall assign the appropriate classification as required.

3. Policy Statement

Each individual at DattaX IT Private Limited shall be responsible for reviewing, adhering to, and handling data according to the classification levels defined below. In case of difficulty identifying a specific data element or uncertainty regarding the associated risk and appropriate classification and handling, individuals are encouraged to contact DattaX IT Private Limited’s Information Security Officer for guidance and assistance.

4. Data Classification Definitions

DattaX IT Private Limited’s data is classified as follows:

4.1 Public Data

This data or information may be shared with any person, organization, or system regardless of their relationship with DattaX IT Private Limited. This classification is not limited to data meant for public consumption but also includes any data that requires no special handling or safeguarding from disclosure. The distribution of such data does not expose DattaX IT Private Limited, its customers, or its partners to any harm.

Examples of Public Data include product blogs, company websites, press releases, marketing collaterals, career pages, etc.

4.2 Company Internal Data 

This data shall be accessible by all staff within DattaX IT Private Limited and may be required for the smooth operational functioning of the organization. Such information shall not be made available to parties outside DattaX IT Private Limited but may be shared if requested.

Examples of Company Internal Data include Information Security Policies and  Procedures, HR Policies, Leave Policies and  Holiday Lists, Operational Procedures, etc.

4.3 Company Confidential Data

This data and  information shall be accessible by pre-authorized staff members and shall not be made generally available to all personnel at  DattaX IT Private Limited. Unauthorized access or disclosure could cause significant financial or material loss and poses a risk to DattaX IT Private Limited if accessed without authorisation . Access to such data may also be limited to specific staff members or groups such as executives, HR, or legal teams.

Examples of Company Confidential Data include employee salaries, legal documents, internal product specifications, customer lists, strategy documents, internal roadmaps, design documents, internal memos, and emails.

4.4 Customer Confidential Data

This data, if accessed by unauthorized parties, may adversely affect DattaX IT Private Limited’s customers. This includes data that DattaX IT Private Limited is required to keep confidential, either by law or under a customer agreement. Customer Confidential Data needs to be safeguarded when it is stored, processed, used, and transmitted.

Examples of Customer Confidential Data include data provided by customers using our systems, information on customer accounts, and personally identifiable information of customers (or customers of DattaX’s customers).

4.5 Personal Data

This data, if accessed by unauthorized parties, may adversely affect the privacy of individuals. For purposes of this Policy, Personal Data means information relating to an identified or identifiable individual, as defined under applicable data protection and privacy laws. This includes data DattaX IT Private Limited is required to safeguard, either by law (e.g., GDPR for EU citizens’ data where its scope applies) or under a customer agreement. Personal Data needs to be safeguarded when it is stored, processed, used, and transmitted.

Examples of Personal Data include name, email, phone number, IP address, political views of individuals, cookies, personal health records, credit card information, etc. Note that personal health records, credit card information, and other sensitive personal data may be subject to additional laws based on the location of the relevant individual or jurisdiction applicable to the processing. . Certain health information may be subject to additional sector-specific laws, such as HIPAA where the relevant information is regulated under HIPAA and the organisation is a covered entity or business associate

5. Labeling of Information

Depending on the requirements, the asset owner should label data/information based on this Data Classification Policy. Labeling methods for physical and electronic information could include appropriate tagging of information based on its  classification..

6. Document Security Classification

Company Internal (as described in Section 4.2 of this document).

7. Non-Compliance

Compliance with this policy shall be verified through various methods, including but not limited to automated reporting, audits, and feedback to the policy owner. Any staff member found to be in violation of this policy may be subject to disciplinary action, which may include termination of employment or contractual agreement. The disciplinary action shall depend on the extent, intent, and repercussions of the specific violation.

8. Responsibilities

The Information Security Officer is responsible for approving and reviewing policy and related procedures. Supporting functions, departments, and staff members shall be responsible for implementing the relevant sections of the policy in their area of operation.

9. Schedule

This document shall be reviewed annually and whenever significant changes occur in the organization.

Data Protection Policy

 

1. OBJECTIVE

DattaX IT Private Limited (“DattaX” or the “Company”) is committed to protecting the personal data entrusted to it and to processing personal data responsibly, securely, and in accordance with applicable data protection and privacy laws.

The purpose of this policy is to establish the principles and responsibilities governing the collection, use, storage, disclosure, sharing, retention, and deletion of personal data processed by DattaX.

This policy is intended to ensure that personal data is processed only for legitimate and specified purposes, is appropriately protected, and is not retained or used beyond what is reasonably required.

2. SCOPE

This policy applies to all personal data processed by or on behalf of DattaX in connection with its business activities.

This policy applies to all employees, contractors, consultants, temporary personnel, and other persons who collect, access, use, disclose, store, or otherwise process personal data on behalf of DattaX.

It applies to personal data maintained in electronic or other forms to the extent covered by applicable law.

3. POLICY STATEMENT

DattaX shall process personal data in accordance with applicable data protection laws, contractual obligations, and the requirements of this policy.

Personal data shall be processed only where there is a lawful basis for the processing and for a specified and legitimate purpose.

Where DattaX acts as a Data Fiduciary, it shall remain responsible for compliance with applicable data protection requirements in respect of processing undertaken by it or by a Data Processor on its behalf.

4. PRINCIPLES FOR PROCESSING PERSONAL DATA

DattaX shall apply the following principles when processing personal data.

4.1 Lawfulness and Transparency

Personal data shall be processed only for a lawful purpose and in accordance with applicable legal and contractual requirements.

Where consent is relied upon, DattaX shall obtain and manage consent in accordance with applicable law. Consent shall not be treated as a substitute for another lawful basis where processing is otherwise permitted or required by law.

4.2 Purpose Limitation

Personal data shall be collected and processed for specified, explicit, and legitimate purposes.

Personal data shall not be subsequently used for an unrelated purpose unless such processing is permitted under applicable law or otherwise appropriately authorised.

4.3 Data Minimisation

DattaX shall collect and process only such personal data as is reasonably necessary for the relevant purpose.

Personnel shall not collect personal data merely because it may be useful in the future where there is no identified business or legal requirement for doing so.

4.4 Accuracy

DattaX shall take reasonable steps to ensure that personal data is accurate, complete, and appropriately updated, particularly where the data is used to make decisions affecting an individual or is disclosed to another Data Fiduciary.

4.5 Storage Limitation

Personal data shall not be retained for longer than is necessary for the purpose for which it is processed, unless continued retention is required or permitted by applicable law, contract, legal proceedings, regulatory requirements, or other legitimate requirements.

Retention and deletion shall be managed in accordance with the Company’s Data Retention Policy.

4.6 Integrity and Confidentiality

Personal data shall be protected through appropriate technical and organisational measures designed to preserve its confidentiality, integrity, and availability and to prevent unauthorized or unlawful processing.

4.7 Accountability

DattaX shall maintain appropriate policies, procedures, records, controls, and responsibilities to demonstrate compliance with applicable data protection requirements.

5. NOTICE AND CONSENT

Where DattaX is required to provide notice to a Data Principal, the notice shall be provided in a clear and understandable manner and shall contain information required by applicable law.

The Company shall not make the provision of goods or services conditional upon unnecessary personal data or consent where such data or consent is not required for the relevant service, except where permitted by applicable law.

6. SECURITY OF PERSONAL DATA

DattaX shall implement reasonable technical and organisational measures appropriate to the nature and risk of the personal data processed.

Access to personal data shall be limited to authorised personnel who require such access for legitimate business purposes.

Personnel shall not copy, download, disclose, transfer, or otherwise use personal data outside authorised business purposes.

7. PERSONAL DATA BREACHES

Any suspected or actual unauthorised access, disclosure, acquisition, sharing, use, alteration, destruction, or loss of personal data shall be reported promptly through the Company’s designated incident-reporting mechanism.

DattaX shall maintain procedures for identifying, assessing, containing, investigating, documenting, and responding to personal data breaches.

Where applicable under law, DattaX shall notify the relevant regulatory authority and affected Data Principals within the prescribed time and in the prescribed manner.

Where the DPDP Rules, 2025 are applicable, breach notifications shall be handled in accordance with the applicable requirements, including notification to affected Data Principals without delay and notification to the Data Protection Board within the applicable prescribed timelines.

Employees and other personnel shall not independently communicate with affected individuals, regulators, media, or other external parties concerning a personal data breach unless specifically authorised to do so.

8. DATA PROCESSORS AND THIRD PARTIES

Where DattaX engages a third party to process personal data on its behalf, the engagement shall be subject to appropriate contractual and security requirements.

DattaX shall exercise appropriate due diligence when selecting and monitoring Data Processors and shall take reasonable steps to ensure that processors comply with applicable data protection and security requirements.

9. CROSS-BORDER PROCESSING AND TRANSFERS

Personal data may be transferred or processed outside India only in accordance with applicable law, contractual requirements, and any restrictions or conditions imposed by the Central Government or another competent authority.

Where personal data is transferred to or processed by an overseas service provider, DattaX shall consider the applicable legal requirements, contractual protections, security measures, and risks associated with the transfer.

Where a higher degree of protection or additional restriction is imposed by another applicable law, regulation, contract, or customer requirement, the more stringent requirement shall be observed to the extent applicable.

10. DATA PROTECTION BY DESIGN AND RISK MANAGEMENT

DattaX shall, where appropriate and proportionate to the nature and risk of processing, consider data protection requirements when designing or materially changing products, applications, systems, services, and business processes involving personal data.

Where DattaX is classified as a Significant Data Fiduciary or is otherwise required by applicable law, it shall undertake the additional assessments, audits, impact assessments, and governance measures prescribed by law.

11. DATA PROTECTION OFFICER / PRIVACY CONTACT

Where DattaX is required by applicable law to appoint a Data Protection Officer (“DPO”), the Company shall appoint a suitably qualified individual in accordance with the applicable requirements.

Where a DPO is required for a Significant Data Fiduciary, the DPO shall perform the responsibilities prescribed under applicable law and shall serve as an appropriate point of contact for data protection and grievance-related matters.

Where a DPO is not legally required, DattaX shall designate an appropriate person or function to address questions and requests relating to the processing of personal data.

The relevant contact details shall be made available through appropriate channels where required by law.

12. DOCUMENT SECURITY CLASSIFICATION

This policy is classified as company internal and shall be handled in accordance with the Company’s Data Classification Policy.

13. NON-COMPLIANCE

Compliance with this policy shall be verified through appropriate monitoring, audits, assessments, automated reporting, and feedback to the Policy Owner.

Any employee, contractor, consultant, or other person who violates this policy may be subject to disciplinary or contractual action proportionate to the nature, intent, extent, and consequences of the violation.

Such action may include a warning, suspension, termination of employment or engagement, or other action permitted under applicable Company policies, contractual arrangements, and law.

14. RESPONSIBILITIES

Information Security Officer

The Information Security Officer shall be responsible for approving and reviewing this policy and overseeing its implementation from an information-security perspective.

Privacy / Data Protection Function

The designated privacy or data protection function shall oversee privacy-related requirements, coordinate Data Principal requests, advise on data-processing activities, and support compliance with applicable data protection requirements.

IT / Infrastructure Team

The IT / Infrastructure Team shall implement and maintain appropriate technical controls for protecting personal data and shall support access management, logging, security, backup, deletion, and breach response.

Business and Data Owners

Business and Data Owners shall ensure that personal data processed within their functions is collected, used, shared, retained, and deleted in accordance with this policy and applicable requirements.

Employees and Other Users

Employees, contractors, consultants, and other users shall comply with this policy, protect personal data accessed by them, use such data only for authorised purposes, and promptly report suspected data breaches or violations.

15. SCHEDULE

This policy shall be reviewed at least annually and whenever significant changes occur in applicable data protection or privacy laws and the Company’s products, services, or business operations.

 

Data Retention Policy

 

1. OBJECTIVE

DattaX IT Private Limited (“DattaX” or the “Company”) recognises that information should not be retained indefinitely where there is no continuing legal, contractual, regulatory, operational, or legitimate business requirement for doing so.

This policy establishes the principles and requirements governing the retention, review, archival, and deletion of data maintained by DattaX.

The objective of this policy is to ensure that data is retained for an appropriate period, remains available where required, and is securely deleted or disposed of when the applicable retention period has expired and there is no continuing requirement to retain it.

2. SCOPE

This policy applies to data and records in the possession, custody, or control of DattaX, whether maintained electronically or in physical form.

This includes, as applicable:

• customer and user information;
• employee and personnel records;
• business and operational records;
• financial and accounting records;
• contracts and related documentation;
• communications and correspondence;
• system and application records;
• security and audit logs;
• technical and operational records;
• personal data processed by or on behalf of DattaX; 
• and data maintained by third-party service providers on behalf of DattaX.

This policy applies to employees, contractors, consultants, and other personnel who create, access, maintain, store, or dispose of Company data.

3. POLICY STATEMENT

DattaX shall retain data only for as long as there is a valid and documented reason to retain it.

The applicable retention period shall be determined by considering, as relevant:

• applicable laws and regulatory requirements;
• contractual obligations;
• legitimate business and operational requirements;
• accounting, tax, audit, and financial requirements;
• legal proceedings, investigations, disputes, or potential claims;
• information-security and audit requirements;
• requirements applicable to personal data;
• requirements imposed by customers or other stakeholders; and
• the nature, sensitivity, and importance of the data.

 

Where different requirements apply to the same data, the data shall ordinarily be retained for the longer period required by the applicable law, contract, legal hold, or other binding requirement.

Retention shall not be used as a reason to retain data indefinitely where no continuing requirement exists.

4. DATA RETENTION GUIDELINES

4.1 Retention Periods

DattaX shall maintain appropriate retention periods for different categories of data.

Unless a longer period is required by applicable law, contract, legal hold, or business requirement, the following baseline periods may be applied:

Data Category	Baseline Retention Period
Customer and user records	For the duration of the customer relationship and thereafter as required by law, contract, or legitimate business requirement
Customer personal data	Only for as long as required for the specified purpose or as otherwise permitted/required by applicable law
Employee and personnel records	Duration of employment/engagement and thereafter as required by applicable law or legitimate business requirements
Financial and accounting records	Minimum period prescribed under applicable law
Contracts and material commercial records	Duration of the contractual relationship and thereafter for the applicable limitation, legal, audit, or business requirement
System and application logs	In accordance with applicable law, regulatory requirements, security requirements, and operational needs
Security and audit records	For the period required for security monitoring, investigation, audit, legal, regulatory, or contractual purposes
Internal policies and policy versions	As determined by the Company and applicable legal/audit requirements

 

The periods above are baseline requirements and shall not override a longer mandatory retention period.

Where a specific law, regulation, contractual requirement, customer requirement, or legal proceeding prescribes a different retention period, that requirement shall take precedence.

 

4.2 Personal Data

Personal data shall not be retained for longer than is necessary for the purpose for which it is processed, except where continued retention is required or permitted under applicable law.

Where the purpose for which personal data was collected or processed has been fulfilled and there is no continuing legal, contractual, security, or other valid basis for retention, the data shall be deleted, anonymised, or otherwise disposed of in accordance with applicable requirements.

Requests relating to deletion or erasure of personal data shall be appropriately authenticated, assessed, and handled in accordance with applicable law and the Company’s privacy and data-protection procedures.

A deletion request shall not automatically require deletion where DattaX is legally required or otherwise permitted to retain the relevant information.

5. DATA DELETION AND DISPOSAL

When the applicable retention period has expired and there is no continuing requirement to retain the data, the data shall be securely deleted, destroyed, anonymised, or otherwise disposed of, as appropriate.

Deletion shall cover data maintained in relevant active systems and, where technically and operationally appropriate, associated repositories and copies.

Physical records containing confidential or personal information shall be securely destroyed using an appropriate method.

Electronic storage media and devices containing retained data shall be securely sanitised or disposed of in a manner that prevents unauthorised recovery of the information.

Where complete deletion from backups or other technically isolated systems cannot be performed immediately, such data shall not be restored or used except where necessary, and shall be deleted in accordance with the applicable backup lifecycle when the relevant backup expires.

6. THIRD-PARTY AND VENDOR DATA

Where DattaX engages a third party or service provider to process, store, or otherwise maintain data on its behalf, the relevant contractual arrangements should address applicable retention and deletion requirements.

Where a vendor’s own retention requirements apply, such requirements shall be reviewed to ensure that they do not conflict with DattaX’s contractual, legal, regulatory, or data-protection obligations.

7. BACKUPS AND RETENTION

Retention of backup data shall be governed by the Company’s Data Backup Policy in addition to any applicable legal, regulatory, contractual, or preservation requirements.

Deletion of data from an active production system does not necessarily require immediate deletion from every backup copy where immediate deletion is technically impracticable.

Backup copies shall, however, be subject to defined retention periods and shall not be retained indefinitely.

Where data is required to be preserved pursuant to a legal hold or other mandatory preservation requirement, the relevant backup or other copy shall be preserved to the extent necessary.

8. NON-COMPLIANCE

Compliance with this policy may be verified through audits, automated reporting, monitoring, reviews, and feedback to the policy owner.

Any employee, contractor, or other personnel found to be in violation of this policy may be subject to appropriate disciplinary or contractual action.

The action taken shall depend upon the nature, intent, extent, and consequences of the violation and may include a warning, suspension, termination of employment or engagement, or other action permitted under applicable Company policies, contractual arrangements, and law.

9. DOCUMENT SECURITY CLASSIFICATION

This policy is classified as company internal and shall be handled in accordance with the Company’s Data Classification Policy.

10. SCHEDULE

This policy shall be reviewed at least annually and whenever significant changes occur in the Company’s business operations, information systems, applicable legal or regulatory requirements, contractual obligations, or data-processing activities.