VALLEYDAO DATA RETENTION POLICY
- ABOUT THIS POLICY
- The information, records and data of ValleyDAO, a Swiss Association (Verein) having its address at Chamerstrasse 172, 6300 Zug, Switzerland (“ValleyDAO/we/us/our”) is important to how we conduct our mission and manage staff.
- There are legal and regulatory requirements for us to retain certain data, usually for a specified amount of time. We also retain data to help our business operate and to have information available when we need it. However, we do not need to retain all data indefinitely, and retaining data can expose us to risk as well as be a cost to our business.
- This Data Retention Policy explains our requirements to retain data and to dispose of data and provides guidance on appropriate data handling and disposal.
- Failure to comply with this policy can expose us to fines and penalties, adverse publicity, difficulties in providing evidence when we need it and in running our business.
- This policy applies to all ValleyDAO group entities. This policy does not form part of any staff members service agreement and we may amend it at any time.
- SCOPE OF POLICY
- This policy covers all data that we hold or have control over. This includes physical data such as hard copy documents, contracts, notebooks, letters and invoices. It also includes electronic data such as emails, electronic documents, audio and video recordings and CCTV recordings. It applies to both personal data and non-personal data. In this policy we refer to this information and these records collectively as "data".
- This policy covers data that is held by third parties on our behalf, for example cloud storage providers or offsite records storage. It also covers data that belongs to us but is held by staff on personal devices.
- This policy explains the differences between our formal or official records, disposable information, confidential information belonging to others, personal data and non-personal data. It also gives guidance on how we classify our data.
- GUIDING PRINCIPLES
- Through this policy, and our data retention practices, we aim to meet the following commitments:
- We comply with legal and regulatory requirements to retain data.
- We comply with our data protection obligations, in particular to keep personal data no longer than is necessary for the purposes for which it is processed (storage limitation principle).
- We handle, store and dispose of data responsibly and securely.
- We create and retain data where we need this to operate our business effectively, but we do not create or retain data without good business reason.
- We allocate appropriate resources, roles and responsibilities to data retention.
- We regularly remind staff of their data retention responsibilities.
- We regularly monitor and audit compliance with this policy and update this policy when required.
- ROLES AND RESPONSIBILITIES
- Responsibility of all staff. We aim to comply with the laws, rules, and regulations that govern our organisation and with recognised compliance good practices. All staff must comply with this policy, any communications suspending data disposal and any specific instructions from management. Failure to do so may subject us, our staff, and contractors to serious civil and/or criminal liability. Staff’s failure to comply with this policy may result in disciplinary sanctions, including suspension or termination. It is therefore the responsibility of everyone to understand and comply with this policy.
- Data Protection Representative. Our Data Protection Representative (DPR) is responsible for advising on and monitoring our compliance with data protection laws which regulate personal data. Our Data Protection Representative can be contacted at: people@valleydao.bio.
- TYPES OF DATA AND DATA CLASSIFICATIONS
- Formal or official records. Certain data is more important to us and is therefore listed in the Record Retention Schedule. This may be because we have a legal requirement to retain it, or because we may need it as evidence of our transactions, or because it is important to the running of our business. Please see paragraph 6.1 below for more information on retention periods for this type of data.
- Disposable information. Disposable information consists of data that may be discarded or deleted at the discretion of the user once it has served its temporary useful purpose and/or data that may be safely destroyed because it is not a formal or official record as defined by this policy and the Record Retention Schedule. Examples may include:
- Duplicates of originals that have not been annotated.
- Preliminary drafts of letters, memoranda, reports, worksheets, and informal notes that do not represent significant steps or decisions in the preparation of an official record.
- Books, periodicals, manuals, training binders, and other printed materials obtained from sources outside of ValleyDAO and retained primarily for reference purposes.
- Spam and junk mail.
Please see paragraph 6.2 below for more information on how to determine retention periods for this type of data.
- Personal data. Both formal or official records and disposable information may contain personal data; that is, data that identifies living individuals. Data protection laws require us to retain personal data for no longer than is necessary for the purposes for which it is processed (principle of storage limitation). See paragraph 6.3 below for more information on this.
- Confidential information belonging to others. Any confidential information that a staff member may have obtained from a source outside of ValleyDAO, such as a previous employer, must not, so long as such information remains confidential, be disclosed to or used by us. Unsolicited confidential information submitted to us should be refused, returned to the sender where possible, and deleted, if received via the internet.
- Data classifications. Some of our data is more confidential than other data. Our Asset Classification and Control Policy explains how we classify data and how each type of data should be marked and protected. When complying with this policy, it is also important that you follow our Information Security Policy and Data Privacy Policy
- RETENTION PERIODS
- Formal or official records. Any data that is part of any of the categories listed in the Record Retention Schedule contained in the Annex to this policy (“Record Retention Schedule”), must be retained for the amount of time indicated in the Record Retention Schedule. A record must not be retained beyond the period indicated in the Record Retention Schedule, unless a valid business reason (or notice to preserve documents for contemplated litigation or other special situation) calls for its continued retention. If you are unsure whether to retain a certain record, contact the Data Protection Representative.
- Disposable information. The Record Retention Schedule will not set out retention periods for disposable information. Disposable information consists of data that may be discarded or deleted at the discretion of the user once it has served its temporary useful purpose and/or data that may be safely destroyed because it is not a formal or official record as defined by this policy and the Record Retention Schedule. This type of data should only be retained as long as it is needed for business purposes. Once it no longer has any business purpose or value it should be securely disposed of.
- Personal data. As explained above, data protection laws require us to retain personal data for no longer than is necessary for the purposes for which it is processed (principle of storage limitation). Where data is listed in the Record Retention Schedule, we have taken into account the principle of storage limitation and balanced this against our requirements to retain the data. Where data is disposable information, you must take into account the principle of storage limitation when deciding whether to retain this data. More information can be found in in our Data Privacy Policy.
- What to do if data is not listed in the Record Retention Schedule. If data is not listed in the Record Retention Schedule, it is likely that it should be classed as disposable information. However, if you consider that there is an omission in the Record Retention Schedule, or if you are unsure, please contact the Data Protection Representative.
- STORAGE, BACK-UP AND DISPOSAL OF DATA
- Storage. Our data must be stored in a safe, secure, and accessible manner. Any documents and financial files that are essential to our business operations during an emergency must be duplicated and/or backed up and maintained off site. Where we use third party cloud service providers to host our data, we are reliant on them to back up and recover such data in accordance with their standard policies and procedures.
- Destruction. Our Data Protection Representative is responsible for the continuing process of identifying the data that has met its required retention period and supervising its destruction. The destruction of confidential, financial, and staff-related hard copy data must be conducted by shredding if possible. Non-confidential data may be destroyed by recycling. The destruction of electronic data must be co-ordinated with the IT Department.
- The destruction of data must stop immediately upon notification from the Data Protection Representative or CEO that preservation of documents for contemplated litigation is required (sometimes referred to as a litigation hold). This is because we may be involved in a legal claim or an official investigation (see next paragraph). Destruction may begin again once the Data Protection Representative or CEO lifts the requirement for preservation.
- SPECIAL CIRCUMSTANCES
- Preservation of documents for contemplated litigation and other special situations. We require all staff to comply fully with our Record Retention Schedule and procedures as provided in this policy. All staff should note the following general exception to any stated destruction schedule: If you believe, or the Data Protection Representative or CEO informs you, that certain records are relevant to current litigation or contemplated litigation (that is, a dispute that could result in litigation), government investigation, audit, or other event, you must preserve and not delete, dispose, destroy, or change those records, including emails and other electronic documents, until the Data Protection Representative or CEO determines those records are no longer needed. Preserving documents includes suspending any requirements in the Record Retention Schedule and preserving the integrity of the electronic files or other format in which the records are kept.
- If you believe this exception may apply, or have any questions regarding whether it may apply, please contact the Data Protection Representative
- In addition, you may be asked to suspend any routine data disposal procedures in connection with certain other types of events, such as our merger with another organisation or the replacement of our information technology systems.
- WHERE TO GO FOR ADVICE AND QUESTIONS
- Questions about the policy. Any questions about this policy should be referred to our Data Protection Representative, who is in charge of administering, enforcing, and updating this policy.
- BREACH REPORTING AND AUDIT
- Reporting policy breaches. We are committed to enforcing this policy as it applies to all forms of data. The effectiveness of our efforts, however, depend largely on staff. If you feel that you or someone else may have breached this policy, you should report the incident immediately to your supervisor. If you are not comfortable bringing the matter up with your immediate supervisor, or do not believe the supervisor has dealt with the matter properly, you should raise the matter with the Data Protection Representative. If staff do not report inappropriate conduct, we may not become aware of a possible breach of this policy and may not be able to take appropriate corrective action.
- No one will be subject to and we do not allow, any form of discipline, reprisal, intimidation, or retaliation for reporting incidents of inappropriate conduct of any kind, pursuing any record destruction claim, or co-operating in related investigations.
- Audits. Our Data Protection Representative will periodically review this policy and its procedures (including where appropriate by taking outside legal or auditor advice) to ensure we are in compliance with relevant new or amended laws, regulations or guidance. Additionally, we will regularly monitor compliance with this policy, including by carrying out audits.
- OTHER RELEVANT POLICIES
- This policy supplements and should be read in conjunction with our other policies and procedures in force from time to time, including without limitation our Privacy Policy, Cookie Policy and Data Protection Policy.
- RECORD RETENTION SCHEDULE
ValleyDAO establishes retention or destruction schedules or procedures for specific categories of data. This is done to ensure legal compliance (for example with our data protection obligations) and accomplish other objectives, such as protecting intellectual property and controlling costs.
Staff should comply with the retention periods listed in the record retention schedule below, in accordance with the Data Retention Policy above.
If you hold data not listed below, please refer to the Data Retention Policy above regarding disposable records. If you still consider your data should be listed, if you become aware of any changes that may affect the periods listed below or if you have any other questions about this record retention schedule, please contact our Data Protection Representative.
Personnel Records
- Employment/contractor applications, assessment results, interview records, and pre-employment qualification checks of unsuccessful candidates (electronic and paper)
- 6 months from notification that application is unsuccessful unless agreement to hold details on file.
Employee/contractor contracts
- While employment/worker contract continues and up to 6 years after termination
- Statute of limitation claims can usually be brought up to 6 years after termination of contract.
Personnel and training records
- (including pre-employment verification details such as qualifications checks, references as well as appraisals, disciplinary procedures, grievances, death benefit nomination and revocation forms, resignation, termination, and retirement records) (electronic and paper)
- While employment/worker contract continues and up to 6 years after termination
- Statute of limitation claims can usually be brought up to 6 years after termination of contract.
Working time opt-out forms
- While employment/worker contract continues and up to 2 years after termination
Working Time Records
- 2 years after the relevant period
Records re hours worked and payments made
- 3 years from pay reference period following the one that the records cover
Records required to show compliance with working time regulations
- 2 years after the relevant period
Working time opt-outs
- 2 years from the date entered into
Payroll and wage records
- 6 years from financial year end in which payments were made
PAYE Records
- Not less than 8 years after the end of the tax year to which they relate (consider 6 years)
Maternity Pay Records
- 6 years after the end of the tax year in which the maternity pay period ends
Season ticket and other staff loans
- 6 years after payment of benefit
Death in service benefit nomination and revocation forms
- 6 years after payment of benefit
Collective bargaining agreements
Consents for processing of personal data
- For as long as data processing lasts and 6 years afterward
Disclosure and Barring Service (DBS), formerly Criminal Records Bureau (CRB), checks and disclosures of criminal records forms
- Delete following the recruitment process unless assessed as relevant to ongoing employment. Delete once conviction is spent.
Immigration Checks
- 2 years after termination of employment/worker contract
Fingerprint data for secure access controls
- Delete when personnel no longer need secure access using this technology
IT system logs showing access by personnel
- 2 years after termination of employment/worker contract
Financial data
- 6 years after the end of the tax year in which the data used for any payment calculation.
CCTV footage
- 90 days from footage being captured, or longer if required in relation to the prevention or detection of crime or a legal claim.
Health and Safety
- Reportable accidents, death, or injury in connection with work
- 3 years from the date the report was made
- 3 years from the last date of entry
- Health and safety correspondence and training records
- 6 years after the termination of employment/worker
Corporate Records
- Articles of Incorporation, Bylaws, Corporate Seal
- Annual corporate filings and reports to government departments or regulators
- Board policies, resolutions, meeting minutes, and committee meeting minutes
- 7 years from expiration or termination
- Emails (business-related)
- 3 years from the last usage of the data, or in accordance with our third-party service provider’s own backup policy
Accounting and Finance
- 7 years from the end of the financial year
- Finance/Corporate Governance
- Finance/Corporate Governance
- Filings of fees paid to professionals
- Finance/Corporate Governance
- Employee/contractor pay histories
- Finance/Corporate Governance
- Finance/Corporate Governance
Legal and Insurance Records
- Finance/Corporate Governance
- Insurance claims/ applications
- Finance/Corporate Governance
- Insurance disbursements and denials
- Finance/Corporate Governance
- Insurance contracts and policies (Directors and Officers, General Liability, Property, Employers Liability, and Workers Compensation)
- Finance/Corporate Governance
- Finance/Corporate Governance
- Patents, patent applications, supporting documents
- Finance/Corporate Governance
- Real estate documents (including loan and mortgage contracts, deeds)
- Finance/Corporate Governance
- Trademark registrations, evidence of use documents
- Finance/Corporate Governance
- Finance/Corporate Governance
Data Protection
- Data protection notices and policies
- 6 years after the document is superseded or the end of the life of the organization
- Finance/Corporate Governance
- 6 years from the request being closed
- Finance/Corporate Governance
- Documents provided as a result of a subject access request
- 6 years from the request being closed
- Finance/Corporate Governance
- 6 years from the case being closed
- Finance/Corporate Governance
Customer/Prospective Customer Records
- Contact information of customers
- Duration of contract + 6 months or longer if there is an ongoing dispute with the customer.
- Data to be retained after termination of the customer’s contract on the basis that there may be issues that need to be resolved post-termination, such as recovering fees, dealing with complaints, etc. Data may be retained for longer if there is an ongoing dispute with the customer.
- Contact information of prospective customers
- 3 years is a reasonable sales cycle timeframe for ValleyDAO.
- Website usage/analysis data
- 2 years or the period specified by the relevant third-party cookie provider.
- For third-party cookies, data is retained in accordance with the cookie provider’s own data retention policy.
- Profile data on customers (including preferences, interests, feedback, and survey responses)
- 2 years or, if sooner, the end of the customer’s contract
- Profile data on prospective customers (including preferences, interests, feedback, and survey responses)
- 3 years from data being collected for marketing purposes (unless the individual consents to longer)
- 3 years is a reasonable sales cycle timeframe for ValleyDAO.
- Delete when someone has opted out of marketing communications
- Marketing preferences need to be stored indefinitely to ensure that ValleyDAO does not contact individuals who have asked to unsubscribe from marketing communications.
- Consents to marketing (where consent is used as lawful basis for processing for this purpose)
- 6 years after consent expires
- Marketing suppression lists
- To ensure legal compliance and to not break any laws in regards to contacting people who have opted out of communications. These can be updated by individuals at any time.
Transaction Data (Customers)
- Transaction data (showing purchases made by customers)
- Duration of contract + 6 years
- Necessary in case there is a legal claim relating to a transaction.
Third Party Supplier Records
- Business contact information of suppliers
- Duration of contract + 6 months or longer if there is an ongoing dispute with the supplier.
- Data to be retained after termination of the supplier’s contract on the basis that there may be issues that need to be resolved post-termination, such as paying fees, resolving complaints, etc. Data may be retained for longer if there is an ongoing dispute with the supplier.
- Transaction data (showing purchases made from suppliers)
- Duration of contract + 6 years
- Necessary in case there is a legal claim relating to a transaction.
Supplier Contracts
- Duration of contract + 6 years
- Necessary in case there is a legal claim relating to a supplier’s contract.
Financial Data
- Financial data (bank account details, payment card details)
- Delete as soon as possible after expiration/termination of the contract when final payments have been made
