Purpose
The purpose of this policy is to ensure that Karix retains only data necessary to effectively conduct its business activities and comply with applicable laws and regulations. It clearly outlines what data should be stored or archived based on classification, where this data should be stored and for how long it should be stored. Once a data set completes its retention period, it should be deleted. This policy sets forth Karix’s guidelines on data retention and is to be applied throughout the organization.
Policy
Karix requires that all data be stored according to the following policy.
•
Classify all data - classify the data to determine which data needs to be archived and for how long
•
Understand the legal aspect
•
Understand contractual needs
•
Know the core Business processes to determine what data must be kept and for how long
•
All data must be stored in accordance with guidelines provided for its class.
•
Personal data localization - All data should be stored in data centers within India.
•
None of production data can de deleted before 2 years as TRAI Guidelines.
•
Data storage must be audited every 3 months to ensure compliance with policy.
•
Delete all data post retention. All logs for Data Purge must be recorded and maintained for a period of 3 Years.
•
Avoid data duplication, though there may be instances in which for programmatic or other business reasons it is necessary for data to be held in more than one place. Duplicate data can be stored strictly due to business and technical reasons.
Data Purging
Data Purging ensures that Karix manages the data it controls and processes it in an efficient and responsible manner. Production Transaction Data will be retained until 36 months and 37th-month data will be deleted at the beginning of each month. When the retention period for the data as outlined above expires, Karix will actively destroy the data covered by this policy. If an individual believes that there exists a legitimate business reason why certain data should not be destroyed at the end of a retention period, he or she should identify this data to his/her supervisor and provide information as to why the data should not be destroyed. Any exceptions to this data retention policy must be approved by Karix’s data protection officer in consultation with legal counsel.