Data Retention Policy

  1. The purpose of this policy

Fónua is firmly committed to complying with our data protection obligations. In this context, and to achieve consistency and excellence of service, we believe that it is important to have a policy setting out how we manage document retention.

The General Data Protection Regulation (the GDPR) impose obligations on us, as a Data Controller, to process personal data in a fair manner which notifies data subjects of the purposes of data processing and to retain the data for no longer than is necessary to achieve those purposes.

Under these rules, individuals have a right to be informed about how their personal data is processed. The GDPR sets out the information that we should supply to individuals and when individuals should be informed of this information. We are obliged to provide individuals with information on our retention periods or criteria used to determine the retention periods.

  1. Grounds for processing

Under the GDPR, Fónua are required to provide data subjects with the legal grounds or lawful basis that they are relying on for processing personal data.

The legal grounds for processing personal data are as follows:

  • Consent;
  • Performance of a contract;
  • Legal obligation;
  • Vital interest;
  • Public interest; or
  • Legitimate interests.

Explicit consent is required where special categories, also known as sensitive personal data are being processed.

Fónua may be able to rely a number of legal bases for collecting personal data. For example, as employers, Fónua can justify processing an employee’s personal data as necessary for the performance of a contract and as part of a statutory requirement.

If there is no justification for retaining personal information, then that information should be routinely deleted. Information should never be kept "just in case" a use can be found for it in the future. If we want to retain information about our customers or end users to help us to provide a better service to them in the future, we must obtain their consent in advance.

Further processing

Further retention of the personal data should be lawful only when it is compatible with the purposes for which it was originally collected. In this case no separate legal basis is required- it should be relied on where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

Right of erasure

Individuals have the right to have their personal data erased and no longer processed in the following circumstances:

where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed,

where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or

where the processing of his or her personal data does not otherwise comply with the GDPR.

This right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet.

The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child.

  1. Document Retention Procedure

We are required to retain certain records, usually for a specific amount of time. The accidental or intentional destruction of these records during their specified retention periods could result in the following consequences:

  • Fines and penalties.
  • Loss of rights.
  • Obstruction of justice charges.
  • Contempt of court charges.
  • Serious disadvantages in litigation.

We must retain certain records because they contain information that:

  • Have enduring business value (for example, they provide a record of a business transaction, evidence Fónua’s rights or obligations, protect our legal interests or ensure operational continuity.
  • Must be kept in order to satisfy legal, accounting or other regulatory requirements.

We must balance these requirements with our statutory obligation to only keep records for the period required and to comply with data minimisation principles. The retention schedule below sets out the relevant periods for the retention of Fónua’s documents.

  1. Types of Documents

This policy explains the differences among records, disposable information, personal data and confidential information belonging to others.

Records

A record is any type of information created, received or transmitted in the transaction of Fónua’s business, regardless of physical format. Examples of where the various types of information are located are:

  • Appointment books and calendars.
  • Audio and video recordings.
  • Photographs
  • Computer programs.
  • Contracts.
  • Electronic files.
  • E-mails.
  • Handwritten notes.
  • Invoices.
  • Letters and other correspondence.
  • Magnetic tape.
  • Memory in mobile phones and PDAs.
  • Online postings, such as on Facebook, Twitter and other social media networks.
  • Performance reviews.
  • Voicemails.

Therefore, any paper records and electronic files, that are part of any of the categories listed in the Records Retention Schedule contained in the Appendix to this policy, must be retained for the amount of time indicated in the Records Retention Schedule.

A record must not be retained beyond the period indicated in the Record Retention Schedule, unless a valid business reason (or a litigation hold or other special situation) calls for its continued retention. If you are unsure whether to retain a certain record, contact the Data Protection Officer.

You can contact our Data Protection Representative at Dataprotection@fonua.com

Disposable Information

Disposable information consists of data that may be discarded or deleted at the discretion of the user once it has served its temporary useful purpose and/or data that may be safely destroyed because it is not a record as defined by this policy. Examples may include:

  • Duplicates of originals that have not been annotated.
  • Preliminary drafts of letters, memoranda, reports, worksheets and informal notes that do not represent significant steps or decisions in the preparation of an official record.
  • Books, periodicals, manuals, training binders and other printed materials obtained from sources outside of Fónua and retained primarily for reference purposes.
  • Spam and junk mail.
Personal Data

    Personal Data is defined as any data which can identify an individual either on its own or when combined with other data which we possess. Some examples of personal data include Insert Names and addresses, email addresses, CVs, details of previous employment, medical records and references. We have specific obligations relating to personal data as set out in the GDPR.

    1. The role of the Data Protection Representative in Records Management

    Our Data Protection Representative, in conjunction with senior management, is responsible for identifying the documents that Fónua must or should retain, and determining, in collaboration with the Legal Department, the proper period of retention. The responsibilities of the Data Protection Officer include:

    • Arranging for the proper storage and retrieval of records, coordinating with outside vendors where appropriate.
    • Handling the destruction of records whose retention period has expired.
    • Planning, developing and prescribing document disposal policies, systems, standards and procedures.
    • Monitoring departmental compliance so that employees know how to follow the document management procedures and the Legal Department has confidence that Fónuas’ records are controlled.
    • Ensuring that senior management is aware of their departments' document management responsibilities.
    • Developing and implementing measures to ensure that the Legal Department knows what information Fónua has and where it is stored, that only authorised users have access to the information, and that Fónua  keeps only the information it needs, thereby efficiently using space.
    • Establishing standards for filing and storage equipment and recordkeeping supplies.
    • In cooperation with department heads, identifying essential records and establishing a disaster plan for each office and department to ensure maximum availability of Fónua’s records in order to re-establish operations quickly and with minimal interruption and expense.
    • Determining the practicality of and, if appropriate, establishing a uniform filing system and a forms design and control system.
    • In conjunction with the Legal Department, periodically reviewing the records retention schedules and legislation to determine if Fónua ’s document management program and its Records Retention Schedule is in compliance with legislation.
    • In conjunction with the Legal Department, informing the various department heads of any laws and administrative rules relating to corporate records.
    • In conjunction with the HR Department explaining to employees their duties relating to the document management program.
    • Ensuring that the maintenance, preservation, computer disk storage, destruction or other disposition of Fónua ’s records is carried out in accordance with this policy, the procedures of the document management program and our legal requirements.
    • Planning the timetable for the annual records destruction exercise and the annual records audit, including setting deadlines for responses from departmental staff.
    • Evaluating the overall effectiveness of the document management program.
    • Reporting annually to the Legal Department on the implementation of the document management program in each of Fónua ’s departments.
    1. How to Store and Destroy Records
    Storage

      Fónua’s records must be stored in a safe, secure and accessible manner. Any documents and financial files that are essential to our business operations during an emergency must be duplicated and/or backed up at least once per week and maintained off-site.

      Destruction

        Fónua’s IT team and Department Managers are responsible for the continuing process of identifying the records that have met their required retention period and supervising their destruction. The destruction of personal data, confidential, financial and personnel-related records must be conducted by shredding. The destruction of electronic records must be coordinated with the IT Department.

        The destruction of records must stop immediately upon notification from the Legal Department that a litigation hold is to begin because Fónua may be involved in a litigation or an official investigation. Destruction may begin again once the Legal Department lifts the relevant litigation hold.

        1. Questions About the Policy

        Any questions about this policy should be referred to the Fónua’s Data Protection Representative via email who is in charge of administering, enforcing and updating this policy.

        Appendix

        Record Retention Schedule

        In this policy Fónua establishes retention or destruction schedules or procedures for specific categories of records. This is done to ensure legal compliance and accomplish other objectives, such as protecting intellectual property and controlling costs. Employees should give special consideration to the categories of documents listed in the record retention schedule below. Avoid retaining a record if there is no business reason for doing so, and consult with the Data Protection Committee if unsure.

         

        Personnel Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Benefits descriptions per employee

        Permanent

        Irish employment law

        Legal obligation

        Employee applications and resumes

        6 years or where successful, for the duration of the employment plus 7 years from the date of termination of employment

        Section 11 of The Statute of Limitations Act 1957

        Legal obligation

        Employee benefit plans

        6 years from when the record was required to be disclosed

        Irish employment law

        Legal obligation

        Employee offer letters (and other documentation regarding hiring, promotion, demotion, transfer, termination or selection for training)

        6 years from date of making record or action involved, whichever is later, or 1 year from date of involuntary termination

        Irish employment law

        Legal obligation

        Records relating to background checks on employees

        6 years from when the background check is conducted

        Irish employment law

        Legal obligation

        Employment contracts; employment and termination agreements

        7 years from the date of expiry of the contract or agreement

        Organisation of working time act 1997 / Employment Permit Acts 2003-2014

        Legal obligation

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Employee records with information on pay rate or weekly compensation

        5 years

        Organisation of working time act 1997 / Employment Permit Acts 2003 -2014

        Legal Obligation

        Tax forms

        6 years after date of hire

        Irish employment law, Finance Act

        Legal obligation

        Injury and Illness Incident Reports and related Annual Summaries; Logs of work-related injuries and illnesses

        6 years following the end of the calendar year that these records cover

        Irish employment law

        Legal obligation

        Supplemental record for each occupational injury or illness; Log and Summary of Occupational Injuries and Illnesses

        6 years following the year to which they relate

        Irish employment law

        Legal obligation

        Job descriptions, performance goals and reviews; garnishment records

        For the duration of the employment plus 7 years from the date of termination of employment

        Organisation of working time act 1997

        Legal obligation

        Permit Info (for employees requiring visa permit to work with company)

        5 years

         

        Employment Permit Acts 2003 -2014

        Legal obligation

        Employee tax records

        7 years from the date tax is due or paid

        Tax Consolidation Act 1997

        Legal obligation

        Personnel or employment records

        6 years from the date the record was made

        Organisation of working time act 1997 / Employment Permit Acts 2003 -2014

        Legal obligation

        Pension plan and retirement records

        Permanent

        Pensions Act 2002

        Legal obligation

        Pre-employment tests and test results

        2 years from date of termination

        Irish employment law

        Legal obligation

        Salary schedules; ranges for each job description

        2 years

        Irish employment law

        Legal obligation

        Time reports

        Termination + 3 years

        Organisation of working time act 1997

        Legal obligation

        Training agreements, summaries of applicants' qualifications, job criteria, interview records

        Duration of training + 4 years

        Irish employment law,

        Health, Safety & Welfare Act 2005,

        Legal obligation

        Records of parental leave / force majeure / adoptive leave / carers leave

        7 years following the end of the calendar year that these records cover

        Irish employment law

        Legal obligation

        Records of Maternity leave

        1 years following the end of the calendar year that these records cove

        Maternity Protection Acts 1994 & 2004

        Legal obligation

        Settlement Agreements

        7 years

        Irish employment law

        Legal obligation

        CCTV images

        35 Days or for duration of incident investigation and/or 1 year after completion of litigation

        Service Provision

        Legitimate interests

         

         

         

         

        Payroll Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Payroll starter form / TMS Information

        3 years

        Organisation of working time act 1997 / Employment Permit Acts 2003 -2014

        Legal Obligation

        Payroll registers (gross and net)

        Permanent/5 years from the last date of entry

        Revenue / Employment Permit Acts 2003 -2014

        Legal Obligation

        Time cards; piece work tickets; wage rate tables; pay rates; work and time schedules; earnings records; records of additions to or deductions from wages; records on which wage computations are based

        2 years

        Irish employment law

        Legal obligation

        Biometrics;

        2 years

        Irish employment law

        Consent

         

        Corporate Customers Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Retail Portal Interaction:

        Including orders, repairs, returns & Trade-ins; Store employee details, IP address, Name, Email

        13 months

        Service Provision

        Legitimate interests

        Enterprise Orders

        Name, Address, Phone Number, IMEI, Email

        13 months

        Service Provision

        Contract

        Enterprise Returns

        Name, Address, Phone Number, IMEI, Email

        13 months

        Service Provision

        Contract

        Enterprise Repairs

        Name, Address, Phone Number, IMEI, Email

        27 months

        Service Provision

        Contract

        Enterprise Trade-in

        Name, Address, Phone Number, IMEI, Email

        13 months

        Service Provision

        Contract

        Online contact; name, email

        6 months

        Service Provision

        Legitimate interests

        Phone records

        13 months

        Service Provision

        Legitimate interests

         


         

         

        End Customers Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Direct Orders

        Name, Address, Phone Number, IMEI

        13 months

        Service Provision

        Contract

        Returns

        Name, Address, Phone Number, IMEI, Email

        13 months

        Service Provision

        Contract

        Repairs

        Name, Address, Phone Number, IMEI, Email

        27 months

        Service Provision

        Contract

        Online contact; name, email

        6 months

        Service Provision

        Legitimate interests

        Phone records

        13 months

        Service Provision

        Legitimate interests

         

        Corporate Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Articles of Incorporation, Bylaws, Corporate Seal

        Permanent

        Irish corporate law

        Legal obligation

        Annual corporate filings and reports to secretary of state and attorney general

        Permanent

        Irish corporate law

        Legal obligation

        Board policies, resolutions, meeting minutes and committee meeting minutes

        Permanent

        Irish corporate law

        Legal obligation

        Contracts

        Permanent if current (7 years if expired)

        Irish corporate law

        Legal Obligation

        Construction documents

        Permanent

        Irish corporate law

        Legal Obligation

        E-mails (business related)

        3 years

        Irish corporate law

        Legal Obligation

        Fixed Asset Records

        Permanent

        Irish tax legislation

        Legal Obligation

        All tax records

        Permanent

        Irish tax legislation

        Legal Obligation

        Sales and purchase records

        3 years

        Irish tax legislation

        Legal Obligation

        Resolutions

        Permanent

        Irish corporate law

        Legal Obligation

         

        Accounting and Finance

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Accounts Payable and Receivables ledgers and schedules

        7 years

        Irish tax legislation

        Legal Obligation

        Annual audit reports and financial statements

        Permanent

        Irish tax legislation

        Legal Obligation

        Annual plans and budgets

        2 years

        Irish tax legislation

        Legal Obligation

        Bank statements, cancelled checks, deposit slips

        7 years

        Irish tax legislation

        Legal Obligation

        Business expense records

        7 years

        Irish tax legislation

        Legal Obligation

        Cash receipts

        3 years

        Irish tax legislation

        Legal Obligation

        Details of cheques/stubs

        7 years

        Irish tax legislation

        Legal Obligation

        Electronic fund transfer documents

        7 years

        Irish tax legislation

        Legal Obligation

        Employee expense reports

        7 years

        Irish tax legislation

        Legal Obligation

        General ledgers

        Permanent

        Irish tax legislation

        Legal Obligation

        Journal entries

        7 years

        Irish tax legislation

        Legal Obligation

        Invoices

        7 years

        Irish tax legislation

        Legal Obligation

        Petty cash vouchers

        3 years

        Irish tax legislation

        Legal Obligation

         


         

         

        Tax Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        All tax records

        7 years

        Irish tax legislation

        Legal Obligation

         

         

        Legal and Insurance Records

        Record

        Retention Period

        Justification for time frame

        Legal basis for processing

        Appraisals

        6 years from termination

        Irish corporate law

        Legal Obligation

        Insurance claims/ applications

        Permanent

        Irish corporate law

        Legal Obligation

        Insurance disbursements and denials

        Permanent

        Irish corporate law

        Legal Obligation

        Insurance contracts and policies (Director and Officers, General Liability, Property, Workers' Compensation)

        Permanent

        Irish corporate law

        Legal Obligation

        Leases

        6 years after expiration

        Irish corporate law

        Legal Obligation

        Patents, patent applications, supporting documents

        Permanent

        Irish corporate law

        Legal Obligation

        Real estate documents (including loan and mortgage contract, deeds)

        Permanent

        Irish corporate law

        Legal Obligation

        Stock and bond records

        Permanent

        Irish corporate law

        Legal Obligation

        Trademark registrations, evidence of use documents

        Permanent

        Irish corporate law

        Legal Obligation

        Warranties

        Duration of warranty + 7 years

        Irish corporate law

        Contract