Data Retention Policy

Last Updated: Jan 23, 2025

This Data Retention Policy ("Policy") outlines our approach to the retention, management, and disposal of data collected and processed by Arifalab Technologies Limited ("we," "us," or "our"). It is designed to ensure that we retain only the necessary data to effectively conduct our business activities while complying with applicable laws and regulations. This Policy provides guidelines for all employees, contractors, and third-party service providers regarding the handling of data throughout its lifecycle.


Scope

This policy applies to all data collected, processed, and stored by us across our owned or leased systems, whether in electronic or physical form. It includes, but is not limited to:

  1. Personal Data: Customer, employee, and vendor information
  2. Financial Records
  3. Operational Documents
  4. Communication Records: Emails, chat logs
  5. Media Files: Photographs, videos

The policy applies to all employees, contractors, and third-party service providers handling data on our behalf.


Reasons for Data Retention

We retain data for the following purposes:

  1. To provide ongoing services to individuals (e.g., newsletters, program updates)
  2. Compliance with legal obligations under labor, tax, and financial regulations
  3. Reporting obligations to donors or regulators
  4. Security incident investigations
  5. Preservation of intellectual property
  6. Litigation or dispute resolution


Retention Guidelines

The following table outlines the retention periods for various types of data:


Data TypeRetention Period
Website visitor dataRetained as long as necessary to provide services
Contributor/donor dataYear of contribution + 4 years
Event participant dataDuration of event + 2 years
Program participant dataDuration of grant agreement + 3 years
Employee recordsDuration of employment + 6 years
Recruitment data (unsuccessful)Closing of position recruitment + 1 year
Consultant/vendor recordsDuration of contract + 5 years
Board member recordsDuration of service + 5 years
Tax-related records7 years
Operational program documentsAs per donor requirements, not exceeding 7 years


Data Duplication

We seek to minimize duplication in data storage. However, duplicate copies may be retained temporarily for operational purposes. All copies are subject to this policy.

Data Destruction

When the retention period expires, we will securely destroy or delete the data using the following methods:

  1. Physical Records: Shredding or incineration.
  2. Electronic Records: Permanent deletion using secure deletion tools.

In cases where a legitimate business reason exists for retaining specific data beyond its retention period, approval must be obtained from the Data Protection Officer in consultation with legal counsel.


Roles and Responsibilities

  1. Data Protection Officer: Oversees compliance with this policy.
  2. IT Department: Ensures secure storage and deletion processes.
  3. Legal Counsel: Advises on retention periods and exceptions.
  4. Employees: Responsible for adhering to this policy in their roles.

Compliance and Review

This policy is designed to comply with applicable laws, including the Data Protection Act of 2019 of the Republic of Kenya and General Data Protection Regulation (GDPR). It will be reviewed annually or whenever there are significant changes in regulations or business needs.

Exceptions and Litigation Holds

In rare cases, a litigation hold may be issued by legal counsel prohibiting the destruction of specific records. Such holds remain in effect until officially released. By adhering to this policy, we ensure responsible management of our data lifecycle while maintaining compliance with legal and regulatory requirements.