Data Management & Privacy

Data governance

• Our Data Management Policy governs how data is classified, handled and protected.

• We maintain an asset inventory that tracks which resources contain user data, with active owners assigned to every item.

• We maintain records of processing activities (ROPA) and conduct data protection impact assessments (DPIAs).

Retention & deletion

• Security and server logs are retained for at least 12 months.

• Assets are returned and decommissioned under a documented process when no longer needed, with certificates of destruction obtained for destroyed media.

• We operate documented processes for the removal of personal data (PII).

Terms

Request the Data Management Policy under NDA