PeopleHub Data Retention Policy

1. Purpose

This Data Retention Policy explains how long PeopleHub retains various types of personal and operational data, and the principles governing data deletion and retention.

The policy balances operational needs, legal requirements, and privacy expectations by retaining data only for as long as necessary.

2. General Retention Principles

PeopleHub retains data based on these principles:

• Operational Necessity: Data is retained for as long as required to support active platform functions
• Legal Compliance: Data is retained to meet legal and regulatory obligations
• Business Continuity: Historical records are retained to support reporting and analysis
• Audit Trail: System and access logs are retained to investigate security incidents and maintain accountability
• Proportionality: Retention periods are proportionate to the sensitivity and volume of data

3. Data Retention Schedule

Different types of data are retained for different periods:

4. Active User Data Retention

While a user account is active, PeopleHub retains:

• Profile Information: Name, email, job title, department, role, and contact details (retained for account management and communication)
• Attendance Records: All clock-in, clock-out, and status information (retained for reporting and payroll)
• Leave Records: All leave requests and leave balance information (retained for leave management)
• Bookings: All current and historical bookings (retained for facilities management)
• Recent Activity: Recent logs and activity records (retained for audit and security purposes)

5. User Deletion and Historical Data Retention

When a user account is deleted by an administrator:

• Account Access Removed: The user can no longer log into PeopleHub
• Personal Profile Deleted: Name, email, and contact information are permanently removed from the active system
• Historical Records Retained: Operational data (attendance, leave, bookings, audit logs) may be retained for the periods specified in the Data Retention Schedule

Retention of Deleted User Records:

• Historical records may retain an association with the deleted user (e.g., "Deleted User #12345") for reporting purposes
• Personal identifiable information (name, email, phone) is removed, but operational data remains tied to a user identifier
• This allows historical reporting while preventing re-identification through personal information

6. Early Data Deletion

Data may be deleted earlier than the scheduled retention period in the following circumstances:

• User Request: Users may request deletion of their personal data subject to legal and operational constraints
• Security Incident: Data may be deleted if compromised or involved in a security breach
• System Maintenance: Temporary or test data may be deleted during system maintenance
• Organisational Policy: Special circumstances or legal requirements may necessitate earlier deletion

7. Geolocation Data

PeopleHub may collect GPS coordinates when location tracking is enabled:

• Retention Period: 90 days (or as configured by your organisation)
• Purpose: Real-time location services, attendance verification, security (e.g., tracking lost devices)
• Automatic Deletion: Data older than the retention period is automatically deleted
• User Control: Users may disable location tracking in their settings to prevent collection

8. Backup and Archive Data

PeopleHub maintains backups for disaster recovery and business continuity:

• Backup Retention: Backups are retained for 30 days (or as configured)
• Archive Data: Archived historical data may be retained separately from active systems for long-term compliance
• Deletion from Backups: Deleted user data will be removed from new backups but may exist in historical backup archives until those archives are rotated
• Recovery: In the event of a security incident or system failure, backups may be restored, which could temporarily restore deleted data

9. Legal and Regulatory Holds

Notwithstanding this Data Retention Policy, PeopleHub may retain data longer than the scheduled periods if:

• Required by law (e.g., employment law, tax law, data protection law)
• Subject to litigation holds or legal disputes
• Required to investigate or defend against claims or allegations
• Required by regulatory authorities or government agencies

Users will be notified where possible if their data is subject to a legal hold that extends the normal retention period.

10. POPIA Compliance

This policy aligns with the Protection of Personal Information Act (POPIA) principles:

• Purpose Limitation: Data is retained only for purposes stated in this policy
• Retention Limitation: Data is retained for no longer than necessary
• Accuracy: Data accuracy is maintained throughout the retention period
• Security: Retention systems are secured against unauthorised access
• Transparency: Users are informed of retention practices through this policy

11. Data Subject Rights

Subject to applicable law, users may:

• Request Access: Request access to their retained personal data
• Correct Data: Request correction of inaccurate information
• Request Deletion: Request deletion of personal data (subject to legal and operational constraints)
• Object to Retention: Object to retention of data on specific grounds
• Data Portability: Request a copy of their data in portable format

Requests should be directed to PeopleHub administrators, HR, or your organisation's data protection contact.

12. Modification and Review

PeopleHub may adjust retention periods:

• To comply with changes in law or regulation
• To reflect changing operational needs
• To improve privacy practices
• To respond to emerging security risks

Significant changes will be communicated to users. Continued use of PeopleHub indicates acceptance of updated retention policies.

13. Contact and Questions

For questions about data retention, please contact:

• PeopleHub administrators
• Your HR department
• Your organisation's designated data protection contact