Legal

RETENTION AND DISPOSAL OF PERSONAL DATA POLICY – Global EdgeUno Inc

Policies and Guidelines

Object

EdgeUno has the responsibility to ensure compliance with the applicable country legislations of Personal Data protection and their requirements relating to the processing, collection, storage, retrieval, and destruction of records of personal data and/or sensitive data. This policy complements, and does not replace, EdgeUno’s Privacy Policy in force.

EdgeUno keeps sets of Personal Data stored in accordance with contractual, regulatory, and other legal data bases applicable to the modalities of processing of Personal Data. It is important that these Records are protected from loss, destruction, forgery, unauthorized access, and unauthorized release. For this, a variety of controls are used, such as backups, access control, and encryption.

TEMPORALITY OF RECORD RETENTION

All Personal Data will be retained for the necessary term to fulfill the objective for which they were collected, for lawful, specific, and informed purposes. The storage time of the Records shall comply with the prescribed period provided by law, when applicable, and the best industry practices if there is no specific requirement by the Regulatory Authority.

Record Type Description of the Data Retention Period Discard Format
People
Hiring Information, Employees		 Name, identification number, gender, date and place of birth, address, family data, bank details, salary. Up to 5 years after termination of the employment contract. Data is removed using industry best practices.
People
Information related to employee’s medical records required by law or for health insurance purposes and work safety information.		 Name, identification number, gender, date and place of birth, address, health data from the employee and/or family. Up to 20 years after termination of the employment contract. Data is removed using industry best practices.
People
Candidates for open job positions		 Name, identification number, date of birth, address, e-mail, gender, education information and previous occupations. Pre-interview disapproval: 30 days Post-interview disapproval: 1 year. Candidate Approval: up to 6 years after termination of the employment contract. Data is removed using industry best practices.
People
Payroll and Individual Employment Contract		 Name, identification number, address, bank account and details, salary and labor duties and taxes, job functions. Payroll: Up to 10 years after termination of the employment contract. Individual Employment Contract: Up to 10 years after termination of the employment contract. Data is removed using industry best practices.
People
Contractors and/or Remote Hands		 Name, identification number, gender, date and place of birth, address, bank account and details, salary. Up to 10 years after the end of the Consulting Agreement. Data is removed using industry best practices.
People
Leaves and Absenteeism information		 Name, identification number, gender, date of birth, health information. Up to 20 years after termination of the employment contract. Data is removed using industry best practices.
Marketing
Website Leads		 Email, location, IP Address, Company, Name. 2 years after the last activity or within 1 month after revocation of consent. Data is removed using industry best practices.
Marketing
Employees images		 Name, position, image (photos and videos) for campaigns and posts on social networks of the company. For the duration of the employment contract or up to 1 month after the withdrawal of consent. Data is removed using industry best practices.
Marketing
Event Leads		 Email, Location, Company, Name. For 2 years or up to 1 month after withdrawal of consent. Data is removed using industry best practices.
Legal Sales Procurement
Contracts of Customers, Suppliers and Partners		 Name, identification number, telephone number, IP address, address and e-mail of legal representatives and witnesses. For 10 years after the end of the Contract. Data is removed using industry best practices.
Legal
Bylaws		 Name, identification number, nationality, address, marital status, age, date of birth, place of birth of the legal representatives, shareholders, and directors of the Company. For the period of existence of the company and for the period required by law after this period. Data is removed using industry best practices.
Sales
Leads		 Name, title, identification number, phone, email. 2 years after initial contact without response or without closed sale. Up to 10 years after the end of the employment contract. For up to one month after withdrawal of consent. Data is removed using industry best practices.
PMO Network
Personal Data used for the regular execution of Providers and Customers’ Contract.		 Name, email and telephone number of representatives and technical contacts appointed by the Company’s Customers and/or Suppliers . For the duration of the Service Agreement. Data is removed using industry best practices.
Finance Payroll
Receipt, proof of salary payment and tax collection		 Payroll personal information: name, job title, identification number, tax identification number, address, and banking information. Up to 10 years after the end of the employment/consultan t contract. Data is removed using industry best practices.
Security
Access to physical facilities		 Biometric data Up to 1 month after the end of the employment/consultin g agreement. Data is removed using industry best practices.
Security
Video monitoring system		 Video monitoring images/or video. Up to 2 months from the collection of images/videos. Data is removed using industry best practices.
Security
Access to company systems		 Login, password, name, personal email, phone number. Up to 5 years after the end of the employment/consultan cy contract. Data is removed using industry best practices.

REFERENCES

The Personal Data Temporality Table described above is complemented by EdgeUno’s Policies, Standards, and Internal Procedures, as well as applicable law and should be interpreted according to the referred documents.

CONTACT

To exercise the rights set forth above, the holders of personal data may send their requests to the email address dpo@edgeuno.com with documents that allow to confirm their identity, or other written document that meets the requirements of the relevant legislation. After sending a request in writing, the necessary processes will be carried out to ensure that the request is finalized as soon as possible and within a maximum of thirty (30) days.

In order to ensure the security of the data, EdgeUno may request information to determine whether the applicant is the holder of the personal data subject to the request. EdgeUno may also ask questions about the request to ensure that the request is completed in accordance with the purpose of the data subject’s request. For all data processing purposes, EdgeUno has the figure of the Data Protection Officer to act as a communication channel between the company, data subjects and the Data Protection Authority.