Purpose
This policy establishes the requirements for retaining, archiving, and securely disposing of data across Carriyo's systems and operations. It ensures that data is kept only for as long as necessary to fulfil its intended purpose, meet legal and regulatory obligations, and support business operations, and that data is disposed of securely when no longer required. This policy supports ISO 27001:2022 Annex A control A.8.10 (Information deletion).
Scope
This policy applies to all data processed, stored, or managed by Carriyo, regardless of format (digital or physical) or storage location (on-premises, cloud, third-party systems). It covers:
- Data stored in AWS and GCP cloud environments
- Data in SaaS applications and third-party services
- Data on employee devices and removable media
- Physical documents and records
- Backup and archival data
All Carriyo employees, contractors, and third-party service providers who handle Carriyo data are subject to this policy.
Data Classification and Retention Periods
Retention periods are determined by the data classification, data type, applicable legal requirements, and business need. The following table defines the minimum and maximum retention periods for common data types at Carriyo.
Retention Schedule
| Data Type | Classification | Retention Period | Legal / Regulatory Basis | Notes |
|---|---|---|---|---|
| Customer PII (names, addresses, phone numbers, emails) | Confidential | Duration of customer contract + 1 year, or as defined in the DPA | GDPR Art. 5(1)(e) | Deleted or anonymized after contract termination unless legal hold applies |
| Order and shipment data (order details, shipment records, tracking events) | Confidential | Duration of customer contract + 2 years | Contractual obligation, business need | Core platform data; retained for dispute resolution and analytics |
| Tracking event data (status updates, timestamps, location data) | Confidential | Duration of customer contract + 1 year | Business need | May be anonymized and retained longer for aggregate analytics |
| Carrier API credentials and integration keys | Restricted | Duration of active integration + immediate deletion upon decommission | Security best practice | Rotated per Access Control Policy; old credentials deleted immediately |
| Platform audit logs (authentication, authorization, admin actions) | Internal | 3 years | ISO 27001, GDPR Art. 5(2) accountability | Required for security investigations and compliance evidence |
| Infrastructure and application logs | Internal | 12 months online + 24 months archived | ISO 27001, operational need | Logs older than 12 months moved to cold storage |
| Vulnerability scan reports and penetration test results | Confidential | 3 years | ISO 27001 | Evidence for audit and trend analysis |
| Incident reports and investigation records | Confidential | 5 years | ISO 27001, legal | Retained for pattern analysis and regulatory inquiries |
| Employee personal data (HR records, employment contracts) | Confidential | Duration of employment + 7 years | UAE Labour Law, DIFC Employment Law | Consult legal counsel for jurisdiction-specific requirements |
| Employee access and training records | Internal | Duration of employment + 3 years | ISO 27001, GDPR accountability | Evidence for audit and compliance |
| Financial records (invoices, billing, payment records) | Confidential | 7 years | UAE Commercial Companies Law, VAT regulations | Consult finance team for specific requirements |
| Contracts and legal agreements (DPAs, NDAs, vendor contracts) | Confidential | Duration of agreement + 7 years | Contractual, legal | Includes data processing agreements |
| Marketing and public content | Public | Indefinite while relevant | N/A | Reviewed annually; outdated content archived or removed |
| ISMS documents (policies, procedures, records) | Internal | Active: indefinite; Retired: 3 years after retirement | ISO 27001, Document Control Procedure | Per CAR-ISMS-PRC-001 |
| Backup data | Matches source classification | Aligned with source data retention + 90 days maximum overhang | N/A | Backups containing expired data are purged during retention sweeps |
| Cookie and analytics data (website visitors) | Internal | 26 months maximum | GDPR, ePrivacy | Anonymized or deleted after retention period |
Data Processed on Behalf of Customers
Where Carriyo acts as a data processor, the retention period is governed by the customer's data processing agreement (DPA). If the DPA specifies a retention period, that period takes precedence over the defaults in this policy. Upon contract termination, customer data is deleted or returned in accordance with the DPA, typically within 30 days of the request.
Legal and Regulatory Requirements
Carriyo's retention periods are designed to comply with the following regulations. In the event of a conflict between regulatory requirements, the longer retention period applies.
GDPR (EU/EEA)
- Personal data must not be kept longer than necessary for its purpose (Art. 5(1)(e))
- Data subjects have the right to erasure (Art. 17), subject to legal exceptions
- Processing records must be maintained (Art. 30)
- Breach notification records must be retained as evidence of compliance (Art. 33-34)
UAE Commercial and Labour Law
- Financial records: minimum 5 years (UAE Commercial Companies Law)
- Employment records: retained for the duration of employment plus applicable statutory period
- VAT records: minimum 5 years from end of relevant tax period
DIFC Data Protection Law
- Applicable where Carriyo processes data under DIFC jurisdiction
- Similar principles to GDPR regarding purpose limitation and storage limitation
Other Jurisdictions
- Where a customer's data is subject to the data protection or retention law of another jurisdiction, the applicable local requirements are identified and incorporated into the retention schedule during customer onboarding.
Secure Disposal Methods
Digital Data Disposal
All digital data disposal must render data unrecoverable using methods appropriate to the storage medium and data classification.
| Storage Type | Disposal Method | Standard / Verification |
|---|---|---|
| Cloud storage (S3, GCS, Cloud SQL, RDS, DynamoDB) | Deletion through cloud provider APIs with verification; for Restricted data, confirm provider's deletion practices meet requirements | Verify through provider compliance documentation |
| Cloud-managed databases | Record deletion, database drop, or snapshot deletion through provider tools | Confirm deletion via audit logs |
| SaaS applications | Data deletion through application APIs or admin interfaces; request confirmation from provider | Vendor confirmation or audit log |
| Encrypted storage (any medium) | Crypto-shredding — destruction of all copies of the encryption key renders data unrecoverable | Documented key destruction record |
| Employee laptops and devices | Secure wipe using approved tools (minimum NIST 800-88 Clear for standard, Purge for Confidential/Restricted) | Wipe verification certificate |
| Virtual machines and containers | Instance termination with underlying storage deletion; encrypted volumes use crypto-shredding | Cloud provider audit log verification |
| Removable media (USB, external drives) | Degaussing or physical destruction for magnetic media; secure erase or physical destruction for solid-state media | Destruction certificate |
| Email and messaging data | Deletion from all systems including backup and archive; apply retention policies in email platform | Retention policy configuration verification |
Physical Data Disposal
| Medium | Disposal Method | Standard |
|---|---|---|
| Paper documents (Internal, Public) | Cross-cut shredding (minimum DIN 66399 P-3) | Visual verification |
| Paper documents (Confidential, Restricted) | Cross-cut shredding (minimum DIN 66399 P-4) or outsourced confidential destruction | Destruction certificate from provider |
| Physical storage media (HDDs, tapes) | Degaussing followed by physical destruction, or outsourced certified destruction | Destruction certificate |
| Physical storage media (SSDs, flash) | Crypto-shredding or physical destruction | Destruction certificate |
Disposal Verification and Record-Keeping
Verification Requirements
- All disposal of Confidential and Restricted data must be verified and documented
- For cloud-based disposal, audit logs confirming deletion are retained as verification evidence
- For physical media destruction, certificates of destruction are obtained from the destruction service provider or internal personnel performing the disposal
- Disposal verification records are retained for 3 years after disposal
Disposal Register
A disposal register is maintained to record all data disposal activities. Each entry includes:
- Date of disposal
- Description of data disposed (data type, volume, system of origin)
- Data classification
- Disposal method used
- Person or team responsible for disposal
- Verification evidence (log reference, certificate reference, or confirmation)
- Authorizing approver (for Confidential and Restricted data)
The disposal register is maintained by the Information Security Specialist and is available for internal and external audit review.
Exceptions and Legal Hold
Legal Hold
A legal hold suspends the normal retention and disposal schedule for specified data when there is a reasonable expectation of litigation, regulatory investigation, or audit. During a legal hold:
- All normal disposal activities for the affected data are suspended immediately
- The scope of the hold (data types, systems, date ranges, individuals) is documented
- All personnel who manage the affected data are notified of the hold
- Data subject to a legal hold is preserved in its current state; no modification or deletion is permitted
- The legal hold remains in effect until formally released by the person who initiated it or by legal counsel
Legal Hold Procedures
- Initiation — Legal holds are initiated by Carriyo management or legal counsel. The request specifies the scope, reason, and expected duration.
- Notification — The Information Security Specialist notifies all relevant data custodians and system administrators.
- Implementation — Technical controls are applied where possible to prevent accidental deletion (e.g., object lock, retention policies on storage, backup exclusion from purge jobs).
- Monitoring — Compliance with the hold is monitored throughout its duration.
- Release — When the hold is released, normal retention schedules resume. Data that has exceeded its retention period during the hold is disposed of through the standard process.
Other Exceptions
Exceptions to the standard retention schedule may be granted for:
- Contractual obligations that require longer retention (documented in the customer DPA or vendor agreement)
- Regulatory requirements specific to a jurisdiction not covered in this policy
- Ongoing security investigations that require log or record preservation beyond standard retention
All exceptions must be approved by the Information Security Specialist and documented in the disposal register with the justification and expected duration.
Responsibilities
| Role | Responsibilities |
|---|---|
| Information Security Specialist | Maintains this policy and the retention schedule; manages the disposal register; oversees disposal verification; processes legal holds; monitors compliance with retention periods |
| Engineering / DevOps Team | Implements technical retention controls (lifecycle policies, automated deletion jobs, backup rotation); executes disposal of cloud-based data; provides audit log evidence |
| IT Administrator | Manages disposal of employee devices and removable media; executes access deprovisioning-related data cleanup |
| CISO (people matters) | Manages retention and disposal of employee personal data in accordance with this policy and applicable labour law |
| Finance | Manages retention of financial records in accordance with tax and commercial law |
| Management (CISO) | Approves this policy; authorizes legal holds; ensures adequate resources for compliance |
| All Employees | Comply with this policy; do not retain data beyond its defined retention period on local devices or personal storage; report any concerns regarding data retention to the Information Security Specialist |
Automated Retention Controls
Where technically feasible, automated mechanisms are used to enforce retention periods:
- Cloud storage lifecycle policies — S3 lifecycle rules and GCS lifecycle management automatically transition data to cold storage and delete data after the defined retention period
- Database retention jobs — Scheduled jobs purge expired records from production databases
- Log rotation and archival — Centralized logging platforms automatically archive and delete logs per the retention schedule
- Backup rotation — Backup retention policies automatically expire old backups
- Email retention policies — Organizational email retention rules enforce maximum retention periods
Automated controls are reviewed quarterly to confirm correct configuration and operation.
Review of Retention Schedules
The retention schedule in this policy is reviewed:
- Annually as part of the ISMS review cycle
- When new data types are introduced into Carriyo's systems
- When new legal or regulatory requirements are identified
- When customer DPAs introduce retention requirements that differ from the standard schedule
- Following any incident involving improper data retention or disposal
Updates to the retention schedule follow the standard document control procedure (CAR-ISMS-PRC-001).
Compliance
This policy supports Carriyo's compliance with:
- ISO 27001:2022 A.8.10 — Information deletion
- GDPR Article 5(1)(e) — Storage limitation
- GDPR Article 17 — Right to erasure
- Carriyo Data Protection Policy (CAR-ISMS-POL-008)
- Carriyo Document Control Procedure (CAR-ISMS-PRC-001)
Authoritative Operational Schedule
The detailed, authoritative data retention schedule and the operational disposal procedures that implement this policy are maintained in the internal Data Retention Schedule and Disposal Procedures record. Where this governing policy states a retention principle or default, the specific per-data-category retention periods, automated deletion controls, legal-hold handling, and evidence-of-disposal records are defined and kept current in the internal retention schedule record. In the event of any discrepancy, the internal retention schedule record is the operational source of record for retention periods and disposal methods, and is itself governed by this policy.
Enforcement
Violations of this policy may result in disciplinary action, up to and including termination of employment or contract. Failure to dispose of data within the defined retention periods, or improper disposal that does not meet the secure disposal requirements, is treated as a policy violation and may constitute a non-conformity during internal or external audits.