Data Retention Policy

1. Purpose

This policy defines how long Atine Labs™ Limited retains different categories of personal and organisational data, and the secure deletion procedures applied at the end of each retention period.

2. Retention Periods

• Client SaaS data: retained for the duration of the service agreement plus 90 days after termination
• Employee/HR data (AtineHR™ clients): as required by applicable employment law in the relevant jurisdiction (typically 5–7 years)
• Financial and transaction records: 7 years (Uganda tax/company law requirements)
• Website usage logs: 12 months
• Marketing contact data: until consent is withdrawn or 2 years since last interaction, whichever is earlier
• Support tickets: 3 years from resolution
• Booking and appointment records: 24 months
• Security and audit logs: 24 months

3. Data Deletion Procedures

At the end of the applicable retention period, data is securely deleted using recognised secure erasure methods (NIST 800-88 guidelines). Deletion is logged and certificates of destruction are available to clients on request.

4. Legal Hold

Where data is subject to litigation hold, regulatory investigation, or other legal requirement, normal retention periods may be suspended. Legal holds are approved by senior management and tracked centrally.

5. Client Data Requests

Clients may request early deletion of their data subject to contractual terms and applicable legal obligations. Requests should be submitted to admin@alglobal.systems.