Data Retention and Destruction

Purpose and Scope

Data retention - Zoho CRM

This policy defines Evercam’s data retention and destruction practices to safeguard our network and digital assets. (Additional data management policies are handled separately). The scope of this policy covers all information technology systems, software, databases, applications and network resources needed by Evercam to conduct its business. The policy is applicable to all Company employees, contractors and authorised third-party organisations.

Statement of Compliance

This policy is designed to comply with applicable local, national, and international data protection and privacy regulations (e.g., the General Data Protection Regulation (GDPR) and relevant regional privacy acts).

The Engineering department manages compliance with this policy, supported by the Compliance team and leadership. They ensure the right procedures, staff, and technology are in place. To confirm adherence, Engineering team and internal audit team verifies compliance, particularly regarding data destruction, on a regular basis. 

Policy

The company will maintain comprehensive data retention and destruction plans in accordance with established industry best practices. Responsibilities are divided as follows:

  • Engineering & Compliance: Engineering manages all data retention and destruction activities, with support from Compliance. Together, they develop, execute, and periodically test data procedures to ensure alignment with industry standards.

  • Other Departments (Finance, HR, Operations, etc.): Define and communicate their specific data retention and destruction requirements to the Engineering and Compliance teams.

Data retention and destruction activities shall be performed as part of the company's data management program, they include:

  • Planning and designing data retention and destruction activities;

  • Identifying data retention and destruction teams, defining their roles and responsibilities and ensuring they are properly trained and prepared to perform their duties;

  • Planning, designing and documenting data retention and destruction plans;

  • Scheduling updates to data retention and destruction risk analyses;

  • Planning and delivering awareness and training activities for employees and data retention and destruction team members;

  • Planning and executing data retention and destruction plan exercises;

  • Designing and implementing data retention and destruction maintenance activities to ensure that plans are up to date and ready for use;

  • Preparing for management review and auditing of data retention and destruction plan(s); and

  • Planning and implementing continuous improvement activities for data retention, destruction activities and plans. 

Formal Risk Assessments (RAs) and Business Impact Assessments (BIAs) shall include requirements for data retention and destruction activities; RAs and BIAs shall be updated annually to ensure they are in alignment with the business and technology requirements.

Data retention and destruction plans shall address:

  • Electronic data stored on electronic media such as hard disk drives, solid state disk drives, magnetic tape and other appropriate media where applicable.

  • Electronic information systems (e.g., servers, routers, switches) and components (e.g., cabling and connectors, power supplies, storage racks) and other assets that are currently out of production or scheduled to be phased out of production environments.

  • The storage requirements and associated metrics (e.g., length of storage, type of storage media) for electronic information as well as systems supporting the IT infrastructure.

  • The parameters for destruction of electronic data (e.g., overwriting, reformatting, degaussing, firmware-based erasure, physical data media destruction), non-electronic data (e.g., shredding of hard copy), and systems and components (e.g., third-party destruction services).

  • Periodically reviewed and tested plans in a suitable environment to ensure that data, databases, media, systems and other relevant elements can be retained or destroyed and that Evercam’s management and employees understand how the plans are to be executed as well as their roles and responsibilities.

All employees must be made aware of the data retention and destruction program and their own roles and responsibilities.

Exception:

Data that would otherwise be eligible for destruction under the standard retention schedule may be exempted from destruction where any of the following apply:

Any data placed under an exemption must be:

  1. Documented in the exemption/legal hold register, stating the reason, scope of data, and responsible owner;

  2. Reviewed periodically to determine whether the exemption still applies;

  3. Returned to the standard retention and destruction schedule once the exemption no longer applies, unless a new exemption reason is identified.

Data Storage

The cloud recordings are stored on dedicated cloud service providers, primarily on Hetzner servers located in Germany and AWS servers located in Ireland. In addition, physical hard drives are placed at the project site and connected to the cameras for local storage in addition to SD cards located inside the hardware box.

The physical hard drives are sized according to project duration. If storage fills up, the customer can either replace the HDD (paid option with data retention) or allow the system to overwrite old footage (default, free option). Evercam notifies customers 60 days before capacity is reached, offering clear steps for action. For more information please refer to the Storage Device Sizing & Retrieval document.

Regular audits are conducted to ensure the integrity and security of the data storage practices. These routine checks enable Evercam to identify and address any potential issues or concerns promptly, ensuring the safety and confidentiality of customer's data.


Evercam Data at Rest Diagram

Evercam Data at Rest Diagram


Data Retention and Destruction Specifications

Retention Periods

Evercam typically stores a copy of Customer data for 90 days after a project has been completed, unless the Customer's requests to delete the footage earlier. After this period, data storage can be extended at the Customer’s expense, with several storage options available. The data is stored both on cloud-based servers and physical hard drives for redundancy and backup purposes.

See also Project Archiving

Digital Data Retention

Cloud recordings are securely stored for the agreed retention period using dedicated cloud service providers. Evercam conducts regular audits to verify data integrity and security, allowing to promptly address any potential issues and ensure the ongoing confidentiality of Customer data.

Once the agreed retention period has been reached, the Customer can choose from one of the following options:

Extend: Data will continue to be stored by Evercam. The nature of the storage and associated costs are agreed at the time of extension.

Transfer: Data will be transferred to the Customer. The manner in how the data is transferred and associated costs are agreed the time of transfer.

Delete: The Customer confirms that they wish for all data to be deleted and Evercam will provide a formal Data Deletion Certificate.

Evercam reserves the right to delete data after the agreed data retention period has expired.

Optional Physical Data Retrieval (Hard Drive) 

Upon request, Evercam can assist with the physical removal and return of hard drives. Evercam will consult with the nominated site contact to coordinate the best logistical approach. This may involve using a trusted courier, an Evercam-nominated third party, or collaborating directly with the Customer’s team to ensure the drives are safely shipped to the agreed location.

Responsibility for, and costs of, camera decommissioning and hardware retrieval will be agreed on a per project basis due the logistical variations. 

Data Recovery, Fire and Theft

Cloud Recordings are stored in ISO27001 certified data centres with their own internal Security and Disaster Recovery protocols. If required, Evercam can use the Local Recordings stored on the physical hard drive to repopulate the Cloud recordings that are accessible to Customers on the Evercam platform.

Retention and Destruction Requests

To initiate the process of data deletion, Customers can send a request to Evercam support team at support@evercam.io. Evercam team will verify the request with the nominated Customer contact and take the necessary steps to securely delete the data from servers and physical media. A Certificate of Deletion or Retention can be provided upon request.

Data Destruction Procedures

Once the data retention period has expired, or if a Customer requests deletion of their data, Evercam ensures complete and secure removal of the data. This involves deleting the data from the servers and wiping the hard drives of any physical media to prevent any unauthorised access or recovery of the data. Evercam takes every precaution to ensure that the data is completely and irreversibly erased, in accordance with industry best practices and data privacy regulations. 

Data can be sent to the customer on request (physical HDD or uploaded). Charges will apply and will be quoted at time of Customer’s request.
—————————————————————

Created by: Compliance Manager (ISMS team)

Creation date: 17.02.2023

Last modification date: 11.09.2026

Document approver: Head of Compliance