Karma Inc.

United States

Our company is committed to protecting the privacy of our customers and their data. To that end, we have developed a data retention policy to ensure that personal data is handled responsibly and in accordance with applicable laws. 1. We will only retain personal data for as long as necessary to fulfil the purpose for which it was collected or for legal or business purposes. 2. We will securely destroy or delete any personal data no longer required in accordance with applicable laws and regulations. 3. If a customer requests that their personal data be deleted, we will do so within a reasonable time frame. 4. We will ensure that any third-party service providers who process personal data on our behalf are subject to appropriate security measures and comply with this policy.

Data Archival/Removal Policy 1. All users must archive important data regularly. Data should be archived to a secure cloud storage platform or an external hard drive and stored in an accessible location. 2. All data no longer needed must be removed from the system as soon as possible unless it is required for legal or regulatory reasons to retain the data. 3. Data should be securely deleted when it is no longer needed by using encryption or a secure delete software program such as Eraser or File Shredder to ensure that the data can not be recovered once it is deleted. 4. Users must also ensure that any archived data is regularly updated and kept up-to-date to avoid any potential security risks caused by outdated versions of the data being stored on the system for extended periods of time.

Data Storage Policy: 1. All data must be securely stored in an encrypted format. 2. Access to data should be restricted to authorized personnel only. 3. Data backups should be performed regularly and stored in a secure offsite location. 4. Data should not be shared outside of the organization without written authorization from the appropriate parties. 5. All employees must adhere to security protocols when accessing sensitive data, including using unique passwords and multi-factor authentication procedures when necessary. 6. All access logs and activity related to data storage must be monitored and reported regularly as part of an overall security audit process.

United States

no

1. Verify the identity of the data subject: Confirm that the person requesting data deletion is indeed the person whose data is requested to be deleted. This can be done through validating proof of identification or other methods relevant to the organization. 2. Identify and gather personal data: Retrieve all relevant information pertaining to the individual and their personal data, including source documents, digital copies, etc. 3. Securely delete all records: Remove any stored copies of personal information from databases, cloud storage, backups, physical files and any other locations where it may exist. 4. Update privacy policy and consent forms: Ensure that any applicable consent forms or privacy policies have been updated to reflect that user’s data has been deleted as requested. 5. Notify third parties if applicable: If there are any third parties who had access to this individual’s personal information (such as service providers), notify them accordingly so they can also delete their associated records or take appropriate steps in accordance with GDPR regulations regarding erasure requests from users/data subjects. 6. Document process and results: Record details of this process for future reference, including timeframes for the completion of tasks involved in executing a successful deletion request by a user/data subject

no

no

yes

hi@timebot.chat

no

no

no

no