Data Retention Policy

Introduction

Smartflo platform seeks to ensure that it retails only data necessary to effectively conduct
its program activities and work in fulfilment of its mission.
This policy supports the high-level policy statements defined in information security policy.
Data retention policy refers to the rules of managing account data storage for optimal
system performance and reliability and backup the account data of the users of Smartflo
and its entities.

Purpose

Purpose of this document is to ensure necessary records, documents & information of the
company containing customer data are retained for no longer than necessary for the
purposes for which personal data are processed.
The need to retain data varies widely with the type of data and the purpose for which it
was collected. Smartflo strives to ensure that data is only retained for the period necessary
to fulfil the purpose for which it was collected and is fully deleted when no longer required.
This policy. sets forth Smartflo's guidelines on data retention and is to be consistently
applied thought the organisation.

Scope

This policy covers all data collected by Smartflo platform and stored on Smartflo platform
owned or leased systems and media, regardless of location. It applies to both data collected
and held electronically (including recordings, CDR and summary etc.). The need to retain
certain information may be mandated by federal or local law, federal regulations, and
legitimate business purposes, as well as the regulatory authority.
The scope of this document applies to all business functions of Smartflo platform and its
respective entities and shall be committed to comply with applicable legal, regulatory,
contractual, statutory and security requirements for protecting information assets within
the organisation.

Reasons for Data Retention

Smartflo platform retains only that data that is necessary to effectively conduct its program
activities, fulfil its mission and comply with applicable laws and regulations.
Reasons for data retention include:
• Providing an ongoing service to the data subject (e.g. CDR, Summary, user
transcripts, agent handoffs etc.)
• Regulatory requirements
• Security incidents or other investigations
• Litigations

Smartflo Platform Data Retention Policy

Smartflo platform enforces rules for managing account data storage for optimal system
performance and reliability. The Platform do not store any Personal Information (PI) and
Financial Information (FI) of the end users or Client.
Smartflo platform keeps the usage data in platform available for 12 calendar months.
Platform automatically archives data prior to the 12 calendar months and keeps it in cold
storage for 12 calendar months.

Archived Data

We will be archiving data in the list below. Any other data out of this list is not removed
and will be available on the platform for the prolonged time-period.
• User Transcripts
• Call logs
• All Analytics
• Campaigns
• Voice-bot users
• Live chat handoffs
• Ratings
• Use case histories
• Audit logs
• Action histories
• Bot setting histories
• Broadcast Executors
• Logs & CDR
• User profiles
• Conversation credit histories

Duration of availability

All the data that is mentioned in "Archived Data" section follows the availability mentioned
below.
IMPORTANT: If a user extension is deleted from the account, any call recordings with this
user will also be permanently deleted and cannot be recovered. We recommended
downloading and saving any recordings or logs you need to retain before deleting any
user from your account. If your account is terminated (Service Termination), then all call
logs and recordings will be deleted and cannot be recovered. We recommend
downloading and saving any recordings or logs you need to retain before proceeding with
service termination. CDR available in the Archived Section will be available in monthly
CSV files for download and no option to apply filters or create reports from older CDR will
begiven. All reports which depend on CDR will also be available for the same duration as
the CDR.

• Call Detail Record (CDR) & Messaging Detail Record (MDR) – CDR & MDR for 12
  months through portal and additional 1 year in archival will be available on
  request basis.
  • Day 1 to Day 90 - Available on UI with functionalities like quick download,
    filters can be applied, etc.
  • Day 91 to Day 365 - Available on UI but stored on simple storage in the
    form of batch files and can be downloaded easily by the user using the
    'Download Archive Report' option.
  • Days 366 to Days 730 – Available in archive database and can be provided
    to client based on request to Support Team. The archive data can be
    provided in max 5,000 records or 50GB file size (whichever is higher) per
    request and it will require min 5 working days to provide the logs.
• Summary Report – All reports which are derived from CDR such as Agent
  Performance Report, Number wise reports, etc, and doesn’t come under the
  definition of logs is termed as Summary Report.
  All Summary reports older than 6 months will not be available through the
  online portal.
  • Day 1 to Day 90 - Available on UI with functionalities like quick
    download, filters can be applied, etc.
  • Day 91 to Day 180 - Available on UI but stored on simple storage in
    the form of batch files and can be downloaded easily by the user
    using the 'Download Archive Report' option.
    Summary report can be scheduled on Daily, Weekly & Hourly basis to have
    a longer retention period and will be subjected to customer safe keeping.
• Logs – Logs are used to track the events that occur on the platform. Logs are
  broadly categorized as:
  • Activity Logs – Activity logs older than 3 months will not be available
    through the online portal.
  • General/Service specific Logs – Logs which are only used for
    troubleshooting purposes (eg. SMS Logs, Email Logs, API Logs, etc.) older
    than 14-days will not be available through online portal and backend.
  • Call Recordings – Call recordings will automatically be deleted after defined
    months (based on subscribed plan).

  Exception

  Any exception to the policy must be approved and recorded by the Information Security
  Manager in advance and reported to the Management Review Team.
  Any data that needs to be retained for more than the data retention policy should be
  procured from backend operations team and transferred to Client's own storage location.

  Data Duplication

  Smartflo platform seeks to avoid duplication in data storage whenever possible, though
  there may be instances in which for programmatic or other business reasons it is necessary
  for data to be held in more than one place. This policy applies to all the data in Smartflo
  platform possession including duplicate copies of data.

  Data Destruction

  Data destruction ensures that Smartflo Platform manages the data in controls and
  processes it in an efficient and responsible manner. When the retention period for the data
  as outlined above expires, Smartflo platform will actively destroy the data covered by this
  policy. If an individual believes that there exists a legitimate business reason why certain
  data should not be destroyed at the end of a retention period, he or she should identify
  this data to his/her supervisor and provide information as to why the data should not be
  destroyed. Any exceptions to this data retention policy must be approved by Smartflo
  platform data protection officer in consultation with legal counsel.
  In case of a disconnection of Services from any Customer, the Smartflo platform destructs
  the complete configuration and activity logs data of the disconnected account after 60-
  days from the decommissioning request in the Platform.
  In rare circumstances a litigation holds to be issued by legal counsel prohibiting the
  destruction of certain documents. A litigation hold remains in effect until released by legal
  counsel and prohibits the destruction of data subject to the hold.