MakeScanned seeks to ensure that it retains only data necessary to effectively conduct its program activities and work in fulfilment of its mission. The need to retain data varies widely with the type of data and the purpose for which it was collected. MakeScanned strives to ensure that data is only retained for the period necessary to fulfil the purpose for which it was collected and is fully deleted when no longer required. This policy sets forth MakeScanned’s guidelines on data retention and is to be consistently applied throughout the organization.

Scope
This policy covers all data collected and stored by MakeScanned, owned or leased systems and media, regardless of location. It applies to both data collected and held electronically (including photographs, video and audio recordings) and data that is collected and held as hard copy or paper files. The need to retain certain information may be mandated by federal or local law, federal regulations and legitimate business purposes.

Reasons for Data Retention
MakeScanned retains only that data that is necessary to effectively conduct its program activities, fulfill its mission and comply with applicable laws and regulations. Reasons for data retention include:

• Providing an ongoing service to the data subject
• Compliance with applicable laws and regulations associated with financial and programmatic reporting by MakeScanned to its funding agencies and other donors
• Compliance with applicable labor, tax and immigration laws
• Other regulatory requirements
• Security incident or other investigation
• Intellectual property preservation
• Litigation

Retention Requirements
MakeScanned has set the following guidelines for retaining all personal data as defined in the Institute’s data privacy policy.

• Website visitor data will be retained as long as necessary to provide the service requested/initiated through the MakeScanned website.
• Contributor data will be retained for the year in which the individual has contributed and then for 30 days after the date of the last contribution. Financial information will not be retained longer than is necessary to process a single transaction.
• Event participant data will be retained for the period of the event, including any follow up activities, such as the distribution of reports, plus a period of 30 days;
• Program participant data will be retained for the duration of the grant agreement that financed the program plus any additional time required under the terms of the grant agreement.
• Personal data of subgrantees, subcontractors and vendors will be kept for the duration of the contract or agreement.
• Operational data related to program proposals, reporting and program management will be held for the period required by the MakeScanned donor, but not more than 1 year.

Data Destruction
Data destruction ensures that MakeScanned manages the data it controls and processes it in an efficient and responsible manner. When the retention period for the data as outlined above expires, MakeScanned will actively destroy the data covered by this policy. If an individual believes that there exists a legitimate business reason why certain data should not be destroyed at the end of a retention period, he or she should identify this data to his/her supervisor and provide information as to why the data should not be destroyed. Any exceptions to this data retention policy must be approved by MakeScanned’s data protection offer in consultation with legal counsel. In rare circumstances, a litigation hold may be issued by legal counsel prohibiting the destruction of certain documents. A litigation hold remains in effect until released by legal counsel and prohibits the destruction of data subject to the hold. Individual requests for deletion of data before the standard deadline can be sent to info@makescanned.com. Such requests will be reviewed and processed within 30 days.



Last updated: 2/3/22