Data Retention Policy
1. Purpose and Statutory Alignment
This Data Retention Policy defines clear retention schedules and disposal protocols for personal data processed within Vinti Web Solution HRMS. Our schedules balance the principle of data minimization under Section 8(7) of the Digital Personal Data Protection Act, 2023 with statutory recordkeeping obligations under Indian labor, corporate, and taxation statutes.
2. Retention Principle: Section 8(7) DPDPA 2023
Under the DPDPA 2023, personal data must be erased as soon as the specified purpose for collection has been fulfilled or consent has been withdrawn, unless retention is necessary for compliance with applicable laws or the establishment, exercise, or defense of legal claims.
3. Configurable Retention Schedules
| Data Category | Retention Period | Statutory Basis / Legal Citation | Action on Expiry |
|---|---|---|---|
| Employee Master & Personnel Files | 8 Years post-exit | Companies Act 2013, Section 128 & Income Tax Act 1961 | Secure Cold Archive |
| Payroll, Payslips & Tax Deductions | 8 Years (96 Months) | Income Tax Act 1961 Section 44AA, EPF & MP Act 1952 | Secure Financial Archive |
| Attendance & Punch Coordinates | 3 Years (36 Months) | Payment of Wages Act 1936, State Shops & Establishments Acts | Purge / Anonymize |
| Leave Applications & Ledgers | 3 Years (36 Months) | State Factories & Commercial Establishments Leave Rules | Purge / Anonymize |
| Candidate Resumes (Non-Hired) | 1 Year (12 Months) | DPDPA 2023 Purpose Fulfillment (Recruitment Cycle) | Permanent Deletion / Anonymization |
| Internal Chat & Attachments | 2 Years (24 Months) | Corporate Internal Governance & Communications Policy | Archive / Purge |
| Login & Security Audit Trails | 1 Year (12 Months) | CERT-In Cybersecurity Directions (Section 70B IT Act 2000) | Automated Purge |
| Cookie & Privacy Consent Logs | 5 Years (60 Months) | DPDPA 2023 Section 6(7) (Evidentiary Proof of Consent) | Secure Legal Archive |
4. Disposal and Destruction Methods
When data reaches its retention threshold and is approved for deletion:
- Database Records: Permanently deleted via database purging or irreversibly anonymized so individuals cannot be identified.
- File Storage & Documents: Associated PDF resumes, identification scans, and chat attachments are unlinked and permanently deleted from secure object storage disks.
- Backup Sanitization: Secondary rolling system backups overwrite expired data in accordance with automated backup rotation cycles.
5. Legal Hold Exception
In the event of an active labor dispute, regulatory investigation, or legal proceeding, applicable retention rules are temporarily suspended ("Legal Hold") until formal clearance from authorized legal counsel.
Regulatory & Legal Notice
This policy outlines operational processing across Vinti Web Solution HRMS in alignment with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. For organization-specific contractual terms or inquiries, reach out to our designated Grievance Officer at support@vintiwebsolution.in.