Data retention policy
Data Retention
Hook shall retain data if the company has a need for its use, or to meet regulatory or contractual
requirements. Once data is no longer needed, it shall be securely disposed of or archived. Data
owners, in consultation with legal counsel, may determine retention periods for their data. Retention
periods shall be documented in the Data Retention Matrix in Appendix B to this policy.
Data archiving and removal policy
Data & Device Disposal
Data classified as restricted or confidential shall be securely deleted when no longer needed. Hook
shall assess the data and disposal practices of third-party vendors in accordance with the ThirdParty Management Policy. Only third parties who meet Hook requirements for secure data disposal
shall be used for store and process restricted or confidential data.
Hook shall ensure that all restricted and confidential data is securely deleted from company devices
prior to, or at the time of disposal.
Data storage policy
Data Handling
Confidential Data Handling
Confidential data is subject to the following protection and handling requirements:
Access is restricted to specific employees, roles and/or departments
Confidential systems shall not allow unauthenticated or anonymous access
Confidential Customer Data shall not be used or stored in non-production
systems/environments
Confidential data shall be encrypted in transit over public networks
Mobile device hard drives containing confidential data, including laptops, shall be encrypted
Mobile devices storing or accessing confidential data shall be protected by a log-on password
or passcode and shall be configured to lock the screen after five 5) minutes of non-use
Backups shall be encrypted
Confidential data shall not be stored on personal phones or devices or removable media
including USB drives, CD's, or DVD's
Paper records shall be labelled "confidential" and securely stored and disposed
Hard drives and mobile devices used to store confidential information must be securely wiped
prior to disposal or physically destroyed
Transfer of confidential data to people or entities outside the company shall only be done in
accordance with a legal contract or arrangement, and the explicit written permission of
management or the data owner
Restricted Data Handling
Restricted data is subject to the following protection and handling requirements:
Access is restricted to users with a need-to-know based on business requirements
2
Restricted systems shall not allow unauthenticated or anonymous access
Transfer of restricted data to people or entities outside the company or authorized users shall
require management approval and shall only be done in accordance with a legal contract or
arrangement, or the permission of the data owner
Paper records shall be securely stored and disposed
Hard drives and mobile devices used to store restricted information must be securely wiped
prior to disposal or physically destroyed
--- From the Data Protection Policy --
3.6 Storage Limitation
Personal data must not be kept in an identifiable form for any longer than is necessary for the stated
purposes for which the data is processed. Therefore, we must ensure that when personal data is no
longer needed, it is deleted or anonymised. We will require third parties to also delete or anonymise
data where and when applicable.3.6 Storage Limitation
Personal data must not be kept in an identifiable form for any longer than is necessary for the stated
purposes for which the data is processed. Therefore, we must ensure that when personal data is no
longer needed, it is deleted or anonymised. We will require third parties to also delete or anonymise
data where and when applicable.
Data center location(s)
Ireland
Data hosting details
AWS Cloud Hosted
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
no