Last updated December 1, 2025
Purpose
It is the policy of AxioSight (“AxioSight”) to ensure that it retains only the data necessary to responsibly conduct and support its business activities, and that all data not preserved, is disposed of in an appropriate manner. This Policy sets forth the guidelines on data retention and destruction, and is to be consistently applied throughout the organization.
Scope
This Policy covers all data collected by, or created by, AxioSight and stored on AxioSight-owned or leased systems and media, regardless of location. It applies to both data held electronically and data that is collected and held as paper files.
This Policy applies to all business units, processes, and systems in all countries in which AxioSight conducts business and has dealings or other business relationships with third parties.
This Policy applies to all AxioSight officers, directors, employees, agents, affiliates, contractors, consultants, advisors or service providers that may collect, process, or have access to AxioSight data (including, but not limited to, personal data and/or sensitive personal data). It is the responsibility of all of the above to familiarize themselves with this Policy and ensure adequate compliance with it.
Administration
The Data Protection Officer (“DPO”) is the officer in charge of the administration of this Policy and the implementation of processes and procedures to ensure that the Policy is followed, including the maintenance of the Data Retention Schedule below. The DPO is authorized to make modifications to the Policy from time to time to ensure that it is in compliance with all applicable local, state, and federal laws.
To ensure this, the DPO will monitor local, state and federal laws affecting record and data retention and destruction, and annually review this Policy for compliance.
The DPO can be reached at dpo@eventaware.ai.
User Requests
AxioSight respects and recognizes the right of users to control their own personal data as a user of AxioSight’s products and services.
Users may request account deletion at any time by navigating to their account settings, if available, or by contacting our team at info@eventaware.ai. Upon verification, and subject the restrictions as outlined in this Policy, we will process the deletion request within 30 days. When the request has been processed, all personal data associated with the account that made the request will be permanently removed, except where retention is required by other sections of this Policy.
Some anonymized data may be retained for analytics and service improvement. If you have used third-party integrations, you may need to request data deletion from those services separately.
Exceptions
The need to retain or destroy certain data may be mandated by federal or local law, applicable regulations, and other legitimate business purposes, as well as the EU General Data Protection Regulation (“GDPR”). In all cases, those legal obligations will supersede the relevant portions of this Policy.
In the event AxioSight is served with any subpoena or request for information, or any employee becomes aware of a governmental investigation or audit concerning AxioSight, or the commencement of any litigation against, or concerning AxioSight, such employee shall inform the DPO and any further disposal or destruction of data shall be suspended until such time as the DPO, with the advice of counsel, determines otherwise. No data shall be concealed, altered, or destroyed with the intent to obstruct the investigation or litigation. The DPO shall immediately inform the CEO and Board Chair, and take such steps as necessary to promptly inform all staff of any suspension or modification to this Policy as may be required.
Enforcement and Compliance
Any suspicion of a breach of this Policy must be reported immediately to the DPO. All instances of suspected breaches of the Policy shall be investigated and action taken as appropriate.
Non-compliance with this Policy by permanent, temporary, or contract employees, or any third parties, who have been granted access to AxioSight premises or data, may therefore result in disciplinary proceedings or termination of their employment or contract. Such non-compliance may also lead to legal action against the parties involved in such activities.
Retention Rules
In the event, for any category of data not specifically defined elsewhere in this Policy (and in particular within the Data Retention Schedule) and unless otherwise mandated differently by applicable law, the required retention period for such data will be deemed to be 7 years from the date of creation of the document.
Reasons for Retention
In the ordinary course of business activities, AxioSight creates, collects, and stores data, which may be retained for a variety of reasons, including, but not limited to providing an ongoing service (e.g., ongoing training or support, processing of employee benefits); support the company’s operations; compliance with applicable laws and regulations associated with financial reporting by AxioSight; compliance with applicable labor, tax, and immigration laws, or other regulatory requirements; a security incident or other investigation; intellectual property preservation, or; litigation.
Data Safeguards
Appropriate controls shall be in place that prevent the permanent loss of essential information to AxioSight as a result of malicious or unintentional destruction of information. All electronic data should be protected by access controls, firewalls, and other security settings to ensure only personnel with the appropriate level of authorization may view, edit, copy, or otherwise interact with the data.
The possibility that data media used for archiving or backups will wear out, shall be considered for the purpose of meeting the requirements of this Policy. If electronic storage media are chosen, any procedures and systems ensuring that the information can be accessed during the retention period (both with respect to the information carrier and the readability of formats) shall also be stored in order to safeguard the information against loss as a result of future technological changes.
Physical documents and media will be stored in a protected condition, with reasonable provisions made to limit exposure to environmental factors that may lead to degradation or accidental destruction, for the duration of the Document Retention Schedule.
Destruction Rules
AxioSight and its employees shall review all data on a regular basis, to identify when the retention period for given data expires, or to determine whether to destroy any other data once the purpose for it is no longer relevant. If an individual believes that there exists a legitimate business reason why certain data should not be destroyed at the end of the given retention period, they should identify this data to their supervisor and provide information as to why the data should not be destroyed. Any exceptions must be approved by the DPO, who has overall responsibility for the data destruction.
Once the decision is taken to dispose of data according to the Data Retention Schedule, that data should be deleted, shredded, or otherwise destroyed to a degree equivalent to the value to others and the level of confidentiality. The method of disposal varies and is dependent upon the nature of the data. For example, any data that contain sensitive or confidential information (and particularly sensitive personal data) must be disposed of as confidential waste, and be subject to secure electronic deletion, while some expired or superseded contracts may only warrant in-house shredding.
In this context, the employee shall perform the tasks and assume the responsibilities relevant for the information destruction in an appropriate way. The specific deletion or destruction process may be carried out either by an employee or by an internal or external service provider that the DPO subcontracts for this purpose.
The DPO shall fully document and approve the destruction process. The applicable statutory requirements for the destruction of information, particularly requirements under applicable data protection laws, shall be fully observed.
Implementation
Implementation of this Policy shall be deemed effective as of January 1, 2025. No part of this Policy shall have retroactive effect and shall thus apply only to matters occurring on or after this date.
The DPO on a regular schedule and, if necessary, update this Policy.
Data Retention Schedule
The following types of documents will be retained for the following periods of time. At least one copy of each document will be retained according to the following schedule.
Corporate Records
Article of Incorporation | Permanent |
| Bylaws |
| Resolutions |
Board meeting minutes |
Tax or employee identification number designation |
Annual corporate filings |
Annual reports |
Licenses and Permits |
Materials with historic value (pictures, publications, etc.) |
Policies and Procedures | Current version with revision history |
Legal Records
Court Orders | Permanent |
Legal Memoranda and Opinions (including all subject matter files) | 10 years after close of the matter |
Litigation Files |
10 years after expiration of appeals or time for filing appeals, whichever
is later
|
Patent correspondence and supporting materials | 25 years after the patent is issued |
Requests for departure from Data Retention & Destruction Policy | 10 years |
Financial Records
Chart of Accounts Fiscal Policies and Procedures Audits Financial statements General Ledger | Permanent |
Check registers/books Business or employee expenses documents Bank deposit slips Cancelled checks Invoices Property/asset inventories | 7 years |
Investment records (deposits, earnings, withdrawals) | 7 years after sale of investment |
Petty cash receipts/documents Credit card receipts | 3 years |
Tax Records
Annual tax filings for the organization IRS or other government audit records Payroll registers | Permanent |
Filings of fees paid to professionals (IRS Form 1099 in the USA) Payroll tax withholdings Earnings records Tax bills Payroll tax returns W-2 statements | 7 years |
Personnel Records
Employee offer letters Confirmation of employment letters Benefits descriptions per employee Pension records | Permanent |
Employee applications and resumes Promotions, demotions, letter of reprimand, termination Job descriptions, performance goals Employee evaluations I-9 Forms | 7 years after separation |
Workers’ compensation records Salary ranges per job description | 5 years |
Time reports | 3 years after separation |
Insurance Records
Property insurance policy Directors and Officers insurance policy Workers’ Compensation insurance policy General Liability insurance policy Insurance claims applications Insurance disbursements / denials | Permanent |
Contracts
|
Insurance contracts
Employee contracts
Construction contracts
Legal correspondence
Non-disclosure agreements
Memorandums of understanding
Loan or mortgage contracts
Leases or deeds
|
Permanent |
Vendor contracts
| Warranties | 7 years after expiration |
Management Plans
Strategic plans | 7 years |
Budget plans Marketing plans | 3 years |
Routine Records
Certain records may be routinely destroyed, per the discretion each AxioSight department, unless subject to a legal inquiry, regulation, or other requirement as noted in the Data Retention & Destruction Policy.
Employee correspondence (including emails) | 5 years, then as needed |
Support documentation and related data Announcements and notices of routine meetings or events Requests for ordinary information, such as travel directions Reservations for internal meetings without charges or costs Message slips Duplicates such as CC and FYI copies, unaltered drafts, snapshot printouts, or extracts from databases AxioSight publications which are obsolete or superseded Trade magazines, vendor catalogues, flyers, and newsletters from vendors or other external organizations | As needed |
Transmission documents such as letters, fax cover sheets, e-mail messages, routing slips, and similar items that accompany other documents but do not add any value | As needed, unless the attached document falls under other retention rules, in which case that rule applies |
Any data received under non-disclosure, and any copies of that data, along with any materials incorporating or based on that data, should be destroyed immediately when a request is received by AxioSight from the disclosing party.