Data Retention and Deletion Policy

DATA RETENTION AND DELETION POLICY

1. Purpose

This Policy explains how long KMC retains personal information and how information is securely deleted or de-identified when it is no longer required.

2. Retention principle

KMC will not retain personal information for longer than is required for the purposes for which the information may lawfully be used, unless retention is required or permitted by law.

3. Candidate accounts

Active candidate profile information may be retained while:

• the candidate maintains an active account;

• the candidate is participating in recruitment;

• the information is required to provide KMC services.

4. Inactive candidates

Where a candidate becomes inactive, KMC may retain relevant information for a limited period for legitimate recruitment, legal, security or recordkeeping purposes.

KMC should review inactive candidate accounts periodically.

5. Unsuccessful applications

Information relating to unsuccessful applications may be retained for a reasonable period where required for:

• recruitment administration;

• dispute management;

• legal obligations;

• audit purposes;

• future recruitment where permitted.

6. Employer information

Employer and vacancy information may be retained for the period reasonably required to:

• provide recruitment services;

• administer agreements;

• maintain business records;

• manage disputes;

• comply with legal obligations.

7. Communications

KMC may retain relevant communications for as long as reasonably necessary to:

• provide services;

• maintain records;

• investigate complaints;

• meet legal obligations;

• protect KMC and its users.

8. Security and technical logs

Security logs and technical records may be retained for a period appropriate to security, fraud prevention, troubleshooting and legal requirements.

9. Deletion

When personal information is no longer required, KMC will take reasonable steps to securely delete, destroy or de-identify it.

10. Backups

Information may remain temporarily in secure backup systems after deletion from active systems.

Where practical, deleted information will be removed from backups in accordance with the applicable backup lifecycle.

11. Legal holds

KMC may retain information beyond normal retention periods where reasonably necessary because of:

• legal proceedings;

• regulatory investigations;

• disputes;

• contractual obligations;

• fraud investigations;

• other legal requirements.

12. Retention schedule

KMC should maintain an internal retention schedule specifying the retention period for each category of information.

The schedule should be reviewed periodically.

13. Review

This Policy will be reviewed periodically and when KMC introduces significant new technology, services or categories of personal information.