ISHA – The Hip Preservation Society Data Retention Policy
ISHA – The Hip Preservation Society (ISHA) seeks to ensure that it retains only data necessary to effectively conduct its membership services, programme activities and work in fulfilment of its purpose.
The need to retain data varies widely with the type of data and the purpose for which it was collected. ISHA – The Hip Preservation Society (ISHA) strives to ensure that data is only retained for the period necessary to fulfil the purpose for which it was collected and is fully deleted when no longer required. This policy sets forth ISHA – The Hip Preservation Society (ISHA)’s guidelines on data retention and is to be consistently applied throughout the organisation.
This policy covers all data collected by ISHA – The Hip Preservation Society (ISHA) and stored on ISHA – The Hip Preservation Society (ISHA) owned or leased systems and media, or officially contracted third party agent owned or leased systems and media, regardless of location. It applies to both data collected and held electronically (including photographs, video and audio recordings) and data that is collected and held as hard copy or paper files. The need to retain certain information may be mandated by federal or local law, federal regulations and legitimate business purposes, as well as the EU General Data Protection Regulation (GDPR).
Reasons for data retention
ISHA – The Hip Preservation Society (ISHA) retains only that data that is necessary to effectively conduct its programme activities, fulfil its mission and comply with applicable laws and regulations.
Reasons for data retention include:
- Providing an ongoing membership, and educational, training and research support service to the data subject (e.g. sending a newsletter, information pertaining to the subject’s membership, publication or ongoing programme updates to an individual, ongoing training or participation in ISHA – The Hip Preservation Society (ISHA)’s programmes, information provided by Society partner organisations, surveys and educational information relative to hip preservation); the same shall apply to “Friends of ISHA” subscriptions
- Compliance with applicable laws and regulations associated with financial and programmatic reporting by ISHA – The Hip Preservation Society (ISHA) to its funding agencies and other donors
- Compliance with applicable employment, tax and immigration laws
- Other regulatory requirements
- Security incident or other investigation
- Intellectual property preservation
ISHA – The Hip Preservation Society (ISHA) seeks to avoid duplication in data storage whenever possible, though there may be instances in which for programmatic or other business reasons it is necessary for data to be held in more than one place. This policy applies to all data in ISHA – The Hip Preservation Society (ISHA)’s possession, including duplicate copies of data.
- Website Visitor data will be retained as long as necessary to provide the service requested/initiated through the ISHA – The Hip Preservation Society (ISHA) website.
- Contributor data will be retained for the year in which the individual has contributed and then for two years after the date of the last contribution / membership subscription. Financial information will not be retained longer than is necessary to process a single transaction. If you leave a comment on the ISHA website(s), the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.
- Event Participant data will be retained for the period of the event, including any follow up activities, such as the distribution of reports, plus a period of 7 years if this data includes financial information.
- Programme Participant data (including sign in sheets) will be retained for the duration of the grant agreement that financed the programme, plus any additional time required under the terms of the grant agreement.
- Personal data of subgrantees, subcontractors and vendors will be kept for the duration of the contract or agreement.
- Employee / Contractor data will be held for the duration of employment / contract and then for 7 years after the last day of employment.
- Volunteer Leadership data, including interview notes of unsuccessful applicants, will be held for 5 years after the closing of the position recruitment process.
- Consultant (both paid and pro bono) data will be held for the duration of the consulting contract, plus for 7 years after the end of the consultancy.
- Board Member data will be held for the duration of service on the Board, plus for 5 years after the end of the member’s term.
- Data associated with tax payments (including payroll, corporate and VAT) will be held for 7 years.
- Operational data related to programme proposals, reporting and programme management will be held for the period required by the ISHA – The Hip Preservation Society (ISHA) donor, but not more than 5 years.
Data destruction ensures that ISHA – The Hip Preservation Society (ISHA) manages the data it controls and processes it in an efficient and responsible manner. When the retention period for the data as outlined above expires, ISHA – The Hip Preservation Society (ISHA) will actively destroy the data covered by this policy. If an individual believes that there exists a legitimate business reason why certain data should not be destroyed at the end of a retention period, he or she should identify this data to his/her supervisor and provide information as to why the data should not be destroyed. Any exceptions to this data retention policy must be approved by ISHA – The Hip Preservation Society (ISHA)’s data protection officer in consultation with legal counsel. In rare circumstances, a litigation hold may be issued by legal counsel prohibiting the destruction of certain documents. A litigation hold remains in effect until released by legal counsel and prohibits the destruction of data subject to the hold.