DPA Annex E — Retention and Exit
Version: 2026-10-13-draft
1. Scope
Return/export, retention, deletion and backup periods remain to be agreed. The completed schedule must identify supported processes and lawful retention exceptions; this draft does not promise immediate self-service deletion or unrestricted export.
2. Agreed lifecycle schedule — must be completed
| Trigger / data type | Entitlement and permitted access | Export/return | Retention/deletion | Evidence / approval |
|---|---|---|---|---|
| Active paid subscription | Subscribed authorized modules/projects | Normal authorized in-app export where available | Retain during term according to law/Customer configuration | To be confirmed: active account retention policy |
| Trial expiry without conversion | To be confirmed: trial expired access policy | To be confirmed: trial export window days days, by To be confirmed: customer exit supported formats | To be confirmed: trial retention days days to next reviewed disposition | To be confirmed: trial lifecycle qa evidence |
| Cancellation at end of paid period | Continue through paid term, then To be confirmed: cancellation access policy | To be confirmed: termination export window days days | To be confirmed: primary data deletion days days after approved trigger | To be confirmed: cancellation lifecycle qa evidence |
| Unpaid/payment failure | To be confirmed: payment failure access policy | To be confirmed: payment failure export policy | To be confirmed: past due retention days days or agreed legal requirement | To be confirmed: payment lifecycle qa evidence |
| Tier/module downgrade | Retain higher-tier data but restrict unauthorized read/export; re-upgrade restores lawful access | Export only in authorized entitlements | To be confirmed: downgrade data retention policy | Source design; authenticated QA required |
| Specific user deprovisioning | Revoke eligible roles; preserve legitimate Project evidence | Company/Project authorised export as applicable | To be confirmed: user removal retention policy | To be confirmed: user offboard qa evidence |
| Company deletion request | Suspend irreversible work until authority and shared project rights verified | Operator-controlled export + approval | To be confirmed: company deletion workflow | To be confirmed: deletion qa evidence |
| Multi-organization shared Project | Preserve independent participants' legally retained records and audit trace | Governed by approved sponsor/member rights | To be confirmed: shared project retention policy | To be confirmed: customer project authority model |
| Safety/incident evidence | Access follows lawful personnel permissions and sensitive nature | Restricted subject to law and Project authority | To be confirmed: safety incident retention policy | To be confirmed: allowed injury data scope |
| Attachments and generated files | Scope by parent record and module entitlement | Include only approved objects | To be confirmed: storage object deletion policy | To be confirmed: file access qa evidence |
| Immutable/necessary audit, security and compliance logs | Least-access use for lawful reasons | Typically metadata-only; exceptions by law | To be confirmed: log retention days days or statutory schedule | To be confirmed: audit log retention evidence |
| Backups/replicas | Protected operational access only | Not normal self-service export | To be confirmed: backup max age days days, with To be confirmed: backup reentry process | To be confirmed: backup restore evidence |
| Billing and tax records | SiteAxis independent-controller legal basis | Subject to applicable lawful rights | To be confirmed: billing tax retention policy | To be confirmed: billing legal review |
3. Controlled return/export process
3.1 Customer submits a written request through To be confirmed: customer exit request channel naming authorized company, Project(s), custodian and permitted recipient. SiteAxis verifies authority and cross-company restrictions, then identifies available formats and scope, export constraints, fees To be confirmed: exit assistance fees and secure delivery route.
3.2 Exports must respect the most restrictive relevant Project/tenant authorization, lifecycle state, module entitlement and third-party confidentiality. An administrative role or possession of a link does not automatically grant authority to download another organization's records. Highly sensitive injury and witness data may require additional review.
3.3 Supported product export formats are To be confirmed: customer exit supported formats. Any custom package of files, PDFs, metadata, revision history, audit trails, schedules or attachments requires separately confirmed scope and implementation. The table does not promise complete machine-readable data portability unless validated.
4. Deletion and backup handling
4.1 Deletion shall be triggered only by an authorized request, elapsed contractual period or lawful retention rule, after an impact assessment concerning linked records, participating companies, open corrective actions, statutory records, tax/security logs and legal holds.
4.2 SiteAxis will document deletion status and evidence appropriate to law and approved policy; if a request cannot be fully honoured it will record the lawful basis or conflicting rights and limit access where appropriate.
4.3 Backup copies may persist until scheduled overwrite/expiry according to To be confirmed: backup max age days and provider controls. When an older backup is restored, previously deleted personal data must be re-subjected to approved deletion/restriction workflow To be confirmed: backup reentry process. The actual ability to identify and re-delete records after restore requires testing before this becomes a guarantee.
4.4 Legal holds or documented evidence-preservation duties do not excuse indefinite unrelated use or disclosure; retention must remain necessary, limited and reviewed.
5. Execution proof
Signed schedule revision: To be confirmed: exit schedule version · Runtime tests: To be confirmed: deletion qa evidence · Vendor backup terms: To be confirmed: backup restore evidence · Privacy officer: To be confirmed: privacy officer name · Counsel: To be confirmed: counsel approval reference.
Questions before controlled trial use?
Contact SiteAxis before sharing production customer data, provider secrets, or sensitive screenshots.