Effective Date: 01/08/2018

Last Revised: 10/11/2025

1. Purpose

This Data Retention & Deletion Policy defines how Datacore ERP Software LLC ("Company", "we", "our", or "us") manages, stores, and deletes client and user data throughout its lifecycle.

Our objective is to ensure that personal and business information is retained only as long as necessary for operational, legal, and contractual purposes and securely deleted when no longer required.

2. Scope

This policy applies to:

• All customers using Datacore ERP Software, CRM, and Client Portal systems.
• All digital data hosted on Datacore's cloud servers and authorized third-party service providers.
• All employees, contractors, and authorized team members who have access to client data for development, support, or maintenance purposes.

3. Data Retention Principles

Datacore ERP Software LLC adheres to the following principles:

• Purpose Limitation:
  Data is retained only for legitimate business or legal purposes.
• Storage Limitation:
  Data is stored only for as long as necessary to fulfill the purpose for which it was collected.
• Confidentiality and Integrity:
  All retained data is protected through encryption, restricted access, and periodic security audits.

4. Retention Periods

Retention duration may vary depending on the nature of the data and client relationship:

Data Type	Retention Period	Notes
Client Account Information	Active subscription period + 1 year	For reactivation or compliance queries
Financial Transactions & Invoices	Minimum 5 years	As required by UAE VAT and accounting laws
Support Logs & Communications	1 year	For service history and quality assurance
System Backups	Rolling 30 to 90 days	Automatically overwritten as part of backup cycle
Inactive Accounts	Up to 12 months post-expiry	Subject to client communication and renewal grace period

5. Data Deletion Process

When data reaches the end of its retention period, it is permanently deleted or anonymized following these steps:

• Client-Initiated Deletion:
  Clients may request full data deletion in writing to support@datacoreerp.com. Requests will be verified and processed within 30 working days, subject to legal and contractual obligations.
• Automated Deletion:
  Expired or inactive accounts are automatically queued for deletion after the retention period unless the client renews their subscription or requests data export.
• Secure Disposal:
  Data is removed from all primary and backup servers through secure wiping methods that prevent recovery.
• Verification:
  Deletion actions are logged and reviewed internally to confirm complete data removal from all storage layers.

6. Client Data Export

Before deletion, clients may request an export of their data in a standard readable format (e.g., Excel, CSV, or PDF). Export requests must be made within 30 days after account expiry.

After the retention period, recovery will not be possible, as data will be permanently erased.

7. Exceptions

Certain data may be retained beyond standard periods if:

• Required by applicable UAE tax or corporate laws.
• Needed for ongoing legal proceedings or investigations.
• Mandated under a contractual obligation with the client.

8. Responsibility and Access Control

Access to retained data is strictly limited to authorized core development, technical, and support team members. Each access event is logged and monitored for accountability.

9. Policy Review and Updates

This policy is reviewed annually or upon changes in relevant laws, regulations, or operational practices.

Updates will be published on our official website with the revised effective date.

10. Contact Us

For questions, data access, or deletion requests, please contact:

• 📧 support@datacoreerp.com
• 📞 +971 54 368 3021