DPA Annex E — Retention and Exit
Version: 2026-11-08
1. Scope
Return/export, retention, deletion and backup periods remain to be agreed. The completed schedule must identify supported processes and lawful retention exceptions; this draft does not promise immediate self-service deletion or unrestricted export.
2. Agreed lifecycle schedule — must be completed
| Trigger / data type | Entitlement and permitted access | Export/return | Retention/deletion | Evidence / approval |
|---|---|---|---|---|
| Active paid subscription | Subscribed authorized modules/projects | Normal authorized in-app export where available | Retain during term according to law/Customer configuration | kept for the life of the subscription unless deleted by an authorized user |
| Trial expiry without conversion | read-only access to existing records until a plan is purchased or the retention period ends | 30 days, by the in-product exports (CSV/XLSX/PDF) and original uploaded files | 90 days to next reviewed disposition | Internal record, available to customers on request |
| Cancellation at end of paid period | Continue through paid term, then full access until the end of the paid period, then read-only access for 30 days | 30 days | 90 days after approved trigger | Internal record, available to customers on request |
| Unpaid/payment failure | a 14-day grace period with email reminders, then read-only access until payment is made | exports remain available to administrators during read-only access | 90 days or agreed legal requirement | Internal record, available to customers on request |
| Tier/module downgrade | Retain higher-tier data but restrict unauthorized read/export; re-upgrade restores lawful access | Export only in authorized entitlements | records in modules removed by a downgrade are kept read-only and are not deleted | Source design; authenticated QA required |
| Specific user deprovisioning | Revoke eligible roles; preserve legitimate Project evidence | Company/Project authorised export as applicable | the user's access ends; records they created remain with the project | Internal record, available to customers on request |
| Company deletion request | Suspend irreversible work until authority and shared project rights verified | Operator-controlled export + approval | a verified written request from an authorized administrator to privacy@siteaxis.app | Internal record, available to customers on request |
| Multi-organization shared Project | Preserve independent participants' legally retained records and audit trace | Governed by approved sponsor/member rights | kept while any participating organization with rights to the project remains subscribed, subject to Section 9.4 of the DPA | the project roles configured in the account |
| Safety/incident evidence | Access follows lawful personnel permissions and sensitive nature | Restricted subject to law and Project authority | kept for the subscription term; customers are responsible for statutory retention periods (for example under the Ontario Occupational Health and Safety Act) | work-related injury descriptions, affected body part, first-aid or medical-attention indicator and witness statements; no health-card numbers or medical records |
| Attachments and generated files | Scope by parent record and module entitlement | Include only approved objects | files are deleted from storage with their records, then from backups as backups expire | Internal record, available to customers on request |
| Immutable/necessary audit, security and compliance logs | Least-access use for lawful reasons | Typically metadata-only; exceptions by law | 365 days or statutory schedule | Internal record, available to customers on request |
| Backups/replicas | Protected operational access only | Not normal self-service export | 30 days, with if a backup is restored, deleted data is removed again before the system returns to service | Internal record, available to customers on request |
| Billing and tax records | SiteAxis independent-controller legal basis | Subject to applicable lawful rights | invoices and billing records kept for 7 years as required by Canadian tax law | Internal record, available to customers on request |
3. Controlled return/export process
3.1 Customer submits a written request through privacy@siteaxis.app naming authorized company, Project(s), custodian and permitted recipient. SiteAxis verifies authority and cross-company restrictions, then identifies available formats and scope, export constraints, fees no fee for standard exports; custom extracts quoted in advance and secure delivery route.
3.2 Exports must respect the most restrictive relevant Project/tenant authorization, lifecycle state, module entitlement and third-party confidentiality. An administrative role or possession of a link does not automatically grant authority to download another organization's records. Highly sensitive injury and witness data may require additional review.
3.3 Supported product export formats are the in-product exports (CSV/XLSX/PDF) and original uploaded files. Any custom package of files, PDFs, metadata, revision history, audit trails, schedules or attachments requires separately confirmed scope and implementation. The table does not promise complete machine-readable data portability unless validated.
4. Deletion and backup handling
4.1 Deletion shall be triggered only by an authorized request, elapsed contractual period or lawful retention rule, after an impact assessment concerning linked records, participating companies, open corrective actions, statutory records, tax/security logs and legal holds.
4.2 SiteAxis will document deletion status and evidence appropriate to law and approved policy; if a request cannot be fully honoured it will record the lawful basis or conflicting rights and limit access where appropriate.
4.3 Backup copies may persist until scheduled overwrite/expiry according to 30 and provider controls. When an older backup is restored, previously deleted personal data must be re-subjected to approved deletion/restriction workflow if a backup is restored, deleted data is removed again before the system returns to service. The actual ability to identify and re-delete records after restore requires testing before this becomes a guarantee.
4.4 Legal holds or documented evidence-preservation duties do not excuse indefinite unrelated use or disclosure; retention must remain necessary, limited and reviewed.
5. Execution proof
Signed schedule revision: 2026-11-08 · Runtime tests: Internal record, available to customers on request · Vendor backup terms: Internal record, available to customers on request · Privacy officer: the SiteAxis Privacy Officer (privacy@siteaxis.app) · Counsel: Internal record, available to customers on request.
Questions about these documents?
Contact the SiteAxis team for help with a policy or agreement.