Xoxoday Empuls formally sets and documents data retention periods through its Data Retention and Disposal Policy, ensuring personal data is held only as long as necessary and securely disposed of in line with GDPR requirements when those periods expire.
Formal Data Retention Policy
Xoxoday Empuls operates a documented Data Retention and Disposal Policy that defines how long different categories of employee and organisational data are stored. This policy is formally approved, reviewed at least annually, and aligned with Xoxoday Empuls’s broader Information Security Management System (ISMS), which is structured around ISO 27001 and SOC 2 Type II controls. Each data category within Xoxoday Empuls carries either a specific retention period or a defined set of criteria used to determine when data is no longer required. Employee recognition activity data, reward transaction records, and engagement survey responses are each governed by separate retention rules tied to their original processing purpose. When that purpose is fulfilled, the data does not persist indefinitely.How Retention Is Enforced
Xoxoday Empuls mandates secure disposal once a retention period expires or a valid erasure request is received. This includes secure electronic deletion for digital records and, where applicable, physical shredding for printed materials. These disposal actions are documented to maintain an auditable trail. For organisations integrating Xoxoday Empuls with HR platforms such as Workday, SAP SuccessFactors, or Darwinbox, data imported via API or file sync is subject to the same retention framework. Retention schedules apply regardless of the channel through which data was originally ingested.DPO Oversight and GDPR Alignment
Compliance with data retention rules is overseen by Xoxoday Empuls’s Data Protection Officer (DPO). The DPO monitors adherence as part of a GDPR-aligned privacy programme and the ISMS review cycle. Retention periods are not merely documented on paper — they are actively tracked and enforced as a governance obligation. For organisations subject to data protection regulations under GDPR, UK GDPR, or equivalent local frameworks, Xoxoday Empuls’s structured approach to retention directly supports the principle of storage limitation. Data is not held beyond what is necessary, reducing regulatory risk exposure for your organisation.Annual Review Cadence
The Data Retention and Disposal Policy is reviewed at minimum once per year. This ensures retention periods remain appropriate as product capabilities evolve, new data categories are introduced, or regulatory guidance changes. Any policy updates are cascaded across operational procedures to maintain consistency between documentation and practice. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](How does Xoxoday Empuls handle data retention and deletion?
Understand how Xoxoday Empuls processes valid erasure requests and securely disposes of personal data under GDPR and equivalent frameworks.
Is Empuls ISO 27001 and SOC 2 certified?
Learn about Xoxoday Empuls’s ISO 27001 and SOC 2 Type II certifications and how they underpin the platform’s information security controls.