Legal Document

PULSEBUILD PTY LTD – AUSTRALIAN DATA RETENTION AND DISPOSAL POLICY

Pulsebuild Pty Ltd (ACN 694 426 483) is committed to maintaining complete, accurate and high-quality records and documents. We recognise the need to:

preserve records and make them accessible over time to meet our business needs and meet community expectations; and
ensure that records are retained only for as long as required to maximise business productivity, minimise costs and reduce any risks associated with retaining information protected by Australian privacy laws.

You play a key role in helping us to retain, store and dispose of documents and data that relate to the Pulsebuild business. We have developed this Document Retention Policy (Policy) to help you understand how you should handle and manage the documents and data that you use or have access to in the course of your employment or other contractual arrangement with us.

The aim of this Policy is to help you to understand Pulsebuild obligations in retaining and storing documents in Australia and to provide you with guidance on when and how documents may be disposed of.

Background

We have established this Policy and appointed a Data Retention Officer who will be responsible for data retention issues, contact details are as follows:

Name: [Andrew Chen]
Email: [ac@pulsebuild.ai]
Phone: [+61436910649]

You are required to comply with any directions and requests from the Data Retention Officer and the provisions of this Policy (and any updates made by us from time to time) as part of working with Pulsebuild. Any suspicion of a breach of this Policy should be immediately reported to the Data Retention Officer. Please read this Policy carefully and let us know if you have any questions.

We may update this Policy from time to time. When we update this Policy, we will provide you with the amended version, for you to read and comply with.

What documents does this policy apply to?

The Policy applies to all physical and electronic records generated in the course of Pulsebuild's operations, including both original documents and any copies and any emails, video, audio, photographs and data generated by, or received by, our systems.

Storage of documents

We recognise the need to have a system in place to store and easily identify where documents and records are. If you are ever unsure about where or how a document should be stored, you should contact the Data Retention Officer for guidance.

Document and data retention periods

At a minimum, you must retain the documents listed below for the periods of time set out. The table reflects our legal obligations and company policies for document retention, however, any decisions regarding document disposal should be made in light of the general guidelines in this Policy. Please note that the information listed in the table below is intended as a guideline and may not contain all the records Pulsebuild may be required to keep in the future.

Failure to follow this policy can result in possible civil and criminal sanctions against Pulsebuild and its officers, directors and employees, and possible disciplinary action against responsible individuals, up to and including termination of employment.

We hope that this Policy makes it easier for you to understand how long to retain documents for. If you are unsure about what to do in a specific situation, please contact our Data Retention Officer.

1. Accounting and finance

Record	Retention Period
Financial records, being any document that records and explains our financial position and performance, and enables accurate financial statements to be prepared and audited, including: invoices and statements received and paid; any unpaid invoices; credit applications receipts; cheques (including dishonoured cheques); financial statements (including profit and loss statements, balance sheets, depreciation schedules and taxation returns); bank statements and loan documents; cash records - this includes cash receipts, records of bank deposits, petty cash books, and cheque butts; merchant summary; sales and debtor records; books of prime entry; business activity statements; and working papers and other financial documents.	7 years from the date the transaction covered by the record is complete Note: These records can be electronic, but they must be able to be converted into hard copy (for example: printed as paper copies).
Australian Tax Office (ATO) records, being any document that records and explains any income tax or ATO related transactions or any document that could be used as evidence to show how you arrived at figures used in any ATO related dealings. ATO records include: corporate tax records including - income, expenses, liabilities, assets (including substantiation for work, car and business travel expenses), and records containing particulars of any election, estimate, determination or calculation (and the basis on which they were made); year-end records - list of debtors and creditors, stock take sheets and depreciation schedules; goods and services (GST) records - including tax invoices from suppliers; and fringe benefits tax records.	5 years from the last relevant transaction Note: Records must be in English and in a format accessible to the Australian Tax Office (ATO). If you use information from a record in a tax return in one financial year and then use that information again in a future return, you need to keep that record for another 5 years.
Records of depreciating assets	For depreciating assets, you generally need to keep the record for as long as you have the asset for, and then another five years after you sell, or otherwise dispose of, the asset. However, there are different time periods and requirements that apply if the depreciating asset is in a low-value pool or is subject to rollover relief.
Capital Gains Tax (all records relevant to an asset)	For capital gains tax (CGT) assets, you generally need to keep the record for as long as you have the asset, and then another five years after you sell, or otherwise dispose of, the asset.

2. Company documents

Record	Retention Period
Company documents, being all documents relating to the creation and ongoing governance of the company, including: Company constitution; Shareholders Agreement; Certificate of Company Incorporation; Certificate of Business Names Registration; Minutes of Meetings: General Meetings / Directors / Committees; Original Annual Financial Report and Auditors' Reports; Registers of Directors, Company Secretaries, Members and Shares Inter-company transactions; and Company resolutions.	Permanently
Records lodged electronically with ASIC	7 years from the date they were filed

Record

Retention Period

Company documents, being all documents relating to the creation and ongoing governance of the company, including:

Company constitution;
Shareholders Agreement;
Certificate of Company Incorporation;
Certificate of Business Names Registration;
Minutes of Meetings: General Meetings / Directors / Committees;
Original Annual Financial Report and Auditors' Reports;
Registers of Directors, Company Secretaries, Members and Shares Inter-company transactions; and
Company resolutions.

Permanently

Records lodged electronically with ASIC

7 years from the date they were filed

3. Employee records

Record	Retention Period
Employee records, being any document that relates to any employment relations between Pulsebuild and an employee, including: details of the employer and employee, including the ABN of the employer; general information regarding an employee's employment e.g. names, type of employee (casual, full-time, part-time), commencement date, end date etc; details of an employee's pay, including rate, gross/net amounts, any deductions, and any incentive-base pay such as bonuses or commissions; hours of work, plus any penalty rates or loading for overtime; leave; superannuation contributions; any transfer of business; a guarantee of annual earnings; if the employee has been terminated, details surrounding the termination of the employment; employee expenses; and individual flexibility agreements. Legislative Reference: Fair Work Act 2009 (Cth) s535, 539 Fair Work Regulations 2009 (Cth) r.3.31-3.44, r4.01A	7 years from the end of the financial year when the document was created. Note: These records must be in a form that is readily accessible to a Fair Work Inspector. They must be in a legible form and in English (preferably in plain, simple English). They must not be altered unless for the purposes of correcting an error. They must not be false or misleading to the employer's knowledge.

Record

Retention Period

Employee records, being any document that relates to any employment relations between Pulsebuild and an employee, including:

details of the employer and employee, including the ABN of the employer;
general information regarding an employee's employment e.g. names, type of employee (casual, full-time, part-time), commencement date, end date etc;
details of an employee's pay, including rate, gross/net amounts, any deductions, and any incentive-base pay such as bonuses or commissions;
hours of work, plus any penalty rates or loading for overtime;
leave;
superannuation contributions;
any transfer of business;
a guarantee of annual earnings;
if the employee has been terminated, details surrounding the termination of the employment;
employee expenses; and
individual flexibility agreements.

Legislative Reference:

Fair Work Act 2009 (Cth) s535, 539

Fair Work Regulations 2009 (Cth) r.3.31-3.44, r4.01A

7 years from the end of the financial year when the document was created.

Note:

These records must be in a form that is readily accessible to a Fair Work Inspector.
They must be in a legible form and in English (preferably in plain, simple English).
They must not be altered unless for the purposes of correcting an error.

They must not be false or misleading to the employer's knowledge.

4. Legal

Record	Retention Period
Documents shared with, or received from, any legal advisor, including any advice and all correspondence, relating to any existing, previous or future matter.	Permanently
Legal documents, including: any document or correspondence that relates to current litigation; any document or correspondence that was previously involved in litigation; and any document or correspondence that you think may be required for litigation in the future.	Permanently
Contracts, leases and insurance policies (still in effect)	Permanently
Agreements (expired)	6 years from the date the transaction has completed
Deeds	Where the governing law of a deed is Victoria or South Australia, 15 years from the date the transaction has completed. Where the governing law of a deed is any other state or territory, 12 years from the date the transaction has completed.
Trade Mark registrations and related documents	10 years from the filing date of registration
Leases (expired)	6 years from the date the transaction has completed
Insurance policies (expired)	6 years from the date the policy expires
Insurance records, current accident reports, claims, policies, and the like	Permanently
Audit reports	Permanently

5. Personal Information

Record	Retention Period
'Personal Information' (as defined under the Privacy Act 1988 (Cth)) means any information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not. Examples of Personal Information include: names; email addresses; financial information and transaction data of customers; and payment details of individuals.	We have a legal obligation to keep identifiable Personal Information for no longer than required to fulfil any purpose for which the Personal Information may be legally used or disclosed. Once Personal Information is no longer required we must delete the Personal Information or de-identify the Personal Information. Personal information should never be kept just in case there may be a future use for it. Two exceptions apply to the retention of Personal Information. We should not delete it if it is in a Commonwealth record or if we are required by Australian law, or a court/tribunal order to retain the Personal Information. When assessing whether to retain Personal Information, you take the following steps: Ask what the purpose of collecting, using and disclosing the Personal Information was. Ask whether the need to use or disclose the Personal Information for those purposes has ended. If yes, the Personal Information should be deleted. As part of this decision-making process, consider whether there is an authorised secondary purpose for using or disclosing the Personal Information, such as a legal, accounting or reporting obligation which requires that you retain the Personal Information. If the need to use the Personal Information for the purposes has not ended, then the information can be retained for those purposes but should continue to be stored securely. Regularly review retention of Personal Information against these criteria. If a decision is made to delete Personal Information, and this information is stored in an electronic record, then it must be deleted securely, including all backup versions and should be done with the assistance of our IT department or external IT service providers, to ensure the electronic records are all correctly deleted and are not retrievable. As best practice, we should keep high level records of our privacy decisions and processes for the purpose of keeping track of how we handle Personal Information. Any records we keep will also be useful if we receive any privacy complaints or need to respond to any communication from any privacy regulatory authority.

Record

Retention Period

'Personal Information' (as defined under the Privacy Act 1988 (Cth)) means any information or an opinion about an identified individual, or an individual who is reasonably identifiable:

whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.

Examples of Personal Information include:

names;
email addresses;
financial information and transaction data of customers; and
payment details of individuals.

We have a legal obligation to keep identifiable Personal Information for no longer than required to fulfil any purpose for which the Personal Information may be legally used or disclosed. Once Personal Information is no longer required we must delete the Personal Information or de-identify the Personal Information. Personal information should never be kept just in case there may be a future use for it.

Two exceptions apply to the retention of Personal Information. We should not delete it if it is in a Commonwealth record or if we are required by Australian law, or a court/tribunal order to retain the Personal Information.

When assessing whether to retain Personal Information, you take the following steps:

Ask what the purpose of collecting, using and disclosing the Personal Information was.
Ask whether the need to use or disclose the Personal Information for those purposes has ended.
If yes, the Personal Information should be deleted. As part of this decision-making process, consider whether there is an authorised secondary purpose for using or disclosing the Personal Information, such as a legal, accounting or reporting obligation which requires that you retain the Personal Information.
If the need to use the Personal Information for the purposes has not ended, then the information can be retained for those purposes but should continue to be stored securely.
Regularly review retention of Personal Information against these criteria.

If a decision is made to delete Personal Information, and this information is stored in an electronic record, then it must be deleted securely, including all backup versions and should be done with the assistance of our IT department or external IT service providers, to ensure the electronic records are all correctly deleted and are not retrievable.

As best practice, we should keep high level records of our privacy decisions and processes for the purpose of keeping track of how we handle Personal Information. Any records we keep will also be useful if we receive any privacy complaints or need to respond to any communication from any privacy regulatory authority.

6. Other business records

Record	Retention Period
Marketing materials	2 years
Internal emails	2 years
Emails with customers	2 years

Access and Deletion

1. General considerations

Above, we have outlined the minimum time periods that documents must be retained for. When deciding whether or not to dispose of a document or data, a number of issues need to be considered.

whether the document or data holds any significance;
where the information came from, why it was collected and whether the purpose is still relevant;
any relevant statutory obligations to retain documents for a particular period of time;
whether the documents may be relevant in current or future court proceedings; and
whether destruction could lead a court to infer adverse inferences.

2. How to respond to a client request for deletion

Since there is no concrete or explicit right to delete information upon request, each request from a client should be considered carefully. You must make contact with the Data Retention Officer immediately regarding a request for deletion.

The Data Retention Officer will consider the request with you and apply the guidelines described above.

3. Disposal of documents and data

Once a decision is made to dispose of documents or data, the way the document will be disposed of will depend on the type of document that is being disposed.

Sensitive information must be confidentially destroyed and, if stored electronically, be subject to secure electronic deletion.

4. Suspending disposal of documents and data

From time to time, and for any reason, the Data Retention Officer may issue a notice suspending destruction of records or documents, including due to pending or reasonably foreseeable litigation, audits or investigations.